# ISO/IEC 42001 vs NIST AI RMF

> ISO/IEC 42001 is a management system standard that defines how an organisation governs AI, and independent bodies can certify against it. The NIST AI RMF is a free, voluntary framework for identifying and reducing AI risk. If customers ask for a certificate, look at ISO/IEC 42001; if you need an internal risk method, start with NIST. Most teams use both.

URL: https://corrplus.net/blog/iso-42001-vs-nist-ai-rmf/
Updated: 2026-10-26
Corrplus Team

## What is ISO/IEC 42001 and who is it for?

ISO/IEC 42001 is the international standard that sets requirements for establishing, running and continually improving an AI management system. Its first edition was published in December 2023. It applies to organisations of any size that develop, provide or simply use AI.

The structure will look familiar from other ISO management system standards: context of the organisation, leadership, planning, support, operation, performance evaluation and improvement. Planning includes AI risk assessment, risk treatment and AI system impact assessment. Annex A provides a reference set of controls. Certification is carried out by independent certification bodies and is optional.

In short, ISO/IEC 42001 turns [AI governance](/glossary/ai-governance/) into an auditable management system.

Certification usually starts with a gap analysis: your current policies, processes and records are compared against the clauses of the standard. Then you set the scope. It does not have to be the whole company; it can be, for example, a single AI-enabled product you sell to customers. Once gaps are closed and an internal audit and management review are done, the certification body you choose carries out its audit. Surveillance audits continue after the certificate is issued, so the system cannot be built once and left alone.

The standard does not stand alone. ISO offers ISO/IEC 42005, on AI system impact assessment, and ISO/IEC 27001, on information security, as related standards. Which ones you need depends on what your customers and your sector expect.

## What is the NIST AI RMF and what do its four functions cover?

The NIST AI Risk Management Framework (AI RMF 1.0) is a voluntary framework released by the US National Institute of Standards and Technology on 26 January 2023. It gives teams a shared language for identifying, measuring and managing AI risk. NIST's page notes that the framework is being revised under the White House AI Action Plan, so check for the current version.

The framework has four functions:

- **Govern:** policies, roles, accountability and risk culture. The foundation for the other three.
- **Map:** the system's context, intended use, the people it affects and possible harms.
- **Measure:** testing, metrics and evaluation of the identified risks.
- **Manage:** prioritisation, risk treatment, monitoring and incident response.

The NIST AI RMF Playbook lists suggested actions for each function. The framework is free, issues no certificate and has no audit mechanism.

## What is the difference: certifiable standard or voluntary framework?

The core difference is what each produces. ISO/IEC 42001 produces a management system and, at the end, a certificate you can show to others. The NIST AI RMF produces a risk method; it organises what you do internally but gives you no external document. The EU AI Act is a third category: binding law for the companies in its scope.

| Criterion | ISO/IEC 42001 | NIST AI RMF | EU AI Act |
|---|---|---|---|
| Nature | International management system standard | Voluntary risk management framework | EU regulation (Regulation (EU) 2024/1689) |
| Binding? | Voluntary; can become required by contract | Voluntary | Binding for companies in scope |
| Certification | Third-party certification available | None | Conformity assessment depending on system type |
| Structure | Management system clauses and Annex A controls | Four functions: Govern, Map, Measure, Manage | Risk-based obligations and prohibitions |
| Best fit | Organisations that need to prove governance to customers | Any team that needs a risk method quickly | Companies placing or using AI on the EU market |
| Evidence | Certificate, audit reports, policies and records | Internal risk registers, evaluation results | Technical documentation, logs, declaration of conformity |

In practice they do not compete. The NIST Map and Measure functions are a good method for carrying out the risk assessment that ISO/IEC 42001 requires.

