Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteShort answer: NIST AI RMF, ISO/IEC 42001, and the EU AI Act are not interchangeable. NIST AI RMF 1.0 is voluntary risk-management guidance; ISO/IEC 42001:2023 is a certifiable, organization-wide AI management-system standard; and the EU AI Act is binding law for covered actors, systems, and uses. A company can use all three, but neither NIST adoption nor ISO certification automatically proves compliance with the EU Act.
The practical approach is to classify each AI use under applicable law, build an organization-wide management system, and use a risk framework to operate and document controls. The comparison below explains what each instrument requires, when its obligations apply, and how to combine them without confusing guidance, certification, and legal duties.
As an Amazon Associate I earn from qualifying purchases.
At a glance: three different instruments
| Question | NIST AI RMF 1.0 | ISO/IEC 42001:2023 | EU AI Act |
|---|---|---|---|
| What is it? | Voluntary risk-management framework | International AI management-system standard | Binding European Union regulation |
| Main unit of work | AI products, services, systems, and related organizational risk processes | The organization’s policies, roles, processes, and continual-improvement system | A legally defined provider, deployer, importer, distributor, product manufacturer, system, or use |
| Primary objective | Incorporate trustworthiness into AI design, development, use, and evaluation | Establish, operate, maintain, and improve an Artificial Intelligence Management System (AIMS) | Apply enforceable duties according to risk category and actor role |
| Assessment route | Implementation evidence; the framework is not a legal certification | Optional independent certification by a certification body | Act-specific compliance and, where required, conformity assessment |
| Geographic reach | Usable across jurisdictions as voluntary guidance | International | EU law, including specified situations involving actors outside the EU |
| Current timing issue | NIST says version 1.0 is being revised | Edition 1 was published in December 2023 | Application is staged and has been amended by Regulation (EU) 2026/1744 |
This distinction is confirmed by the NIST AI Risk Management Framework page, the ISO/IEC 42001 standard record, and the consolidated text of Regulation (EU) 2024/1689.
What NIST AI RMF does
NIST released AI RMF 1.0 on 26 January 2023. It is designed for voluntary use by organizations that want to identify and manage risks while building, deploying, or evaluating AI. NIST describes it as adaptable to different sectors, sizes, and levels of capability. It is guidance, not a statute, and using it does not by itself satisfy a particular legal requirement.
The framework organizes work into four functions: Govern, Map, Measure, and Manage. They are intended to operate continuously rather than as a one-time checklist.
Govern: establish accountability
Govern sets the policies, roles, authority, and culture that make AI risk work possible. Typical evidence includes an approved AI policy, named decision owners, escalation routes, documentation rules, training expectations, and criteria for accepting or rejecting residual risk. Governance also connects AI oversight to existing security, privacy, safety, procurement, and enterprise-risk processes.
Map: understand context and potential impact
Map records the intended purpose, users, affected groups, operating environment, data sources, dependencies, and reasonably foreseeable misuse of a system. A useful inventory identifies the model or vendor, version, interfaces, location of processing, human decision points, and downstream systems. Mapping should also state what could go wrong and who could be harmed before choosing metrics or mitigations.
Measure: test and monitor trustworthiness
Measure turns the mapped risks into evidence. Depending on the use case, that can include accuracy and robustness testing, bias or disparate-impact analysis, privacy and security testing, explainability checks, red-team exercises, incident metrics, and monitoring of performance drift. The relevant metric, threshold, test population, and limitations should be recorded; a generic claim that a model is “safe” is not an adequate measurement record.
Rank #2
Manage: prioritize and treat risk
Manage uses the measured results to select controls, reduce or transfer risk, and decide whether to deploy, restrict, retrain, replace, or retire a system. Actions should have an owner, due date, acceptance rationale, and verification result. Post-deployment monitoring matters because data, users, prompts, and connected systems can change after launch.
NIST provides a companion AI RMF Playbook with implementation ideas. NIST’s current framework page also says AI RMF 1.0 is being revised, so any policy should name the version used and check that page for a successor before relying on a future edition.
