NIST AI RMF vs ISO 42001: Which One Actually Gets You Certified?

What is NIST AI RMF?

The NIST AI Risk Management Framework (AI RMF) is a voluntary framework developed by the US National Institute of Standards and Technology (NIST), part of the US Department of Commerce. Published on 26 January 2023, it helps organisations identify and manage AI risks across design, development, deployment and use.

It is intended for organisations of different sizes and sectors. Internal risk, product and compliance teams can use it to structure their work; US federal contractors may also use it when a contract or customer expects a NIST-aligned approach. NIST says the AI RMF 1.0 is currently being revised.

The framework groups AI risk management into four functions:

• Govern sets policies, responsibilities and oversight.
• Map identifies the context, risks and potential impacts of an AI system.
• Measure assesses and tracks those risks.
• Manage prioritises risks and decides how to respond.

These functions support ongoing risk management. The AI RMF is not a certification standard: NIST does not audit organisations against it or issue an AI RMF certificate. An organisation can document how it applies the framework or commission a separate assessment, but neither is a NIST certification.

What is ISO 42001?

ISO/IEC 42001:2023 is the international standard for an artificial intelligence management system (AIMS), published by ISO and the IEC in December 2023. It sets requirements for organisations that develop, provide or use AI, helping them establish clear responsibilities, assess AI risks and impacts, manage systems through their lifecycle, and monitor and improve their controls. Unlike the NIST AI RMF, it is a requirements standard that organisations can seek independent certification against.

To become ISO 42001 certified, an organisation defines and implements its AIMS, then a certification body assesses it through audits. If the system meets the standard’s requirements and any findings are resolved, the body can issue a certificate for the agreed scope. The certificate applies to that management system and scope; it does not certify an individual AI model or guarantee legal compliance.

NIST AI RMF vs ISO 42001: Key Differences

NIST AI RMF gives organisations a way to organise AI risk management. On the other hand, ISO 42001 sets requirements for an AI management system that can be independently audited and certified. The differences affect the evidence you can show, the work involved and the outcome you can expect.

Which One Should You Choose?

The right choice depends on what you need to show and how you manage AI today.

What ISO 42001 Auditors Actually Check

An ISO/IEC 42001 audit looks at whether an organisation’s AI management system is properly defined and working in practice. The auditor follows the evidence: how AI is used, who is accountable for it, how risks are assessed and what the organisation does in response.

Can You Use NIST AI RMF and ISO/IEC 42001 Together?

Yes. An organisation can use both frameworks within its AI governance programme. The NIST AI RMF offers a voluntary structure for managing AI risks through its Govern, Map, Measure and Manage functions. ISO 42001 sets requirements for an AI management system that can be independently audited for certification.

NIST guidance can help shape how an organisation identifies and manages AI risks. It does not replace the requirements of ISO/IEC 42001, or qualify an organisation for certification on its own.

Crosswalks between the frameworks can help teams identify related concepts, but they do not make the frameworks equivalent. For certification, the audit must assess the organisation’s AI management system against ISO/IEC 42001.