Appearance
ISO 42001 vs NIST AI RMF — Side-by-Side Comparison for AI Governance
ISO/IEC 42001:2023 and NIST AI RMF 1.0 (NIST AI 100-1) are two references for AI governance that do different work. ISO/IEC 42001 is a standard with requirements for an AI management system in an organization (Clause 1). NIST AI RMF is voluntary guidance that gives outcomes and actions to manage AI risks, in four functions (Section 5). An organization can use the two together.
Where to start
An organization that selects ISO/IEC 42001, NIST AI RMF, or the two can use these points:
- An AI management system: ISO/IEC 42001 gives requirements for one AI management system in the scope that the organization sets (4.3). This scope can include more than one AI system (6.1.1, NOTE 2).
- Outcomes for AI risk management: NIST AI RMF gives outcomes in four functions, GOVERN, MAP, MEASURE, and MANAGE. An organization can select from the categories and subcategories, or apply all of them (Section 5).
- NIST AI RMF first, then ISO/IEC 42001: an organization can start with NIST AI RMF and add ISO/IEC 42001 after it. ISO/IEC 42001 then adds work, because it has requirements that AI 100-1 does not have, for example internal audit (9.2) and management review (9.3).
- The EU AI Act: ISO/IEC 42001 and NIST AI RMF replace no duty of the EU AI Act.
Summary
ISO/IEC 42001 and NIST AI RMF are two voluntary documents of different types:
- ISO/IEC 42001:2023 (first edition, 2023-12) is an International Standard of ISO and IEC. It gives requirements for an AI management system to all organizations that supply or use products or services that use AI systems (Clause 1).
- NIST AI RMF 1.0 (NIST AI 100-1, January 2023) is voluntary guidance of NIST. NIST AI 100-1 writes that the framework "is intended to be voluntary, rights-preserving, non-sector-specific, and use-case agnostic". It sets no obligation for an organization or an AI actor (Legal effect).
- Different work: ISO/IEC 42001 sets requirements for a management system. These requirements include AI risk assessment, AI risk treatment, and an AI system impact assessment (6.1.2 to 6.1.4). The NIST AI RMF Core gives outcomes and actions for AI risk management, from policies and oversight in GOVERN to risk responses in MANAGE.
The two frameworks side by side
| Item | ISO/IEC 42001:2023 | NIST AI RMF 1.0 |
|---|---|---|
| Publisher | ISO and IEC (ISO/IEC JTC 1/SC 42) | NIST, U.S. Department of Commerce |
| Edition | First edition, 2023-12 | NIST AI 100-1, January 2023 |
| Type | Management system standard with requirements | Guidance with outcomes and actions |
| Legal status | Voluntary | Voluntary |
| For whom | All organizations that supply or use products or services that use AI systems (Clause 1) | "organizations designing, developing, deploying, or using AI systems", and AI actors (Section 2) |
| Geographic scope | Not stated in the standard | Not stated in AI 100-1. NIST developed it as directed by the National Artificial Intelligence Initiative Act of 2020 (P.L. 116-283). |
| Certification | The standard sets no certification procedure. Certification by a certification body is optional. | AI 100-1 has no certification. |
| Structure | Clauses 4 to 10 in the harmonized structure. Annex A (normative) with control objectives and controls. Annex B (normative) with guidance for each Annex A control. Annexes C and D (informative). | Part 1: AI risk and the characteristics of trustworthy AI. Part 2: the Core with GOVERN, MAP, MEASURE, and MANAGE, each with categories and subcategories, and AI RMF Profiles (Section 6). |
| How the parts work together | One management system that the organization keeps and continually improves (4.4, Clause 10) | If the organization has a governance structure, the functions "may be performed in any order across the AI lifecycle". NIST recommends iterative use of the functions (Section 5). |
| Risks and impacts | AI risk assessment (6.1.2), AI risk treatment (6.1.3), AI system impact assessment (6.1.4), and their performance during operation (8.2 to 8.4) | MAP sets the context to frame risks. MEASURE analyzes, assesses, benchmarks, and monitors AI risk. MANAGE allocates risk resources to mapped and measured risks. |
| Documents | AI policy (5.2), statement of applicability (6.1.3 f)), documented information (7.5), results of the AI system impact assessment (6.1.4) | Current Profile and Target Profile. AI 100-1 does not prescribe profile templates (Section 6). |
| Life cycle | Annex A area A.6, AI system life cycle | GOVERN "addresses full product lifecycle and associated processes" (Section 5.1). MAP, MEASURE, and MANAGE "can be applied in AI system-specific contexts and at specific stages of the AI lifecycle" (Executive Summary). |
| Third parties | Annex A area A.10, Third-party and customer relationships (A.10.2 to A.10.4) | GOVERN 6, MAP 4, MANAGE 3 |
| Generative AI | No clause or control for generative AI | NIST AI 600-1 (July 2024), a profile of AI RMF 1.0 for generative AI |
| ISO/IEC 27001 and ISO/IEC 27701 | Annex D (D.2) names them as standards that an organization can integrate with its AI management system | Not in AI 100-1 |
| Use | An organization operates an AI management system, with or without certification | An organization gives structure to its AI risk management with the outcomes of the Core |
The four functions and the ISO/IEC 42001 clauses
The table below is the mapping of this page, not a mapping from NIST or from ISO. For each function of the NIST AI RMF Core, it shows ISO/IEC 42001 clauses and Annex A areas with related content. NIST AI 100-1 does not map its functions to the clauses of ISO/IEC 42001.