What ISO/IEC 42001 adds
ISO/IEC 42001:2023 specifies requirements for establishing, implementing, maintaining, and continually improving an Artificial Intelligence Management System. ISO positions it for organizations that provide or use AI-based products or services. Unlike a project-level risk checklist, an AIMS is an organization-wide management system: it defines how leadership, planning, operations, performance evaluation, and improvement work across a portfolio of AI activities.
Free tools Windows power users keep installed
One-click scans. No signup required.
The ISO record identifies edition 1, published in December 2023, at 51 pages, with paper and digital formats. The standard follows the familiar Plan-Do-Check-Act management-system cycle.
Rank #3
Plan
Define the organization’s context and interested parties, set the scope of the AIMS, identify AI-related risks and opportunities, establish objectives, and assign resources and responsibilities. Scope decisions should make clear which business units, products, suppliers, and AI life-cycle activities are included.
Do
Implement the documented policies and operational controls. This can cover data governance, model development and acquisition, supplier oversight, human oversight, competence, communication, change management, incident handling, and records. The standard is designed to accommodate both developers and organizations that primarily procure or deploy AI.
Check
Monitor objectives and controls, conduct internal audits, review performance, and have leadership evaluate whether the AIMS remains suitable and effective. Evidence might include audit findings, management-review minutes, training records, supplier assessments, incident trends, and corrective-action status.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Act
Correct nonconformities, improve controls, and update the system as technology, law, organizational goals, or risk changes. Continual improvement is the point of the management-system model; certification is not a “set and forget” approval.
ISO itself does not certify organizations. Certification is voluntary and is performed by independent certification bodies, as explained in ISO’s ISO/IEC 42001 overview. An ISO certificate therefore demonstrates conformity to the audited standard’s requirements within a defined scope; it is not a declaration that every AI use is lawful under the EU AI Act.
What the EU AI Act requires
The EU AI Act, Regulation (EU) 2024/1689, is binding law. It assigns duties to covered providers, deployers, importers, distributors, and product manufacturers and uses risk categories to determine which duties apply. The Act can reach organizations established outside the EU in specified circumstances, including where a system or its output is used in the Union. Coverage depends on the Act’s definitions, the actor’s role, the system’s intended purpose, and the actual use; a company should not decide coverage from geography alone.
Risk categories drive obligations
The Act prohibits certain AI practices, imposes transparency duties for specified systems, and sets stronger obligations for high-risk systems. A classification must be made for the particular system and use, not for an entire company merely because it uses AI. General-purpose AI model rules and governance provisions also have their own timing and scope.
High-risk risk-management system
For a high-risk AI system, Article 9 requires a documented, maintained, and iterative process. The official text states: “A risk management system shall be established, implemented, documented and maintained in relation to high-risk AI systems.” The process identifies and analyzes known and foreseeable risks, estimates and evaluates risks in normal use and reasonably foreseeable misuse, considers information from post-market monitoring, and adopts targeted mitigation measures. It runs through the system’s lifecycle rather than ending at launch.
Staged application dates
The Act’s general application date is 2 August 2026, but individual provisions apply on different dates. The current official EU summary lists the following schedule:
| Date | Provisions identified in the official summary | Practical implication |
|---|---|---|
| 2 February 2025 | Definitions and obligations concerning AI literacy, plus prohibitions, subject to a stated later exception | Organizations should have assessed prohibited practices and literacy responsibilities before this date. |
| 2 August 2025 | Certain governance and penalty provisions, and general-purpose AI model provisions | Relevant governance and model obligations may already apply, depending on the actor and system. |
| 2 August 2026 | General application date | Most remaining provisions begin to apply unless a specific transition rule says otherwise. |
| 2 December 2027 | High-risk systems listed in Annex III | Those systems have a later transition date under the schedule summarized by the EU. |
| 2 August 2028 | High-risk systems related to Annex I product legislation | These systems follow the later date stated in the official summary. |
Regulation (EU) 2026/1744 amended the timetable for certain high-risk obligations. Because dates and transition provisions can change, consult the 2026 amending regulation and the current consolidated Act before publishing a compliance deadline or signing a contract.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Where the frameworks overlap—and where they do not
Risk work
NIST’s Map, Measure, and Manage functions provide a practical method for the Act’s lifecycle risk work. ISO/IEC 42001 can make that method repeatable across departments through required policies, responsibilities, audits, and improvement. The overlap is useful, but the legal test remains the Act’s own definitions and obligations.
