NIST AI RMF vs. ISO 42001: Two Different Tools for AI Governance

The NIST AI Risk Management Framework (AI RMF), published in January 2023, is a voluntary, non-certifiable framework organized around four functions — Govern, Map, Measure, Manage — that gives organizations a structured way to think about AI risk without prescribing a fixed control checklist. ISO/IEC 42001, published in December 2023, is a certifiable management-system standard with a formal Annex A control set an accredited auditor assesses.

Which one to reach for

1. NIST AI RMF is the better starting point for building an internal AI risk-assessment methodology — it's descriptive and flexible, not prescriptive.
2. ISO 42001 is the better choice when you need something an external buyer or auditor can independently verify — a real certificate, not a self-declared maturity level.
3. They aren't competitors — an organization can use NIST AI RMF's functions to structure its actual risk process, then map that process onto ISO 42001's Annex A to pursue certification.