NIST AI RMF, ISO/IEC 42001 and the EU AI Act: comparing AI governance frameworks
NIST AI RMF, ISO/IEC 42001 and the EU AI Act compared on obligations, effort, certifiability and adoption order, with a decision matrix and reusable artefacts.
In short. If you sell or use AI in the EU, the EU AI Act comes first: it is law, not a choice. NIST AI RMF is the fastest way to organise AI risk without certification, useful in the first months. ISO/IEC 42001 matters when someone asks for external proof (tenders, enterprise buyers, audits) and costs more time and budget. All three overlap on system inventory, risk assessment, controls and documentation: build those artefacts once and reuse them. Below: the comparison by nature, scope, effort and certifiability, the decision matrix and the 7 shared artefacts.
Deploying AI without a governance framework is like shipping a product without QA: sooner or later you pay the bill in incidents, fines or lost trust. Three global references dominate the space in 2025: NIST AI RMF (US, voluntary), ISO/IEC 42001 (international, certifiable) and the EU AI Act (Europe, mandatory). They are not alternatives, they are complementary layers. This guide explains what each one does, where they overlap and how to combine them without duplicating work.
The differences in 3 lines
- EU AI Act: binding law in the EU. If you sell or use AI in Europe, start here.
- NIST AI RMF: voluntary method, the fastest to adopt. No certification.
- ISO/IEC 42001: the only certifiable one. Needed when someone asks for external proof.
The three frameworks in one line
| Framework | Mandatory? | Nature | Typical effort | Certifiable | Who uses it |
|---|---|---|---|---|---|
| NIST AI RMF 1.0 | No | Voluntary guidance | Low (weeks) | No | Companies that want a method, not a certificate |
| ISO/IEC 42001:2023 | No | Certifiable standard (AIMS) | High (6-12 months) | Yes, third-party audit | Companies that must prove governance to buyers and tenders |
| EU AI Act (Reg. EU 2024/1689) | Yes, if you operate in the EU | Binding regulation | Varies by risk class | No, but conformity duties apply | Anyone selling or using AI in the EU, in any capacity |
NIST AI Risk Management Framework
Published by the National Institute of Standards and Technology in January 2023, the NIST AI RMF is a voluntary framework built around four functions: Govern, Map, Measure, Manage. It is the most agile of the three: no certification, no obligations, but a shared vocabulary to talk about AI risk in a structured way.
- Govern: define roles, policies and AI accountability.
- Map: identify context, stakeholders and potential risks of each system.
- Measure: measure performance, bias, robustness and explainability.
- Manage: prioritise, mitigate and monitor risks over time.
It is the natural starting point: no barrier to entry, it plugs into any internal methodology and lays the conceptual foundation for ISO 42001 or AI Act compliance later on.
ISO/IEC 42001
ISO/IEC 42001:2023 is the first international standard for an Artificial Intelligence Management System (AIMS). It follows the same logic as ISO 27001 (information security) or ISO 9001 (quality): it defines verifiable requirements for a management system and is certifiable by accredited third parties.
In practice it requires:
- A top-management-approved AI policy.
- Context and stakeholder analysis.
- AI impact assessment (AIIA) of systems.
- Lifecycle management: data, development, deployment, monitoring, decommissioning.
- Internal audits and management review (PDCA cycle).
It is the right choice when you need to demonstrate governance to customers, boards or regulators, an ISO 42001 certificate is a commercial asset, not just a compliance one.
EU AI Act
EU Regulation 2024/1689 is the first horizontal AI law in the world. It entered into force on 1 August 2024 with staggered application: prohibitions from 2 February 2025, GPAI model obligations from 2 August 2025, high-risk system obligations from 2 August 2026.
The AI Act classifies systems into four risk categories:
- Unacceptable risk, banned (social scoring, cognitive manipulation, workplace emotion recognition, etc.).
- High risk, subject to strict requirements (risk management, data governance, technical documentation, transparency, human oversight, accuracy and cybersecurity). Covers HR, credit, education, justice, medical devices, critical infrastructure.
- Limited risk, transparency obligations (e.g. chatbots, deepfakes).
- Minimal risk, no specific obligations.
Separately, GPAI models (General-Purpose AI) have a dedicated regime with reinforced obligations for those with "systemic risk".
Fines reach up to EUR 35 million or 7% of annual worldwide turnover, the highest ceiling of any European digital regulation, GDPR included.
