ISO 42001 vs the NIST AI RMF
Both are voluntary and they cover much of the same ground. The practical difference is that one ends in a certificate an accredited body can issue, and the other does not.
ISO 42001 is a management system standard you can be certified against; the NIST AI RMF is a voluntary risk framework with no certification behind it. They map well onto each other and are often used together.
The two instruments organisations most often weigh for AI governance are different kinds of thing: ISO/IEC 42001 is a standard an accredited body can certify you against (ISO/IEC 42001:2023), and the NIST AI Risk Management Framework is a framework you apply on your own authority (the NIST AI Risk Management Framework (NIST AI 100-1)). This page names the standard's clauses without reproducing its text, which is copyright; the framework itself is published free by NIST, and we quote it where its own words are the clearest description.
What is each one?
ISO/IEC 42001 is the international standard for an AI management system, published in December 2023 (ISO/IEC 42001:2023). Its requirements sit in Clauses 4 to 10, the harmonised structure ISO uses across its management system standards, with a set of reference controls in Annex A, and adopting it is a choice your organisation makes.
The NIST AI Risk Management Framework is a framework published by the US National Institute of Standards and Technology in January 2023 as NIST AI 100-1, and it describes itself as “intended for voluntary use” (the NIST AI Risk Management Framework (NIST AI 100-1)). It organises AI risk work into four functions, GOVERN, MAP, MEASURE and MANAGE, set out in its Section 5. A companion Generative AI Profile, NIST AI 600-1, followed in July 2024 for the risks specific to generative AI (the NIST Generative AI Profile).
Which one can you be certified against?
Only the standard. ISO 42001 is written to be audited: ISO/IEC 42006:2025 sets the requirements for bodies that certify AI management systems (ISO/IEC 42006:2025), and in the UK UKAS has begun accrediting certification bodies for it (UKAS on the first UK AIMS accreditation). A certificate is a finding by an independent, accredited body, which is what makes it portable proof for customers and procurement.
No such machinery exists for the framework. NIST publishes it for voluntary use and does not audit or certify anyone against it, so the evidence the framework produces is your own documentation of how you applied it. That is the deepest practical difference between the two: both can improve how you govern AI, and only one can end in a certificate someone else will accept without looking inside your organisation.
How do the clauses map to the four functions?
Imperfectly but usefully. The standard is organised as a management system cycle across Clauses 4 to 10; the framework is organised as the four functions of its Section 5, applied to the AI you run. Neither document was written against the other, so the table below is a reading aid rather than a conformity mapping.
| ISO 42001 clause | Nearest function | Shared ground |
|---|---|---|
| 4Context of the organisation | MAP (5.2) | Establishing the context an AI system runs in and framing its risks |
| 5Leadership | GOVERN (5.1) | Accountability and policy set from the top |
| 6Planning | GOVERN (5.1) and MAP (5.2) | Identifying AI risks and planning what to do about them |
| 7Support | GOVERN (5.1) | The resources and competence the system needs |
| 8Operation | MANAGE (5.4) | Operating controls and acting on the risks you have mapped |
| 9Performance evaluation | MEASURE (5.3) | Analysing and monitoring AI risks and whether treatment is working |
| 10Improvement | MANAGE (5.4) and GOVERN (5.1) | Feeding what reviews find back into how the system runs |
GOVERN appears against more than one clause because the framework calls it “a cross-cutting function that is infused throughout AI risk management and enables the other functions” (Section 5.1) (the NIST AI Risk Management Framework (NIST AI 100-1)). For a line-by-line reading, NIST's AI Resource Center hosts a detailed crosswalk between the framework and ISO/IEC 42001, produced by Microsoft (the crosswalks hosted on NIST's AI Resource Center).
When would a UK organisation pick each, or both?
Pick the standard when someone else needs to trust the result. If enterprise customers, procurement questionnaires or your board are asking for third-party proof of AI governance, only ISO 42001 can produce it, and the readiness check shows how far your current practice already goes before you commit. That check is a self-assessment: it is not an audit, and it never says whether you would pass one.
Pick the framework when the work is internal risk practice. It is free to read and faster to adopt than a management system, and it is the natural choice if you sell into the US or your customers already speak NIST. If generative AI is where your risk sits, the Generative AI Profile extends the framework there (the NIST Generative AI Profile).
The two are compatible, and using both is common: the standard supplies the management system an auditor can certify, and the framework supplies the risk thinking to run inside it. Nothing in either document rules the pairing out, and the crosswalk above is the working tool for it.
Does either satisfy the EU AI Act?
No. The EU AI Office determined in May 2024 that ISO 42001 is not fully aligned with the Act and is not part of its harmonisation process, so certifying to it does not establish compliance (Cloud Security Alliance research note on prEN 18286). The AI-specific harmonised standard is EN 18286, which CEN-CENELEC ratified on 12 July 2026 and BSI has issued in the UK as BS EN 18286:2026 (CEN-CENELEC on the publication of EN 18286). It has not been cited in the Official Journal yet, so it does not confer a presumption of conformity either.
The framework sits further away still: it is a US government publication with no standing in the EU harmonisation process at all. Either can strengthen the governance underneath your Act obligations, and neither is a compliance shortcut. If the Act is the question you actually have, the ISO 42001 vs the EU AI Act guide takes it properly, and the EU AI Act check settles whether the Act reaches you at all.