US AI governance guide
ISO 42001 and the NIST AI RMF: How US Organizations Use Both
The NIST AI Risk Management Framework is a voluntary US framework for managing AI risk. ISO/IEC 42001 is the international standard for an AI management system, and organizations can be certified to it. The two can be used together: the AI RMF to organize how you manage AI risk, and ISO/IEC 42001 to run that work as a management system and show customers a certificate. This guide compares them and shows which PECB course fits each role.
Last reviewed 26 October 2026
Any applicable taxes are calculated at checkout.
Mindset Cyber is a PECB Authorized Titanium Partner, PECB's highest partner level.
What is the NIST AI RMF?
NIST released the AI Risk Management Framework, AI RMF 1.0, published as NIST AI 100-1, on 26 January 2023. NIST describes it as "intended for voluntary use", and its FAQ answers the question of whether organizations must use it plainly: "No. NIST has produced the AI RMF as a voluntary Framework."
Its core is composed of four functions: Govern, Map, Measure and Manage. Govern covers the culture, policies and accountability for AI risk, and Map, Measure and Manage take each risk from its context through assessment to treatment. NIST publishes a companion AI RMF Playbook with suggested actions, and on 26 July 2024 it released the Generative Artificial Intelligence Profile (NIST AI 600-1), which applies the framework to generative AI.
NIST calls AI RMF 1.0 a living document, and the White House AI Action Plan of 23 July 2025 tasked NIST with revising it, so check nist.gov for the current version.
What is ISO/IEC 42001?
ISO/IEC 42001:2023, published in December 2023, is the international standard for an AI management system. In ISO's words it "specifies requirements for establishing, implementing, maintaining, and continually improving an Artificial Intelligence Management System (AIMS) within organizations", and ISO calls it the world's first AI management system standard. It follows the same clause structure as other ISO management system standards, clauses 4 to 10, with AI controls in Annex A that our ISO 42001 controls list sets out.
Organizations are certified to it by certification bodies. ISO/IEC 42006:2025, first published in July 2025, sets the additional requirements for bodies that audit and certify AI management systems, building on ISO/IEC 17021-1, the general standard for management system certification bodies.
How do they compare?
| NIST AI RMF | ISO/IEC 42001 | |
|---|---|---|
| Published by | NIST, the US National Institute of Standards and Technology | ISO and IEC, the international standards bodies |
| First released | 26 January 2023 (AI RMF 1.0) | December 2023 (ISO/IEC 42001:2023) |
| What it is | A voluntary framework for managing AI risk | A management system standard with requirements |
| Structure | Four functions: Govern, Map, Measure and Manage | Clauses 4 to 10, with AI controls in Annex A |
| Certification | Voluntary: NIST says organizations are not required to use it | Organizations can be certified by certification bodies, under ISO/IEC 17021-1 and ISO/IEC 42006 |
| Getting the text | Published on nist.gov | A licensed document, bought from ISO or a national standards body |
The table shows that the AI RMF is a voluntary framework for organizing AI risk work, while ISO/IEC 42001 sets requirements a certification body can audit against.
Where do they overlap?
Both start from governance and risk. The AI RMF's functions take you from the policies and accountability for AI risk to mapping, measuring and managing each risk. ISO/IEC 42001 asks for the same kinds of things inside a management system: leadership and an AI policy, AI risk assessment and treatment, and AI system impact assessment, then monitoring, internal audit, management review and continual improvement.
NIST's AI Resource Center lists a crosswalk from the AI RMF to ISO/IEC 42001, contributed by a third party. NIST notes that inclusion "does not imply NIST endorsement of the resource the AI RMF is mapped to, nor does it imply that either resource comprehensively covers the contents of the other."
The main difference is the management system around the risk work: ISO/IEC 42001 requires it to be documented, audited internally and reviewed by management, which is what lets an external auditor certify it.
How can a US organization use both?
The US has no single federal AI law: the AI RMF is voluntary, regulators such as the FTC apply existing law to AI, several states have passed AI laws of their own, and firms selling into the EU also have the EU AI Act to answer to. Within that, the two fit together:
- To organize the risk work: map your AI systems and their risks with the AI RMF's functions, using the Playbook's suggested actions.
- To prove it to customers: build an ISO/IEC 42001 management system around that work and have it certified by a certification body.
- To keep one set of records: run the AI RMF's risk activities as the risk assessment and treatment your ISO/IEC 42001 system requires.
Which PECB course fits your role?
