Picture an organization starting an AI governance program in January 2023, when NIST published the AI Risk Management Framework. ISO/IEC published ISO 42001 in October of the same year. During the nine months between those releases, dozens of organizations anchored their programs to NIST AI RMF because it was available first. Many now ask whether to rebuild around ISO 42001 or operate both. The right answer depends on the goal and who requires proof.
Both address AI governance, but they are different tools serving different purposes. That distinction affects implementation priorities and the evidence an organization must produce.
NIST AI RMF
NIST AI RMF is a voluntary risk management framework built around four functions: Govern, Map, Measure, and Manage. It helps organizations identify and address risk across the AI lifecycle. Its design is flexible, allowing profiles suited to a particular context, risk tolerance, and regulatory environment. There is no required implementation route or third-party certification mechanism.
Govern addresses the structures, policies, and culture supporting AI risk management. Map identifies and classifies risks for particular use cases. Measure covers methods for analyzing and assessing risk. Manage addresses response plans, prioritization, and monitoring.
NIST AI RMF began in the US federal context. Executive Order 13960 (2020) instructed NIST to develop it, and federal agencies adopted it as guidance for responsible AI use. Private-sector adoption has broadened, especially among organizations with US federal contracting relationships or NIST Cybersecurity Framework governance structures.
ISO 42001
ISO 42001 is a management system standard. It sets requirements for an AI management system (AIMS) and uses the ISO high-level structure also found in ISO 9001 (quality management) and ISO 27001 (information security management). It is therefore auditable and certifiable through accredited third-party certification bodies.
The standard contains 10 clauses on context, leadership, planning, support, operation, performance evaluation, and improvement. Annex A contains 38 controls in six categories. Certification candidates must show that the AIMS meets the normative requirements of Clauses 4 through 10 and provide a Statement of Applicability for the Annex A controls.
ISO 42001 is internationally recognized. Organizations working across jurisdictions, especially in the EU, or serving customers that require ISO certification for procurement qualification, often find it more directly relevant than NIST AI RMF, a US-originated voluntary framework with no certification route.
Structural Differences
Certifiability is the most consequential practical difference. ISO 42001 can produce a third-party certificate for customers, regulators, or procurement teams as evidence of an AI management system. NIST AI RMF cannot. There is no NIST AI RMF certification. Organizations may document alignment, publish profiles, and cite the framework in governance reports, but no external artifact matches an ISO certificate.
A second difference is orientation. NIST AI RMF helps organizations identify, assess, and address AI risk. ISO 42001 specifies how an organization is structured, governed, and operated to manage AI responsibly, including risk management. ISO 42001 requires documented evidence that the management system functions. NIST AI RMF requires its risk management functions to be addressed. Their documentation requirements differ.
The third difference concerns integration. An organization with ISO 27001 can extend its existing management system to AI under ISO 42001, with overlap in governance, internal audits, management review, and nonconformity handling. An organization using NIST frameworks (CSF, SP 800-53) will find NIST AI RMF aligned with its risk vocabulary. Neither route is automatically easier. Both require substantial AI-specific documentation.
Which Framework?
ISO 42001 is the clearer choice when an organization needs certifiable evidence of its AI management practices. Regulated industries, healthcare organizations, financial services firms facing third-party audits, and suppliers to enterprise customers with vendor qualification processes are common candidates. If an outside party asks, "can you demonstrate your AI governance program is independently certified," ISO 42001 provides what NIST AI RMF does not.
NIST AI RMF best fits a US federal agency or federal contractor operating within NIST governance frameworks and needing AI risk documentation aligned with executive branch guidance. An existing NIST CSF program can extend its terminology and processes to AI risk without creating a new management system. NIST AI RMF also suits an internal program focused first on better risk practice rather than certification.
Using Both Frameworks
The frameworks are compatible. NIST published a mapping document connecting NIST AI RMF core functions with ISO 42001 clauses. An organization seeking ISO 42001 certification can use NIST AI RMF as the risk methodology within its AIMS. ISO 42001 requires AI risk management; NIST AI RMF supplies a structured way to perform it.
Organizations with federal contracting relationships and enterprise customer certification requirements may need both: NIST AI RMF alignment for federal reporting and ISO 42001 certification for procurement qualification. Overlap is significant in risk assessments, AI inventory, and operational controls. A single governance process serving both is feasible and is the approach we see in more mature programs, rather than two parallel programs.
Discovery Affects Both
Whichever framework comes first, governance depends on an accurate AI landscape. NIST AI RMF's Map function calls for identifying and classifying organizational use cases. ISO 42001 Clause 4 requires defining scope, which requires knowing which AI systems exist. Neither framework can be applied meaningfully to an incomplete, self-reported inventory missing 20 to 40 tools.
Framework selection affects certification, documentation structure, and external reporting. It follows the discovery question, however. Choosing a framework is easier than establishing an accurate inventory of what the organization actually runs. That inventory is where the work begins.