Start with the NIST AI RMF if you need a flexible way to structure AI risk work. Start with ISO/IEC 42001 if customers want a management system they can have independently assessed. Many teams use the RMF for content and 42001 for the management wrapper, and the work overlaps substantially.
What each is
The NIST AI RMF 1.0, released 26 January 2023, is a voluntary framework organized around Govern, Map, Measure and Manage. It is not a certification and does not prescribe risk tolerance.
ISO/IEC 42001:2023 specifies requirements for establishing, implementing, maintaining and continually improving an AI management system within an organization. Standards bodies list it as valid from December 2023 and applicable to organizations of any size that provide or use AI-based products or services. As a management system standard, it follows the same family approach as other ISO management standards, which is why organizations that already run a security management system often find the structure familiar. Check the official text for clause detail, since this post does not reproduce it.
Key differences
- Nature. The RMF is guidance. 42001 states requirements that an assessor can test.
- Output. The RMF produces a documented risk practice. 42001 produces a management system with scope, policy, objectives, audit and improvement cycles.
- Cost and cadence. An external assessment of a management system carries cost and ongoing surveillance. Adopting the RMF has no assessor.
- Flexibility. The RMF lets you choose depth by risk. A standard asks you to meet defined requirements within your scope.
How to choose
Pick the RMF first when you have no AI program, want a shared vocabulary quickly, or serve mainly US public-sector style audiences who already know NIST material. Pick 42001 when buyers or partners ask for an independently assessed management system, or you already operate similar management systems and want to extend them.
Using both
Map the artifacts once. An inventory, risk tolerance, impact assessments, testing records and incident reviews support both. Keep a crosswalk table so a single piece of evidence answers two sets of questions. NIST's development page says crosswalks accompanied the 1.0 release, so check NIST's resources for official mappings before building your own.
Do not overclaim
Saying you align with the RMF is a statement about practice. Saying you are certified to 42001 requires an actual assessment outcome. Keep wording exact in questionnaires.
A practical sequence
A common path is to build the inventory, tolerance statement and assessment routine using the RMF structure, run them for a quarter, then decide whether to scope a management system for independent assessment. This ordering lets you learn what your practice actually looks like before you commit to audit cycles. If a deal depends on 42001, reverse it and start with scope, policy and internal audit first.
Quick check
Is 42001 required by law?
Not by itself. It is a voluntary standard. Check whether any contract or regulation you face refers to it.
Can a small company do either?
Yes. Scope the work to your actual AI systems and keep documents short.
Sources
- NIST, AI Risk Management Framework 1.0 (NIST AI 100-1)
- EVS, ISO/IEC 42001:2023 listing
- NIST, AI Risk Management Framework overview page
Last reviewed: 19 October 2026.