- New to ISO/IEC 42001: ISO/IEC 42001 Foundation (US$195): a shared baseline in the standard before anyone implements or audits it.
- Building the AI management system: ISO/IEC 42001 Lead Implementer (US$485): plan, implement and run an AI management system an auditor can certify.
- Auditing it: ISO/IEC 42001 Lead Auditor (US$485): plan, run and report audits of an AI management system.
- Leading AI risk work: Lead AI Risk Manager (US$485): PECB's course applies the NIST AI Risk Management Framework and the EU AI Act to identifying, assessing and treating AI risk.
Any applicable taxes are calculated at checkout.
Each course includes the PECB exam voucher, two exam attempts and the certification fee. UKAS lists the PECB ISO/IEC 42001 Lead Implementer and Lead Auditor credentials under ISO/IEC 17024: see whether PECB certification is recognized in the US.
Frequently asked questions
Is ISO 42001 better than the NIST AI RMF?
Neither is better in general: they do different jobs. The NIST AI RMF is a voluntary framework for managing AI risk, organized in four functions: Govern, Map, Measure and Manage. ISO/IEC 42001 is a management system standard that sets requirements an organization can be certified against. The two can be used together, the AI RMF to structure the risk work and ISO/IEC 42001 to run and certify the management system around it.
Can you get certified to the NIST AI RMF?
NIST publishes the AI RMF as a voluntary framework, and its FAQ says organizations are not required to use it. A certificate for an organization's AI governance comes from ISO/IEC 42001, which certification bodies audit against; ISO/IEC 42006:2025 sets the requirements for those bodies.
Is there a crosswalk between the NIST AI RMF and ISO 42001?
Yes. NIST's AI Resource Center lists a crosswalk from the AI RMF to ISO/IEC 42001, contributed by a third party. NIST notes that inclusion does not imply NIST endorsement of the resource the AI RMF is mapped to, nor that either resource comprehensively covers the contents of the other.
Does US law require ISO 42001 or the NIST AI RMF?
No federal law requires either. NIST says organizations are not required to use the AI RMF, and ISO/IEC 42001 certification is a choice an organization makes, for example because customers or partners ask for it. Several states have passed AI laws of their own, so check the rules that apply to your organization.
What is the NIST Generative AI Profile?
NIST AI 600-1, the Generative Artificial Intelligence Profile, which NIST released on 26 July 2024 as a companion resource that applies the AI RMF to generative AI.
Is the NIST AI RMF being updated?
NIST calls AI RMF 1.0 a living document, and the White House AI Action Plan of 23 July 2025 tasked NIST with revising it. Check nist.gov for the current version before you build on it.
Which PECB ISO 42001 course should I take?
It depends on your role. ISO/IEC 42001 Foundation (US$195) gives a baseline in the standard, Lead Implementer (US$485) is for the people who build the AI management system, and Lead Auditor (US$485) for the people who audit it. Each includes the PECB exam voucher, two exam attempts and the certification fee. Any applicable taxes are calculated at checkout.
Next steps
Every course is priced in US dollars and includes the PECB exam voucher, two exam attempts and the certification fee.
PECB Certified ISO/IEC 42001 Lead Implementer
US$485
Any applicable taxes are calculated at checkout.
Includes the PECB exam voucher, two exam attempts, the certification fee, the first year of PECB certification maintenance and 12 months of access. 31 CPD credits.
View course → Official PECB eLearningPECB Certified ISO/IEC 42001 Lead Auditor
US$485
Any applicable taxes are calculated at checkout.
Includes the PECB exam voucher, two exam attempts, the certification fee, the first year of PECB certification maintenance and 12 months of access. 31 CPD credits.
View course →Sources
Every source was read on 26 October 2026. Quotations keep their original spelling.
- NIST, AI Risk Management Framework: https://www.nist.gov/itl/ai-risk-management-framework
- NIST, Artificial Intelligence Risk Management Framework (AI RMF 1.0), NIST AI 100-1, January 2023: https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.100-1.pdf
- NIST, AI Risk Management Framework FAQs: https://www.nist.gov/artificial-intelligence/ai-risk-management-framework-faqs
- NIST AI Resource Center, Crosswalks to the NIST AI RMF: https://airc.nist.gov/airmf-resources/crosswalks/
- ISO, ISO/IEC 42001:2023 Information technology, Artificial intelligence, Management system (publication date 2023-12): https://www.iso.org/standard/42001
- ISO, ISO/IEC 42006:2025, requirements for bodies providing audit and certification of AI management systems (publication date 2025-07): https://www.iso.org/standard/42006