NIST AI RMF vs ISO 42001: what they share and how they differ

NIST AI RMF and ISO 42001 share 11 of 24 control themes and 16 checks. 92% of ISO 42001 requirements can be proven with checks NIST AI RMF already uses, 47% the other way round.

USVoluntary frameworkVoluntary

NIST AI RMF

How to apply the NIST AI RMF to your AI systems

72 requirementsNext Dec 2026
INTLCertifiable standardVoluntary

ISO 42001

How to prepare for ISO/IEC 42001 certification

13 requirementsNext Dec 2026
11/24shared control themes
16shared checks
92%of ISO 42001 requirements covered by NIST AI RMF evidence
47%of NIST AI RMF requirements covered by ISO 42001 evidence

At a glance

NIST AI RMF ISO 42001
JurisdictionUnited States (federal)International
KindVoluntary frameworkCertifiable standard
StatusVoluntary sameVoluntary same
BindingNo sameNo same
Object analysedAI systemOrganisation
ScopeAny organisation designing, deploying or using AI.Organisations providing or using AI systems.
Territorial reachNo territorial scope; de facto reference for US public buyers.International.
PenaltiesNone (voluntary). Leverage: safe harbour in state laws.None; certification lost or refused.
Qualification axesInternal risk tier (organisation-defined)System impact level (Cl. 6.1.4)
RolesAI actorProvider, User, Producer
Requirements7213
Next milestoneDec 2026, Expected RMF revisionDec 2026, CEN-CENELEC JTC 21 harmonised standards for the AI Act (prEN 18286 QMS)

Theme by theme

requirements per theme

NIST AI RMFISO 42001
Governance
13Governance & accountabilityshared3
2Inventory & categorisationNIST AI RMF only
2Literacy & competenceshared1
11Risk managementshared1
Quality & conformityISO 42001 only3
Assessment
6Impact assessmentsshared1
1Fairness & non-discriminationNIST AI RMF only
2Personal dataNIST AI RMF only
Build
Data governanceISO 42001 only1
8Technical documentationshared1
Logging & traceabilityISO 42001 only1
11Accuracy & robustnessshared1
1CybersecurityNIST AI RMF only
1Environmental impactNIST AI RMF only
People & use
1Transparency & noticeshared1
3Human oversightshared1
4Explanation & redressNIST AI RMF only
Lifecycle & third parties
8Post-deployment monitoringshared2
6Incidents & corrective actionshared1
5Third parties & value chainshared1

What they share: one piece of evidence, two frameworks

16

CodeCheckRequirements NIST AI RMFRequirements ISO 42001
CHK-LEGAL-MAPApplicable legal and regulatory requirements for AI are identified, mapped and monitored
GOVERN-1.1
ISO-4.3
CHK-POL-TRUSTTrustworthy-AI characteristics are embedded in organizational policies and a safety-first culture
GOVERN-1.2GOVERN-4.1
ISO-5.2
CHK-POL-RISKAn AI risk-management policy and process are established through transparent, documented controls
GOVERN-1.3GOVERN-1.4
ISO-6.1.2
CHK-ROLES-CLARIFIEDRoles, responsibilities and delegated authorities are documented and clear to relevant stakeholders
GOVERN-1.4GOVERN-2.1GOVERN-2.3GOVERN-3.2GOVERN-5.1MANAGE-1.4
ISO-5.3
CHK-REVIEW-PLANOngoing monitoring and periodic review of the risk-management process are planned, with defined roles and review frequency
GOVERN-1.5
ISO-9
VER-022-F-01Risk and incident response procedure
GOVERN-1.5GOVERN-4.3GOVERN-6.2MANAGE-2.3MANAGE-4.1MANAGE-4.3
ISO-A.8
CHK-TRAININGPersonnel and partners receive AI risk-management training
GOVERN-2.2
ISO-7.2
CHK-EXEC-ACCOUNTExecutive leadership is accountable for AI risk decisions (board committee, risk appetite)
GOVERN-2.3
ISO-5.3
VER-008-03Competent overseers assigned to the system
GOVERN-3.2MAP-3.5
ISO-A.9
CHK-IMPACT-ASSESSAn impact assessment is performed, documented and used in go/no-go and risk decisions
GOVERN-4.2MAP-3.2MAP-5.1MANAGE-1.1MANAGE-1.4
ISO-6.1.4
CHK-THIRDPARTY-POLPolicies address third-party AI/data risks, incl. IP, transparency and testing
GOVERN-6.1MAP-4.1
ISO-A.10
CHK-TEVVTEVV plan, test sets, metrics and data considerations are documented
MAP-2.3MEASURE-2.1MEASURE-2.13
ISO-A.6
VER-021-F-01Operational monitoring plan
MEASURE-2.4MANAGE-2.2MANAGE-4.1
ISO-A.6
VER-003-01Documented and up-to-date risk register
MEASURE-3.1MEASURE-3.2
ISO-6.1.2
CHK-RISK-RESPONSERisk treatment is prioritized and high-priority responses are planned and documented
MANAGE-1.2MANAGE-1.3
ISO-6.1.2
CHK-CONTINUAL-IMPROVEContinual-improvement activities are integrated with stakeholder engagement
MANAGE-4.2
ISO-10

Differences: requirements specific to each framework

Requirements with no check serving the other framework: the extra work.

NIST AI RMF

38

GOVERN-1.6
GOVERN-1.7
GOVERN-3.1
GOVERN-5.2
MAP-1.1
MAP-1.2
MAP-1.3
MAP-1.4
MAP-1.5
MAP-1.6
MAP-2.1
MAP-2.2
MAP-3.1
MAP-3.3
MAP-3.4
MAP-4.2
MAP-5.2
MEASURE-1.1
MEASURE-1.2
MEASURE-1.3
MEASURE-2.2
MEASURE-2.3
MEASURE-2.5
MEASURE-2.6
MEASURE-2.7
MEASURE-2.8
MEASURE-2.9
MEASURE-2.10
MEASURE-2.11
MEASURE-2.12
MEASURE-3.3
MEASURE-4.1
MEASURE-4.2
MEASURE-4.3
MANAGE-2.1
MANAGE-2.4
MANAGE-3.1
MANAGE-3.2

ISO 42001

1

ISO-A.7

Timelines

PastSet in the textPotentialTo verify
Jan 26, 2023NIST AI RMF · AI RMF 1.0
Dec 18, 2023ISO 42001 · ISO/IEC 42001 published
Jul 26, 2024NIST AI RMF · Generative AI Profile (NIST AI 600-1)
May 2025ISO 42001 · ISO/IEC 42005 (impact assessment)
Jul 2025ISO 42001 · ISO/IEC 42006 (certification bodies)
Jul 23, 2025NIST AI RMF · AI Action Plan asks for a revision of the framework
Dec 2026NIST AI RMF · Expected RMF revision
Dec 2026ISO 42001 · CEN-CENELEC JTC 21 harmonised standards for the AI Act (prEN 18286 QMS)

Run these requirements across all your AI systems

TrustFlow inventories your systems, qualifies them under each regulation and collects evidence once for every referential.

Request a demo