ISO/IEC 42001 is a standard you can be audited and certified against. The NIST AI Risk Management Framework is a voluntary guide with no certificate. Use NIST to structure how you think about AI risk, and ISO 42001 if a buyer wants third party evidence. Many organizations use both.
What is each one?
NIST describes the AI RMF as intended for voluntary use, to improve the ability to incorporate trustworthiness into the design, development, use and evaluation of AI products, services and systems. It was released on 26 January 2023, and NIST has published a Playbook with suggested actions for its four functions: Govern, Map, Measure and Manage. NIST's page also says the AI RMF 1.0 is being revised as part of the White House AI Action Plan, so watch for changes.
ISO/IEC 42001 is a management system standard for AI, with requirements an auditor checks. ISO's site blocked our fetch, so confirm clause details in the purchased standard.
Where do they differ?
Nature. NIST is guidance you borrow from as much as you like; the Playbook itself says organizations may use as many or as few suggestions as apply. ISO is a set of requirements you meet to certify.
Output. NIST produces an internal risk practice. ISO produces a certificate and audit reports.
Origin. NIST is a US government framework. ISO is international and sold by ISO.
Cost. NIST material is free to read. ISO charges for the standard and certification audits.
Where do they overlap?
Both want you to know your AI systems, assign accountability, assess risk, measure and monitor, and improve. NIST's Govern function (policies and accountability) resembles the leadership, roles and policy parts of a management system. Map and Measure resemble risk assessment and performance evaluation. Manage resembles treatment and improvement. A crosswalk is something to build and check yourself; NIST publishes an AI RMF Crosswalk document.
A constructed example
A 200 person company ships an AI feature to banks. Its internal team uses the NIST AI RMF to run a risk review: Govern sets an owner, Map lists the system's context and harms, Measure picks tests, Manage tracks fixes. Two European buyers then ask for an AI management certificate. The company keeps the NIST work as the risk core and adds the document control, internal audit and management review a certification needs.
How to choose
- Start with NIST if you have no AI risk practice. It is free and flexible.
- Add ISO 42001 when a customer, a tender or your board wants external assurance.
- Keep one risk register that feeds both.
- Map your controls once and tag them to each source.
- Re-check NIST revisions and any new profiles, such as the critical infrastructure profile concept note NIST announced on 7 April 2026.
- Treat neither as legal compliance. The EU AI Act and other laws have their own tests.
Safeguard's compliance automation can organize evidence and controls across frameworks you choose; it does not certify you against either.
Is it a choice at all?
Often not. A common path is to adopt the NIST structure first because it is free, then layer the management system requirements when a customer asks. The work you did under Govern, Map, Measure and Manage becomes input: your risk register, your testing records and your accountability model. The risk is duplication, with two registers and two sets of owners. Avoid it by keeping a single list of AI systems and controls, tagged to whichever framework a buyer references. Also remember that neither framework tests a model for you. You still need your own evaluations, red teaming and monitoring.
Quick check
Can you get certified to the NIST AI RMF?
NIST does not run a certification program for it. Its use is voluntary.
Do we need ISO 42001 if we follow NIST?
Only if someone needs a certificate. Otherwise NIST alone may be enough.
Sources
- NIST AI Risk Management Framework
- NIST AI RMF Playbook
- ISO/IEC 42001 text is sold by ISO and was not fetched.
Last reviewed: 18 October 2026.
