Crosswalk
NIST AI RMF ↔ ISO/IEC 42001
NIST AI RMF and ISO/IEC 42001 target overlapping objectives but use different structures. RMF is voluntary US guidance built around four functions; ISO/IEC 42001 is a certifiable ISO management-system standard. NIST has published a mutual crosswalk. Both cover risk assessment, governance roles, documentation, and monitoring; ISO/IEC 42001 additionally requires the Plan-Do-Check-Act cycle mandatory in ISO management systems.
| NIST AI RMF | ISO/IEC 42001 | Notes |
|---|---|---|
Govern 1 Governance policies and processes | 5.1 – 5.3 Leadership and policy | RMF Govern 1.1 (accountability) → ISO 5.3 (roles); Govern 1.2 (policy) → ISO 5.2 (policy). |
Govern 2 Accountability structures | 5.3, 6.2 Roles, responsibilities, and objectives | Sets up owners for risk categories. |
Govern 3 Workforce | 7.2 Competence | Training and awareness requirements. |
Govern 4 Culture, transparency | 7.4 Communication | Internal and external communication practices. |
Map 1 Context | 4.1 – 4.4 Context of the organization | Understand internal/external issues and interested parties. |
Map 2 System categorization | 6.1.2, Annex A.5 AI system impact assessment | Includes intended use, deployment context, foreseeable misuse. |
Map 3 Benefits and costs | 6.1.2 AI system risk assessment | Tradeoff analysis. |
Map 4 Impacts on individuals and groups | Annex A.5.4 AI system impact assessment | Explicit alignment. |
Measure 1 Metrics | 9.1 Monitoring and measurement | Establishes KPIs. |
Measure 2 Testing (incl. adversarial) | Annex A.6.2 AI system life-cycle | Verification, validation, and testing. |
Measure 3 Monitoring for identified risks | 9.1, 10.1 Monitoring, nonconformity, corrective action | Continuous. |
Manage 1 Risk prioritization | 6.1.3, 8.3 Risk treatment | Decisions on accept/mitigate/transfer. |
Manage 2 Resources and third parties | Annex A.10 Third-party relationships | Supplier obligations. |
Manage 3 Incident response | 10.2, A.6.2.8 Nonconformity and corrective action; incident reporting | Includes root-cause analysis. |
Manage 4 Documentation | 7.5 Documented information | Version control, retention. |
What to watch
Key differences
- · ISO/IEC 42001 is certifiable; NIST AI RMF is voluntary guidance.
- · ISO/IEC 42001 requires PDCA management-system structure; RMF uses the Govern/Map/Measure/Manage cycle.
- · RMF has NIST AI 600-1 as an explicit GAI Profile; ISO handles GenAI within Annex A controls.
- · ISO/IEC 42001 has formal Annex A controls (38 items); RMF uses categories and subcategories.
Primary sources
Where every mapping was verified
Next steps
Turn a crosswalk into an audit-ready posture
Free vendor matchmaking
Need vendors that cover both frameworks?
Get matched with vendors that ship controls, evidence, and mappings across both frameworks on this page.
No sign-up. Independent directory — we do not sell software ourselves.