Organization versus individual system
ISO/IEC 42001 governs the organization’s management system. It does not classify every individual AI use under EU law. NIST can be applied to a product, service, or portfolio. The EU Act, by contrast, attaches duties to a legally defined actor and a specific system or use. A certified AIMS can support evidence collection, but it cannot replace a system-by-system legal analysis.
Voluntary evidence versus legal proof
NIST implementation evidence and an ISO certificate can help demonstrate disciplined processes to customers, auditors, or regulators. Neither is automatically a legal safe harbor. Legal compliance requires mapping the actual control, document, test, or decision to the applicable provision and maintaining evidence for the required period.
How to use all three together
- Inventory AI. List models, applications, embedded features, vendors, data flows, users, affected people, and business owners. Include pilots and systems bought from suppliers.
- Determine EU Act roles and coverage. For each item, identify whether the organization is acting as provider, deployer, importer, distributor, or product manufacturer; record intended purpose, location of actors, where outputs are used, and the relevant risk category.
- Set the AIMS scope. Use ISO/IEC 42001 to document which entities, products, suppliers, and lifecycle activities are inside the management system. Assign executive accountability and an internal-audit route.
- Run NIST-style risk analysis. Govern the decision rights, Map context and foreseeable misuse, Measure performance and trustworthiness, and Manage mitigations, residual risk, monitoring, and retirement decisions.
- Map controls to legal duties. Create a traceability table linking each EU Act obligation to an owner, procedure, technical control, record, test result, and review date. Mark evidence that is missing rather than treating an ISO or NIST label as a substitute.
- Operate and monitor. Track incidents, complaints, drift, supplier changes, new data, and changes in intended purpose. Feed post-market information and audit findings back into the risk system.
- Prepare the applicable assessment. Where the Act requires conformity assessment, technical documentation, registration, transparency, or other formal steps, follow that route specifically. An ISO certification audit is not automatically the same assessment.
Choosing a starting point
- Small team experimenting with AI: start with an inventory, prohibited-practice check, named owner, and a lightweight NIST Govern–Map–Measure–Manage record. Expand to an AIMS as the number and impact of systems grow.
- Enterprise using AI across departments: establish ISO/IEC 42001-style management-system governance so procurement, security, privacy, legal, engineering, and internal audit use one process. Use NIST functions for detailed system risk files.
- Provider or manufacturer placing a system on the EU market: perform the Act’s role and risk analysis first, then build the technical, quality, monitoring, and conformity evidence the specific provisions require. NIST and ISO can organize the work but do not change the legal classification.
- Supplier selling to regulated customers: define the AIMS scope, retain auditable NIST-style risk evidence, and state precisely what an ISO certificate covers. Do not advertise either as blanket EU AI Act compliance.
Common mistakes and corrections
- “We use NIST, so we are compliant.” Correction: NIST is voluntary guidance. Map its evidence to each applicable law instead.
- “ISO certification covers every model.” Correction: certification applies to the audited organizational scope and management system; it does not approve every individual application.
- “The EU rules start on one date.” Correction: application is staged, and the 2026 amendment changed some high-risk timing.
- “Only EU-established companies are covered.” Correction: specified extra-territorial situations can bring non-EU actors within scope.
- “A model is high-risk by itself.” Correction: classification depends on the Act’s definitions, intended purpose, actor role, and use.
- “A policy is enough.” Correction: retain operating evidence—tests, approvals, monitoring results, incidents, corrective actions, supplier records, and review dates.
Bottom line
NIST AI RMF is the flexible risk-practice layer; ISO/IEC 42001 is the organization-wide management-system layer; and the EU AI Act is the binding legal layer. Use NIST to structure risk decisions, ISO/IEC 42001 to institutionalize and audit those decisions, and the EU Act to determine the obligations that actually apply. Keep the version, scope, role, system, evidence, and deadline explicit every time you claim compliance.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
