NIST AI RMF vs ISO 42001: How They Fit Together
The NIST AI Risk Management Framework and ISO/IEC 42001 are often mentioned together. Here is how they differ, where they overlap and how to use them side by side.
In this article
When teams start taking AI governance seriously, two names appear again and again: the NIST AI Risk Management Framework and ISO/IEC 42001. Both aim to help organisations manage AI responsibly. They are not the same thing, and they are not competitors.
Understanding the difference saves a lot of confusion. One is a flexible framework for thinking about AI risk. The other is a management system standard you can be certified against. This guide compares them and explains how many teams use both.
1. Two different kinds of document
The NIST AI Risk Management Framework, often shortened to AI RMF, comes from the US National Institute of Standards and Technology. It is voluntary guidance. It organises AI risk management into four functions: Govern, Map, Measure and Manage. It is designed to be adapted to many kinds of organisation and AI system.
ISO/IEC 42001:2023 is the international standard for an AI management system. It sets requirements that an organisation must meet, using the familiar management system structure of context, leadership, planning, operation, evaluation and improvement. An accredited certification body can audit an organisation against it.
| NIST AI RMF | ISO/IEC 42001:2023 | |
|---|---|---|
| Purpose | Guidance for managing AI risk | Requirements for an AI management system |
| Structure | Four functions: Govern, Map, Measure, Manage | Management system clauses plus reference controls |
| Can you be certified? | No, it is voluntary guidance | Yes, through an accredited certification body |
| Who issues it | US National Institute of Standards and Technology | ISO and IEC |
| Typical use | Shaping how teams think about and assess AI risk | Running and proving a governance system |
In short, the AI RMF helps you think well about AI risk. ISO 42001 helps you run a system that manages it, and show others that you do.
NIST also publishes companion material with suggested actions for each function. Many teams borrow from it when they design their own assessments, even if they never mention the framework to customers.
2. Where they overlap
The two documents share a lot of ground. Both expect clear accountability for AI. Both ask you to understand the context in which an AI system is used and who it affects. Both expect risks to be identified, assessed and treated, and both expect ongoing monitoring.
The four AI RMF functions map loosely onto parts of an ISO 42001 management system. Govern relates to leadership, policy and roles. Map relates to understanding context and AI systems. Measure relates to assessing and testing risks and performance. Manage relates to treating risks and responding to issues. The mapping is not exact, but it is close enough to let one support the other.
3. Using them together
A common pattern is to adopt ISO 42001 as the backbone and use the AI RMF as a source of practical guidance inside it. The standard tells you that you need an AI risk assessment. The framework, and its companion materials, offer detailed ideas on what to consider during that assessment.
Another pattern suits organisations that are not ready for certification. They start with the AI RMF to build shared language and basic practices: an inventory, roles, a risk assessment method and monitoring. Later, if customers or partners ask for independent assurance, they formalise these practices into an ISO 42001 management system.
Choose based on your audience. If your customers are mainly in the United States and talk about the AI RMF in their questionnaires, using its language helps. If your customers want a certificate, or you already run ISO 27001, ISO 42001 is the natural home. Many organisations end up referring to both.
Whatever you choose, keep the documentation practical. One AI inventory, one risk method and one set of roles should serve both. Avoid creating separate paperwork for each framework, which doubles the effort without improving safety.
Keep an eye on change, too. Both documents may be updated as AI practice develops. Note which version you used, review it from time to time, and record the decision in your AI policy so that everyone works from the same reference.
Be clear about what each one gives you. Following the AI RMF does not, by itself, satisfy a specific law, and an ISO 42001 certificate is not a legal approval. Both are good practice that makes legal work easier, but always check the actual requirements that apply to you.
For a hands-on view of the basics, see our practical AI governance framework. If you want to plan an approach that uses one or both, our ISO 42001 consulting team would be glad to talk it through.