ISO/IEC 42001 vs NIST AI RMF

What is ISO/IEC 42001 and who is it for?

ISO/IEC 42001 is the international standard that sets requirements for establishing, running and continually improving an AI management system. Its first edition was published in December 2023. It applies to organisations of any size that develop, provide or simply use AI.

The structure will look familiar from other ISO management system standards: context of the organisation, leadership, planning, support, operation, performance evaluation and improvement. Planning includes AI risk assessment, risk treatment and AI system impact assessment. Annex A provides a reference set of controls. Certification is carried out by independent certification bodies and is optional.

In short, ISO/IEC 42001 turns AI governance into an auditable management system.

Certification usually starts with a gap analysis: your current policies, processes and records are compared against the clauses of the standard. Then you set the scope. It does not have to be the whole company; it can be, for example, a single AI-enabled product you sell to customers. Once gaps are closed and an internal audit and management review are done, the certification body you choose carries out its audit. Surveillance audits continue after the certificate is issued, so the system cannot be built once and left alone.

The standard does not stand alone. ISO offers ISO/IEC 42005, on AI system impact assessment, and ISO/IEC 27001, on information security, as related standards. Which ones you need depends on what your customers and your sector expect.

What is the NIST AI RMF and what do its four functions cover?

The NIST AI Risk Management Framework (AI RMF 1.0) is a voluntary framework released by the US National Institute of Standards and Technology on 26 January 2023. It gives teams a shared language for identifying, measuring and managing AI risk. NIST’s page notes that the framework is being revised under the White House AI Action Plan, so check for the current version.

The framework has four functions:

• Govern: policies, roles, accountability and risk culture. The foundation for the other three.
• Map: the system’s context, intended use, the people it affects and possible harms.
• Measure: testing, metrics and evaluation of the identified risks.
• Manage: prioritisation, risk treatment, monitoring and incident response.

The NIST AI RMF Playbook lists suggested actions for each function. The framework is free, issues no certificate and has no audit mechanism.

What is the difference: certifiable standard or voluntary framework?

The core difference is what each produces. ISO/IEC 42001 produces a management system and, at the end, a certificate you can show to others. The NIST AI RMF produces a risk method; it organises what you do internally but gives you no external document. The EU AI Act is a third category: binding law for the companies in its scope.

Criterion	ISO/IEC 42001	NIST AI RMF	EU AI Act
Nature	International management system standard	Voluntary risk management framework	EU regulation (Regulation (EU) 2024/1689)
Binding?	Voluntary; can become required by contract	Voluntary	Binding for companies in scope
Certification	Third-party certification available	None	Conformity assessment depending on system type
Structure	Management system clauses and Annex A controls	Four functions: Govern, Map, Measure, Manage	Risk-based obligations and prohibitions
Best fit	Organisations that need to prove governance to customers	Any team that needs a risk method quickly	Companies placing or using AI on the EU market
Evidence	Certificate, audit reports, policies and records	Internal risk registers, evaluation results	Technical documentation, logs, declaration of conformity

In practice they do not compete. The NIST Map and Measure functions are a good method for carrying out the risk assessment that ISO/IEC 42001 requires.

How do they relate to the EU AI Act and to KVKK?

The EU AI Act entered into force on 1 August 2024 and applies in stages. It can reach companies outside the EU, for example a Turkish or UK company that places an AI system on the EU market or runs a system whose output is used in the EU. Check the European Commission’s sources for the current application timeline. Our glossary has a short summary of the EU AI Act.

An ISO/IEC 42001 certificate does not by itself demonstrate compliance with the Act. It does make it easier to build the risk management, record keeping, human oversight and documentation the Act expects. Data protection law covers the personal data side: GDPR in the EU and KVKK, Türkiye’s data protection law, for data processed in Türkiye. If your AI system processes personal data, notice, legal basis and transfer rules apply on top. Assess the overlap together with your legal counsel.

What does the NIST generative AI profile (AI 600-1) add?

In July 2024 NIST published NIST AI 600-1, a profile that adapts the AI RMF to generative AI. It describes risks that are unique to or made worse by generative AI. These include confabulation, data privacy, information security, intellectual property, and value chain and component integration.

For each risk it lists suggested actions mapped to the four functions. If you are building an LLM-based assistant or agent, deriving your ISO/IEC 42001 risk assessment checklist from this profile is a practical shortcut.

Where should a small team start?

For a small team the question is usually not “which one” but “in what order”. The sequence we suggest:

1. Build an inventory of the AI systems you use and develop.
2. Use the NIST Map function to write down each system’s purpose, affected people and possible harms.
3. Apply the Measure and Manage steps to the one or two riskiest systems: tests, metrics, monitoring, incident response.
4. If customers ask for certification, move these records into an ISO/IEC 42001 management system. If you hold ISO 27001, extend your document control, internal audit and management review.

This approach fits technology and software companies that sell AI features to customers, and finance and insurance firms that use models in lending decisions. Where decisions affect people directly, as in credit risk scoring, risk assessment and human oversight should be designed in from the start.

Corrplus is not a certification body and does not issue certificates; that is the job of independent bodies. We build the technical side. In AI consulting work we produce the system inventory and risk map; in security, compliance and data ethics work we build logging, testing and human oversight controls into your systems. If you want live systems monitored and risk records kept current, we continue through managed services. Anything that needs legal interpretation we handle together with your legal counsel.