Side-by-side comparison
| Dimension | NIST AI RMF | ISO/IEC 42001 | EU AI Act |
|---|---|---|---|
| Mandatory? | No | No (but certifiable) | Yes, if you operate in the EU |
| Certifiable? | No | Yes, by accredited bodies | CE marking for high-risk |
| Focus | Risk management | Management system | Placing on the market |
| Fines | None | None (loss of certificate) | Up to EUR 35M or 7% revenue |
| Adoption cost | Low | Medium-high | Variable by risk category |
| Recognition | US and global | International | EU (extraterritorial) |
| Updates | NIST releases | ISO review ~5 years | Commission delegated acts |
EU AI Act obligations: what NIST and ISO actually cover
The EU AI Act is the only mandatory layer, so the practical question is how much of it you already satisfy by running NIST AI RMF or ISO/IEC 42001.
| EU AI Act obligation (high-risk) | NIST AI RMF | ISO/IEC 42001 | What is still missing |
|---|---|---|---|
| Risk management system (Art. 9) | Covered (Map, Measure, Manage) | Covered (clause 6, AI risk assessment) | Formal link to the specific legal risk classes |
| Data and data governance (Art. 10) | Partially covered (Map) | Covered (Annex A controls on data) | Bias testing evidence and dataset provenance records |
| Technical documentation (Art. 11, Annex IV) | Not prescriptive | Partially covered (documented information) | The Annex IV structure itself, to be produced explicitly |
| Record keeping and logging (Art. 12) | Partially covered (Measure) | Covered (operational control) | Retention period and traceability of automated logs |
| Transparency to deployers (Art. 13) | Partially covered | Partially covered | Instructions for use with the legally required content |
| Human oversight (Art. 14) | Covered (Govern) | Covered (roles and competences) | Named oversight roles per system, with authority to stop it |
| Accuracy, robustness, cybersecurity (Art. 15) | Covered (Measure) | Partially covered | Declared metrics and thresholds per intended purpose |
| Quality management system (Art. 17) | Not covered | Covered (this is the core of the standard) | Nothing, if the AIMS is in place |
| Conformity assessment and CE marking (Art. 43) | Not covered | Not covered | Specific legal procedure, not replaceable by any framework |
| Post-market monitoring (Art. 72) | Partially covered (Manage) | Covered (monitoring and improvement) | Serious-incident reporting to authorities |
Read it this way: NIST gets you the method, ISO gets you the management system and the external proof, but neither one delivers conformity assessment, Annex IV documentation or incident reporting. Those remain legal work you have to do on top.
Where they overlap (and how to exploit it)
The three frameworks are not competing: they share 60-70% of controls. Companies that implement one solidly have already done half of the work on the other two.
Key overlaps:
- Risk assessment: NIST "Map/Measure", ISO clause 6, AI Act art. 9.
- Data governance: NIST "Measure", ISO Annex B, AI Act art. 10.
- Technical documentation: ISO clause 7, AI Act art. 11 and Annex IV.
- Human oversight: NIST "Govern/Manage", ISO Annex B, AI Act art. 14.
- Post-deployment monitoring: NIST "Manage", ISO clause 9, AI Act art. 72.
Which framework does your company actually need?
AI Rating measures maturity across the four areas of the model and shows where to start, with priorities and estimated effort.
Start your AI RatingWhich one should you pick? A scenario per profile
Startup or scale-up, B2B AI product in the EU. Start from NIST to build the method, evaluate ISO 42001 when enterprise customers begin asking for it, check AI Act exposure (especially in HR, healthtech, fintech, edtech).
Large regulated company (bank, insurance, healthcare, public sector). The AI Act is the binding constraint. ISO 42001 provides an auditable structure and integrates well with existing ISO 27001. NIST as the internal vocabulary for the risk team.
AI model or platform vendor. The AI Act (GPAI regime) is mandatory. ISO 42001 is the commercial lever for enterprise clients. NIST as a baseline for red-teaming.
SME integrating third-party AI. The main risk is vendor selection. NIST as a due-diligence checklist, contracts aligned with AI Act obligations, ISO 42001 only if and when it becomes necessary.
How to start without wasting resources
- AI system inventory: what you have, who uses it, what data it processes, what decisions it makes.
- AI Act risk classification: which systems are banned, high-risk or limited-risk.
