NIST AI RMF 1.0 (January 2023) is a voluntary framework from the US National Institute of Standards and Technology, organized around four functions: Govern, Map, Measure, Manage. NIST says it is being revised as part of the White House AI Action Plan. ISO/IEC 42001:2023 is an international management-system standard that independent bodies certify against. They overlap in intent but differ in structure and in whether certification is possible. See our [ISO 42001 guide](/frameworks/iso-iec-42001) for the standard in detail.
Can one satisfy both with the same program?
Largely yes. NIST’s AI Resource Center hosts a crosswalk mapping AI RMF subcategories to ISO/IEC 42001 clauses and controls; it was provided by Microsoft and prepared on the standard’s final draft. A single governance program with an AI policy, risk and impact assessments and ongoing monitoring covers much of both. The main extra work for ISO 42001 is the management-system discipline certification auditors check: documented scope, Statement of Applicability, internal audit and management review.
Which should a US company choose first?
If you need external attestation (for customers, regulators, or procurement), prioritize ISO/IEC 42001 — it is certifiable. If you want a practical internal framework with concrete action items and no certification overhead, start with NIST AI RMF. Many organizations run AI RMF internally and pursue ISO 42001 when they need a certificate.
Does either one satisfy the EU AI Act?
No. Neither gives a presumption of conformity under the EU AI Act. The European Commission says ISO/IEC 42001's goals and definitions are not aligned with the quality management system the Act requires. The Act's first harmonised standard, EN 18286:2026 for quality management, was cited in the Official Journal on 14 October 2026. Both frameworks are still useful groundwork for the Act's risk-management and governance obligations.
Is NIST AI RMF free?
Yes. The framework, the companion Generative AI Profile (July 2024) and the Playbook are free from NIST. ISO/IEC 42001 is a paid standard: CHF 225 from ISO.