Crosswalk
NIST AI RMF ↔ ISO/IEC 42001
NIST AI RMF and ISO/IEC 42001 target overlapping objectives but use different structures. RMF is voluntary US guidance built around four functions; ISO/IEC 42001 is a certifiable ISO management-system standard. NIST has published a mutual crosswalk. Both cover risk assessment, governance roles, documentation, and monitoring; ISO/IEC 42001 additionally requires the Plan-Do-Check-Act cycle mandatory in ISO management systems.
| NIST AI RMF | ISO/IEC 42001 | Notes |
|---|---|---|
Govern 1 Governance policies and processes | 5.1 – 5.3 Leadership and policy | RMF Govern 1.1 (accountability) → ISO 5.3 (roles); Govern 1.2 (policy) → ISO 5.2 (policy). |
Govern 2 Accountability structures | 5.3, 6.2 Roles, responsibilities, and objectives | Sets up owners for risk categories. |
Govern 3 Workforce | 7.2 Competence | Training and awareness requirements. |
Govern 4 Culture, transparency | 7.4 Communication | Internal and external communication practices. |
Map 1 Context | 4.1 – 4.4 Context of the organization | Understand internal/external issues and interested parties. |
Map 2 System categorization | 6.1.2, Annex A.5 AI system impact assessment | Includes intended use, deployment context, foreseeable misuse. |
Map 3 Benefits and costs | 6.1.2 AI system risk assessment | Tradeoff analysis. |
Map 4 Impacts on individuals and groups | Annex A.5.4 AI system impact assessment | Explicit alignment. |
Measure 1 Metrics | 9.1 Monitoring and measurement | Establishes KPIs. |
Measure 2 Testing (incl. adversarial) | Annex A.6.2 AI system life-cycle | Verification, validation, and testing. |
Measure 3 Monitoring for identified risks | 9.1, 10.1 Monitoring, nonconformity, corrective action | Continuous. |
Manage 1 Risk prioritization | 6.1.3, 8.3 Risk treatment | Decisions on accept/mitigate/transfer. |
Manage 2 Resources and third parties | Annex A.10 Third-party relationships | Supplier obligations. |
Manage 3 Incident response | 10.2, A.6.2.8 Nonconformity and corrective action; incident reporting | Includes root-cause analysis. |
Manage 4 Documentation | 7.5 Documented information | Version control, retention. |
What to watch
Key differences
- · ISO/IEC 42001 is certifiable; NIST AI RMF is voluntary guidance.
- · ISO/IEC 42001 requires PDCA management-system structure; RMF uses the Govern/Map/Measure/Manage cycle.
- · RMF has NIST AI 600-1 as an explicit GAI Profile; ISO handles GenAI within Annex A controls.
- · ISO/IEC 42001 has formal Annex A controls (38 items); RMF uses categories and subcategories.
Primary sources
Where every mapping was verified
Next steps
Turn a crosswalk into an audit-ready posture
Free vendor matchmaking
Need vendors that cover both frameworks?
Get matched with vendors that ship controls, evidence, and mappings across both frameworks on this page.
No credit card. Independent directory — we do not sell software ourselves.