NIST AI RMF, ISO/IEC 42001 and the EU AI Act: how the three compare

NIST's AI Risk Management Framework is voluntary US guidance with no enforcement body; ISO/IEC 42001 is an international standard an organization can choose to be independently certified against; the EU AI Act is binding law with regulators and fines behind it. A security leader working across all three is not choosing one, since they sit at different levels: a legal floor in the EU, a certifiable management system anywhere, and a risk-management vocabulary NIST publishes for anyone to adopt.

What problem does each one solve?

AI RMF 1.0, which NIST published on January 26, 2023, gives an organization a shared vocabulary and four functions, Govern, Map, Measure and Manage, for thinking about AI risk; it tells a team how to organize the work, not what specific controls to implement.

ISO/IEC 42001:2023, published December 18, 2023 by ISO and IEC jointly, solves a different problem: it specifies requirements for an AI management system that a certification body can audit, the same model ISO/IEC 27001 uses for information security. Its scope statement commits an organization to establishing, implementing, maintaining and continually improving that management system, and it applies to organizations of any size, type or sector that provide or use AI-based products or services.

The EU AI Act solves a third problem: it sets legal obligations for specific AI systems, tied to EU market access, enforced by regulators with the power to fine. It entered into force on August 1, 2024.

Is any of them mandatory?

Only the EU AI Act, and only for organizations whose AI systems touch the EU market. The Act's duties phase in on a schedule rather than all at once: prohibited practices and an AI-literacy duty applied from February 2, 2025, governance duties for general-purpose AI model providers applied from August 2, 2025, and general application began on August 2, 2026, when the European Commission's AI Office and national authorities started enforcement alongside new transparency duties requiring chatbots to disclose they are AI and deepfakes to carry machine-readable marks.

A July 2026 amendment, the AI Omnibus, pushed two later deadlines back: high-risk systems under Annex III now have until December 2, 2027, and AI embedded in regulated physical products until August 2, 2028.

Neither the AI RMF nor ISO/IEC 42001 carries that kind of force on its own. Adopting the AI RMF is free and requires nothing to be filed anywhere; adopting ISO/IEC 42001 is also voluntary, though a company can choose to pay an accredited body to certify it has done so, which is where the standard gets its teeth in contract negotiations.

How are they structured?

AI RMF 1.0 runs on four functions: Govern sets culture and accountability, Map establishes context for a given system, Measure tests and tracks identified risks, and Manage allocates resources to treat them.

ISO/IEC 42001 is a management-system standard, meaning it is organized the way ISO/IEC 27001 is: leadership commitment, a policy with objectives, risk management specific to AI systems, resource and competence requirements, operational controls, performance evaluation and a formal improvement cycle, audited start to finish rather than read as a reference document.

The EU AI Act is organized by risk tier for the AI system itself rather than by management process: practices it classifies as unacceptable risk are banned outright, high-risk systems carry conformity-assessment and documentation duties before they can reach the market, systems posing limited risk carry narrower transparency duties such as disclosing AI-generated content, and the great majority of AI systems fall into a minimal-risk tier with no obligations under the Act at all.

Do NIST, ISO or the EU map these frameworks to each other officially?

Partially, and with an explicit disclaimer. NIST's AI Resource Center hosts a public page of crosswalks between the AI RMF and other frameworks and standards, including one from Microsoft that pairs AI RMF subcategories with ISO/IEC 42001 clauses, and another that relates AI RMF concepts to the OECD AI Recommendation and the EU AI Act. NIST states plainly that listing a crosswalk there is not an endorsement of the resource it maps the AI RMF to.

That caveat matters for an audit trail: a crosswalk can help a team translate work already done under one framework into the language of another, but none of the three bodies has issued a joint statement saying compliance with one satisfies the others.

Do they ask for the same underlying work?

Largely yes, even though the vocabulary differs. All three eventually want an organization to know where AI is in use, to have assessed what could go wrong with it, to monitor it afterward and to be able to show that work to someone else: an auditor for ISO/IEC 42001, a regulator or notified body for the EU AI Act's high-risk obligations, a board or customer for the AI RMF. A gap analysis built against any one of them tends to surface most of the same open items a team would find starting from either of the other two, which is the practical reason NIST's crosswalk pages exist at all.

Where they genuinely diverge is enforceability and audience. The AI RMF's functions are a self-assessment vocabulary with no outside check; ISO/IEC 42001's clauses are written to be verified by an accredited auditor who can withhold a certificate; the EU AI Act's obligations are written to be checked by a regulator who can fine a company for missing them. Treating all three as interchangeable "AI governance paperwork" misses that only one of the three has an enforcement body actually reading the paperwork.

Is any of the three about to change?

The AI RMF is the most likely to move next. NIST's own framework page says AI RMF 1.0 is being revised as part of the White House AI Action Plan, and in December 2025 NIST released a preliminary draft Cyber AI Profile built on Cybersecurity Framework 2.0, aimed specifically at AI-enabled attack and defense rather than AI risk generally, with a fuller public draft expected in 2026.

ISO has no announced revision to 42001 itself. The EU AI Act, by contrast, has already been amended once through the 2026 Omnibus, and nothing rules out a second simplification pass before the delayed 2027 and 2028 deadlines arrive.

Which one should a CISO start with?

Start with the EU AI Act's obligation schedule if any product, model or deployment touches the EU market, since it is the only one of the three with a filing deadline and a regulator behind it; everything else is secondary to meeting that floor on time.

Adopt the AI RMF next as the internal operating model, since it is free, already widely used as shared vocabulary with legal, procurement and the board, and maps reasonably well onto work most security teams already do for other risk domains.

Reach for ISO/IEC 42001 certification only when an external party is asking for it specifically: an enterprise customer's AI contract clause, a regulator in a sector that already expects ISO certificates, or a sales process losing ground to certified competitors. Build it on top of the AI RMF work already done rather than as a separate program, the same way a certified ISO/IEC 27001 shop extends its existing risk register rather than keeping two. For the detail behind each framework on its own, see how CISOs use the NIST AI RMF, what ISO/IEC 42001 requires and whether to certify, and the AI regulation tracker for every dated EU AI Act milestone.