## How do they relate to the EU AI Act and to KVKK?

The EU AI Act entered into force on 1 August 2024 and applies in stages. It can reach companies outside the EU, for example a Turkish or UK company that places an AI system on the EU market or runs a system whose output is used in the EU. Check the European Commission's sources for the current application timeline. Our glossary has a short summary of the [EU AI Act](/glossary/eu-ai-act/).

An ISO/IEC 42001 certificate does not by itself demonstrate compliance with the Act. It does make it easier to build the risk management, record keeping, human oversight and documentation the Act expects. Data protection law covers the personal data side: GDPR in the EU and KVKK, Türkiye's data protection law, for data processed in Türkiye. If your AI system processes personal data, notice, legal basis and transfer rules apply on top. Assess the overlap together with your legal counsel.

## What does the NIST generative AI profile (AI 600-1) add?

In July 2024 NIST published NIST AI 600-1, a profile that adapts the AI RMF to generative AI. It describes risks that are unique to or made worse by generative AI. These include confabulation, data privacy, information security, intellectual property, and value chain and component integration.

For each risk it lists suggested actions mapped to the four functions. If you are building an LLM-based assistant or agent, deriving your ISO/IEC 42001 risk assessment checklist from this profile is a practical shortcut.

## Where should a small team start?

For a small team the question is usually not "which one" but "in what order". The sequence we suggest:

1. Build an inventory of the AI systems you use and develop.
2. Use the NIST Map function to write down each system's purpose, affected people and possible harms.
3. Apply the Measure and Manage steps to the one or two riskiest systems: tests, metrics, monitoring, incident response.
4. If customers ask for certification, move these records into an ISO/IEC 42001 management system. If you hold ISO 27001, extend your document control, internal audit and management review.

This approach fits [technology and software](/industries/technology-software/) companies that sell AI features to customers, and [finance and insurance](/industries/finance-insurance/) firms that use models in lending decisions. Where decisions affect people directly, as in [credit risk scoring](/solutions/credit-risk-scoring/), risk assessment and human oversight should be designed in from the start.

Corrplus is not a certification body and does not issue certificates; that is the job of independent bodies. We build the technical side. In [AI consulting](/services/ai-consulting/) work we produce the system inventory and risk map; in [security, compliance and data ethics](/services/ai-governance/) work we build logging, testing and human oversight controls into your systems. If you want live systems monitored and risk records kept current, we continue through [managed services](/services/managed-services/). Anything that needs legal interpretation we handle together with your legal counsel.

## Frequently asked questions

### Is ISO/IEC 42001 certification mandatory?

No. ISO/IEC 42001 is a voluntary standard and no law makes it mandatory on its own. Enterprise customers and public tenders may still ask suppliers for evidence of AI governance. Where they do, certification is one way to provide it.

### Is the NIST AI RMF only for US companies?

No. NIST developed it in the US, but it is a free, voluntary framework anyone can use. A team in Europe or Türkiye can adopt it as its method for identifying and measuring AI risk. It does not lead to a certificate.

### Does ISO/IEC 42001 certification demonstrate EU AI Act compliance?

Not by itself. The standard helps build the risk management and documentation discipline the Act expects, but the Act's obligations depend on the type of system and must be assessed separately. Define the scope together with your legal counsel.

### We already hold ISO 27001. Does that help?

Usually, yes. Both standards share the same management system structure: context, leadership, planning, support, operation, performance evaluation and improvement. Your document control, internal audit and management review processes can be extended to cover AI.

## Sources

- [ISO, ISO/IEC 42001:2023 AI management systems](https://www.iso.org/standard/42001)
- [NIST, AI Risk Management Framework](https://www.nist.gov/itl/ai-risk-management-framework)
- [NIST AI RMF Playbook](https://airc.nist.gov/airmf-resources/playbook/)
- [NIST AI 600-1, Generative Artificial Intelligence Profile, July 2024 (PDF)](https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf)
- [Regulation (EU) 2024/1689, the Artificial Intelligence Act (EUR-Lex)](https://eur-lex.europa.eu/eli/reg/2024/1689/oj)