Short answer: The NIST AI Risk Management Framework is a voluntary framework organized around four functions: Govern, Map, Measure, and Manage. ISO/IEC 42001 is a certifiable standard for an AI management system. They overlap heavily, so organizations that map both to a single control set can assess once and satisfy the shared requirements with the same evidence.
- NIST AI RMF is a voluntary framework; ISO/IEC 42001 is a certifiable standard.
- The two overlap heavily across accountability, risk assessment, and treatment.
- Mapping both to one control set lets the same evidence satisfy both.
NIST AI RMF in brief
NIST AI RMF 1.0 guides organizations in identifying and managing AI risk. Its four functions cover governance culture and accountability (Govern), understanding context and risk (Map), analyzing and tracking risk (Measure), and prioritizing and acting on risk (Manage). It is widely used as a baseline in the United States and is referenced by several state laws.
ISO/IEC 42001 in brief
ISO/IEC 42001 specifies requirements for establishing, operating, and improving an AI management system, following the same management system structure as ISO/IEC 27001. Because it is certifiable, it gives organizations an external attestation that their AI governance program operates as described.
Where they overlap
| Area | NIST AI RMF | ISO/IEC 42001 |
|---|---|---|
| Accountability and roles | Govern | Leadership and organizational roles |
| Risk and impact assessment | Map and Measure | AI risk assessment and AI system impact assessment |
| Risk treatment | Manage | AI risk treatment and operational controls |
| Monitoring and improvement | Measure and Manage | Performance evaluation and improvement |
Assess once, satisfy both
Mapping framework to framework produces fragile spreadsheets. A more durable approach maps every framework to one common control set. The ARISE Framework™ serves that role: 128 controls and 953 prioritized requirements, crosswalked to more than 42 frameworks. Assessed Govern assesses each AI system against ARISE once and reports the evidence state for NIST AI RMF and ISO 42001 together. Audit firms preparing ISO 42001 engagements can run them in Assessed Assurance.
Questions
Is NIST AI RMF mandatory?
NIST AI RMF is voluntary at the federal level, but it is referenced in contracts, procurement requirements, and some state laws, which makes it a practical baseline for many organizations.
Can an organization get certified to NIST AI RMF?
No. NIST AI RMF is a framework without a certification scheme. ISO/IEC 42001 is the certifiable standard, which is why many organizations pursue both.
Does ISO 42001 replace ISO 27001?
No. ISO 42001 addresses AI management, and ISO 27001 addresses information security management. They share a structure, and many controls and evidence items support both.