ISO 42001 vs NIST AI RMF: Which Do You Need?

Sooner or later a customer’s security review asks how you govern AI. Usually it arrives as one of two questions: “Do you follow the NIST AI Risk Management Framework?” or “Are you ISO 42001 certified?” Both are reasonable questions, and they are not asking for the same thing.

The short answer is that the NIST AI RMF and ISO/IEC 42001 are not competitors. One is a framework for thinking about AI risk. The other is a standard for a management system that an independent auditor can certify. Most companies that take AI governance seriously end up using both, and the trick is to do the work once.

This guide is for the founder, operations lead or quality and security manager who has to decide what to do first, without a full-time AI governance team.

The fundamental difference: framework vs certifiable standard

The NIST AI RMF is a voluntary framework. The National Institute of Standards and Technology released version 1.0 on January 26, 2023. It describes how to think about, measure and manage AI risk, and it gives you a shared vocabulary for doing so. There is no certificate. Nobody audits you against it and issues a pass or a fail.

ISO/IEC 42001 is a certifiable international standard. Published on December 18, 2023, it specifies the requirements for an AI management system, usually shortened to AIMS. You build the system, and an accredited certification body audits it and issues a certificate that customers can verify.

One gives you a way of thinking. The other gives you a system, plus independent proof that it works. That difference drives nearly everything else.

The NIST AI RMF in brief

The framework is organized around four functions:

• Govern: the culture, policies and accountability that make AI risk management possible.
• Map: understanding the context of each AI system and the risks it could create.
• Measure: analyzing and tracking those risks.
• Manage: prioritizing and acting on them.

NIST publishes a companion playbook with suggested actions, and on July 26, 2024, it added a profile for generative AI (NIST AI 600-1). NIST also says the framework is being revised as part of the White House AI Action Plan, so expect an update.

Its strengths are its flexibility and its standing in the US. Its limit, for a company trying to win a customer’s trust, is that adopting it produces no independent evidence. You can say you follow it, and the buyer has to take your word for it.

ISO/IEC 42001 in brief

ISO/IEC 42001 follows the same structure as ISO 9001 and ISO/IEC 27001: context, leadership, planning, support, operation, performance evaluation and improvement. On top of that structure it adds what is specific to AI: an AI policy, AI risk assessment and treatment, an assessment of the impact your AI systems have on people and groups, and 38 reference controls in Annex A across nine areas, from data for AI systems to relationships with suppliers and customers.

You decide which Annex A controls apply and record that decision in a Statement of Applicability. An accredited certification body then audits the system in two stages. Certification runs on a three-year cycle with annual surveillance audits.

It applies whether you build AI or only use it. A company that uses AI tools internally can be certified, with a lighter system than a company that develops AI products.

Side by side

	NIST AI RMF	ISO/IEC 42001
What it is	Voluntary framework	International management system standard
Published by	NIST (US government)	ISO and IEC
First released	January 26, 2023	December 18, 2023
Certifiable	No	Yes, by accredited certification bodies
What a buyer gets	Your statement that you follow it	A certificate an auditor has issued
Structure	Four functions: Govern, Map, Measure, Manage	Clauses 4 to 10 plus 38 Annex A controls
Fits with	Other NIST frameworks, such as the Cybersecurity Framework	ISO 9001 and ISO/IEC 27001

Which one do you need?

If customers are asking for proof, ISO/IEC 42001. Enterprise procurement and security reviews increasingly want independent evidence, and a certificate is the form they recognize. This is especially true if you already hold ISO/IEC 27001 or ISO 9001, because the AI management system extends the system you have.

If you need a common language for AI risk inside the company, start with the NIST AI RMF. It is free, flexible and widely understood by US engineers, risk teams and government buyers. It is a good way to organize the conversation before you build anything formal.

If you are thinking about the law, be careful with both. Neither one is legal compliance.

• Texas: the Texas Responsible AI Governance Act, in force since January 1, 2026, gives a business some protection from liability if it finds a violation itself and substantially complies with NIST’s AI framework or another nationally or internationally recognized AI risk management framework. Whether a particular ISO/IEC 42001 system counts as “another recognized framework” is a question for your counsel.
• Colorado: the 2024 AI Act, which named ISO/IEC 42001, was repealed and replaced in May 2026 by a narrower law that takes effect on January 1, 2027.
• EU: ISO/IEC 42001 is not a harmonized standard under the EU AI Act, so certification does not create a presumption of conformity with the Act.

We keep a dated summary of where each rule stands in ISO 42001 and AI laws.

How to use both without doing the work twice

The two fit together more naturally than most comparisons suggest. The NIST functions map onto parts of an ISO/IEC 42001 system:

• Govern lines up with the leadership, policy, roles and competence requirements.
• Map lines up with understanding your context, your AI inventory and the AI system impact assessment.
• Measure and Manage line up with AI risk assessment and treatment, monitoring, internal audit and corrective action.

So a practical sequence is:

1. Inventory your AI. List the AI systems you build, sell and use, including the AI features inside software you already pay for. Most companies find more than they expected.
2. Use NIST’s vocabulary to assess the risks. The four functions and the playbook are a good way to structure the first conversations with engineering, legal and operations.
3. Build the system to ISO/IEC 42001. Turn that thinking into an AI policy, owners, a repeatable risk and impact assessment, a Statement of Applicability and the controls behind it.
4. Decide on certification when a customer or a deal makes it worth it. The system is valuable on its own; the certificate is what makes it visible to buyers.

Done in that order, the NIST work is not wasted when you certify, and your ISO/IEC 42001 system can answer a NIST-framed question from a customer as easily as an ISO-framed one.

Common mistakes

• Treating either one as legal compliance. Neither is a law, and certification is not a legal safe harbor unless a specific law says so.
• Starting with controls instead of an inventory. You cannot decide which controls apply until you know which AI systems you have and what role you play in each.
• Building a second management system. If you already run ISO/IEC 27001 or ISO 9001, extend it. One set of policies, one internal audit program and one management review are easier to run and easier to defend.
• Buying a template. A Statement of Applicability or impact assessment that describes someone else’s AI is easy for an auditor to spot, and of no use to you.

Where we fit

We build ISO/IEC 42001 AI management systems for companies that build or use AI, and we use the NIST AI RMF where it helps. Engagements are led by an ISO/IEC 42001 lead auditor, start with an AI inventory and gap analysis, and integrate with ISO/IEC 27001 or ISO 9001 when you already hold them. See ISO 42001 consulting, or start a conversation.