NIST AI RMF, ISO 42001 and the EU AI Act: what each asks of you
By Erick Truong · · 4 min read
The short answer
The NIST AI RMF is a voluntary US framework for managing AI risk. ISO/IEC 42001 is an international standard for an AI management system that accredited bodies can audit and certify. The EU AI Act is law, with obligations that depend on your role and each system's risk. They overlap heavily, so one practical set of controls serves all three.
What is the NIST AI Risk Management Framework?
The NIST AI RMF, published by the US National Institute of Standards and Technology in January 2023, is a voluntary framework for managing the risks of AI systems. It organizes the work into four functions:
- Govern: the culture, policies, roles and accountability that make risk management happen.
- Map: understanding each AI system's context, purpose and potential impacts.
- Measure: assessing and tracking the risks you've mapped.
- Manage: prioritizing and acting on those risks, on a cycle rather than once.
In July 2024 NIST added a Generative AI Profile (NIST AI 600-1) that applies the framework to the specific risks of generative AI. There is no certificate for the NIST AI RMF; you adopt it and show your work.
What is ISO/IEC 42001?
ISO/IEC 42001:2023 is the international standard for an AI management system: the policies, roles, processes and records an organization uses to govern AI responsibly and improve over time. If you know ISO 27001 for information security, the shape is familiar: the same management-system structure, with AI-specific controls in an annex.
You select the controls that apply to your AI risks, document why, and run the system. Unlike the NIST framework, ISO 42001 offers independent certification: an accredited certification body audits your management system, then returns for periodic surveillance audits to keep the certificate current.
What does the EU AI Act require?
The EU AI Act (Regulation (EU) 2024/1689) is binding law that entered into force on August 1, 2024. It is risk-based: what you must do depends on your role, such as provider or deployer, and on each AI system's risk tier.
- Prohibited practices have been banned since February 2, 2025.
- General-purpose AI model obligations have applied since August 2, 2025.
- Transparency obligations, such as telling people they're interacting with AI and labeling AI-generated content, apply from August 2, 2026.
- High-risk systems in areas like employment, education and credit: the Digital Omnibus on AI, adopted in July 2026, moved most of these obligations to December 2, 2027, and to August 2, 2028 for AI built into regulated products.
It can reach companies outside the EU, including US businesses that place AI systems on the EU market or whose AI output is used in the EU.
Dates as of October 2026. I'm not an auditor or a certification body, and none of this is legal advice: confirm your obligations with counsel and the current text on EUR-Lex.
How do they compare?
| NIST AI RMF | ISO/IEC 42001 | EU AI Act | |
|---|---|---|---|
| What it is | A voluntary risk framework | A management-system standard | A regulation |
| Binding? | No | No, unless a contract requires it | Yes, where it applies |
| Independent proof | None; you document your approach | Certification by an accredited body | Conformity duties that vary by risk tier |
| Main ask | Govern, map, measure and manage AI risk | Run and improve an AI management system | Meet obligations for your role and each system's risk |
Can one set of controls serve all three?
Largely, yes. Underneath the different vocabulary, all three ask you to know your AI systems, assign accountability, manage risk continuously, keep humans in the loop where it matters, and keep evidence. A practical set of controls gives you the raw material for each:
- An AI system inventory, including what was already running. It is the starting point for NIST's Map function, ISO 42001's scope and the EU AI Act's risk classification.
- A named risk owner and an AI council charter, which speak to NIST's Govern function and ISO 42001's leadership requirements.
- A one-page acceptable use policy and data boundaries. See what to put in an AI acceptable use policy.
- Vendor criteria decided before contracts are signed, covering training use, subprocessors and notice of model changes.
- Human review tiered by consequence, and monitoring with a pause-and-notify path after launch.
None of this is a substitute for the specific obligations that apply to you. It's the operating base that makes meeting them practical. I lay out the full set on the AI governance framework page.
Where should a mid-sized company start?
- Inventory the AI you use and build, including tools staff adopted on their own.
- Classify each system by risk and by your role (provider, deployer or both).
- Name one accountable owner and publish a one-page acceptable use policy.
- Pick a reference framework for structure. NIST is a practical default for US companies; add ISO 42001 if customers ask for certification.
- Get counsel's view on whether, and how, the EU AI Act applies to you.
Frequently asked questions
- Is the NIST AI RMF mandatory?
- No. It's voluntary guidance. Some customers, partners and public-sector buyers reference it, so adopting it can still matter commercially.
- Can a company get a certificate for the NIST AI RMF?
- No. There's no certification scheme for the NIST AI RMF. If you need independent proof of AI governance, ISO/IEC 42001 is the standard that accredited bodies certify against.
- Does the EU AI Act apply to US companies?
- It can. It reaches providers that place AI systems on the EU market and situations where AI output is used in the EU, regardless of where the company is based. Confirm your position with counsel.
- Which framework should we start with?
- For most US mid-sized organizations, start with the NIST AI RMF for structure and a short set of practical controls for action. Add ISO/IEC 42001 when certification becomes a customer requirement.