- Gap analysis against NIST AI RMF: where you are today across Govern/Map/Measure/Manage.
- ISO 42001 roadmap if certification has commercial value.
- Operational governance: policies, roles, AI committee, monitoring KPIs.
This is exactly the path we follow at ZeroFive with AI Rating and our AI Governance services: we start from measurement (where you are today), define priorities based on real risk, and build tailored governance, not a copy-paste of a standard.
Decision matrix: what to do first, by company profile
| Your profile | Start with | Add within 12 months | Trigger to move | First 90 days of effort |
|---|---|---|---|---|
| Startup or scale-up, AI product sold in the EU | NIST AI RMF | AI Act classification | First enterprise security questionnaire | 10 to 15 person-days |
| Bank, insurer, healthcare, public sector | EU AI Act classification | ISO/IEC 42001 on top of ISO 27001 | High-risk system identified in the inventory | 30 to 45 person-days |
| Model or platform vendor (GPAI) | EU AI Act GPAI obligations | ISO/IEC 42001 | Model placed on the EU market | 25 to 40 person-days |
| SME integrating third-party AI | NIST AI RMF as vendor due diligence | Contract clauses aligned to AI Act art. 25 | Vendor renewal or new AI tool | 5 to 8 person-days |
The mistake we see most often is starting from certification. Certification is an output, not a strategy: without an inventory and a risk classification, an ISO 42001 project prices itself two to three times higher, because the scope is undefined.
What each framework actually costs
| Item | NIST AI RMF | ISO/IEC 42001 | EU AI Act (high-risk) |
|---|---|---|---|
| Internal effort, first cycle | 15 to 30 person-days | 60 to 120 person-days | 80 to 200 person-days per system |
| External cost | Optional advisory | Audit and certification fees, plus advisory | Conformity assessment, notified body where required |
| Time to first usable evidence | 4 to 6 weeks | 6 to 9 months | Tied to the 2 August 2026 deadline |
| Recurring cost | Internal review | Surveillance audits, 3 year cycle | Post-market monitoring, incident reporting |
Ranges assume a mid-sized organisation with 5 to 15 AI systems in scope. The variable that moves the number most is not the framework, it is how many systems you run and how well documented they already are.
Build once, use three times: the reuse map
| Artefact you produce | NIST AI RMF | ISO/IEC 42001 | EU AI Act | Reuse |
|---|---|---|---|---|
| AI system inventory | Map | Clause 4, context | Art. 9, art. 11 | High |
| Risk assessment per system | Map, Measure | Clause 6 | Art. 9 | High |
| Data governance record | Measure | Annex B | Art. 10 | High |
| Technical documentation | Manage | Clause 7 | Art. 11, Annex IV | Medium, the AI Act is stricter |
| Human oversight design | Govern, Manage | Annex B | Art. 14 | High |
| Logging and monitoring | Manage | Clause 9 | Art. 12, art. 72 | Medium, retention rules differ |
| Incident procedure | Manage | Clause 10 | Art. 73 | Medium, 15 day reporting is AI Act specific |
Treat these seven artefacts as a single documentation set with three audiences. Organisations that keep three parallel binders spend roughly double and still fail audits, because the versions drift.
Three questions a board should ask before approving budget
- How many AI systems do we actually run, including the ones bought inside SaaS tools? If nobody can answer within a week, the inventory is the project, not the framework.
- Which of them make or materially influence decisions about people? Those are the ones that pull you into AI Act high-risk territory and into reputational exposure.
- What evidence could we produce tomorrow if a customer or a regulator asked? The gap between what you believe and what you can show is the real maturity score.
In summary
- NIST AI RMF is the vocabulary and the method.
- ISO/IEC 42001 is the certifiable management system.
- EU AI Act is the law you must comply with if you operate in the EU.
They are not alternatives: they are layers. Companies that treat them as mutually exclusive options end up doing the same work three times. Companies that integrate them build AI governance that is defensible in front of boards, customers and regulators, and they get there in months, not years.
How we do this with companies
Turning these three layers into a system that holds up in front of boards, customers and regulators is exactly what our AI governance consulting does. When the pressing issue is the regulatory deadline, the specific track is EU AI Act compliance consulting. To find the concrete starting point, the AI Rating measures current maturity and returns the priorities for the first months. The full picture is on AI consulting for enterprises.
To discuss your case: book a 30 minute call.