| NIST AI RMF function | ISO/IEC 42001 clauses and Annex A areas with related content | Subjects |
|---|---|---|
| GOVERN | Clause 4 (context of the organization), Clause 5 (leadership, with 5.2 and 5.3), A.2 (policies related to AI), A.3 (internal organization) | Policies, roles and responsibilities, accountability, culture of risk management |
| MAP | 4.1 (context, intended purpose, and roles), 6.1.2 AI risk assessment, 6.1.4 AI system impact assessment, A.5 Assessing impacts of AI systems | Context, intended purposes, risks of components, impacts |
| MEASURE | 9.1 (monitoring and measurement), A.6 (AI system life cycle), for example A.6.2.4 and A.6.2.6 | Tests, measurement of the characteristics of trustworthy AI, monitoring |
| MANAGE | 6.1.3 and 8.3 AI risk treatment, 10.1 continual improvement, 10.2 nonconformity and corrective action, A.10 Third-party and customer relationships | Risk responses, risks from third parties, monitoring plans after deployment, continual improvement |
NIST lists Microsoft's AI RMF crosswalk, which uses references to the draft ISO/IEC FDIS 42001.
Where the two frameworks agree and where they are different
ISO/IEC 42001 and NIST AI RMF are about related subjects. The type of each document stays different: ISO/IEC 42001 has requirements, and NIST AI RMF has voluntary outcomes.
- AI risk: ISO/IEC 42001 requires an AI risk assessment (6.1.2) and AI risk treatment (6.1.3), and their performance during operation (8.2 and 8.3). In NIST AI RMF, MAP sets the context to frame risks. MEASURE uses tools and methods "to analyze, assess, benchmark, and monitor AI risk and related impacts" (Section 5.3). MANAGE gives risk responses (MANAGE).
- Impacts: ISO/IEC 42001 requires an AI system impact assessment with documented results (6.1.4), which the organization performs during operation (8.4). In NIST AI RMF, MAP 5 and MAP 5.1 are voluntary outcomes. MAP 5 is the outcome that the impacts on individuals, groups, communities, organizations, and society are characterized. In MAP 5.1, the likelihood and magnitude of each of these impacts are identified and documented. Their text does not use the term "impact assessment" (MAP 5).
- Internal audit and management review: ISO/IEC 42001 requires internal audits (9.2) and management reviews (9.3) of the AI management system. AI 100-1 has no internal audit or management review.
- Improvement: ISO/IEC 42001 requires continual improvement (10.1), and corrective action for nonconformities (10.2). In NIST AI RMF, MANAGE 4.2 is the outcome for measurable activities for continual improvements in AI system updates.
- Documents: ISO/IEC 42001 requires a statement of applicability. It contains the necessary controls and the justification for each inclusion and exclusion (6.1.3 f)). The standard also has requirements for documented information (7.5). NIST AI 100-1 gives a Current Profile and a Target Profile, and it does not prescribe profile templates (Section 6). A statement of applicability and a profile are different documents (NIST AI RMF profiles, statement of applicability).
- Controls: ISO/IEC 42001 Annex A gives control objectives and controls, and not all of them are mandatory (A.1). The organization finds the necessary controls in its AI risk treatment and compares them with Annex A (6.1.3). The NIST AI RMF Core gives outcomes and actions. Its actions "do not constitute a checklist" (Section 5).
- Roles: ISO/IEC 42001 requires the organization to identify its roles for its AI systems (4.1). NOTE 1 to 4.1 refers to the NIST AI RMF for the types of roles and their relation to the AI system life cycle. NIST AI 100-1 refers to AI actors (Section 2, Appendix A) and sets no obligation for them.
- Third parties: ISO/IEC 42001 A.10 (Third-party and customer relationships) has controls for responsibilities, suppliers, and customers. In NIST AI RMF, GOVERN 6, MAP 4, and MANAGE 3 have outcomes for risks from third-party software, data, and entities.
- Life cycle: ISO/IEC 42001 has the Annex A area A.6, AI system life cycle. In NIST AI 100-1, GOVERN applies to all stages of AI risk management, and it "addresses full product lifecycle and associated processes" (Section 5.1). MAP, MEASURE, and MANAGE can apply at one or more stages of the AI lifecycle.
- Generative AI: NIST AI 600-1 is a profile of AI RMF 1.0 for generative AI. It gives suggested actions for some subcategories only (Generative AI Profile). ISO/IEC 42001 has no clause or control for generative AI. The organization sets the scope of its AI management system (4.3).
- Other management system standards: ISO/IEC 42001 Annex D (D.2) names ISO/IEC 27001, ISO/IEC 27701, and ISO 9001 as standards to use with an AI management system (Use with ISO/IEC 27001 and ISO/IEC 27701). AI 100-1 does not refer to ISO/IEC 27001 or ISO/IEC 27701.
ISO/IEC 42001 and NIST AI RMF in Modulos
Modulos gives ISO/IEC 42001 and NIST AI RMF as different Frameworks, each with its own Requirements, at two levels:
| Framework in Modulos | Organization level | AI System level |
|---|---|---|
| ISO 42001 | OFF-10 (Requirement table) | MFF-10 (Requirement table) |
| NIST AI RMF | OFF-3: Requirements in all four functions | MFF-3: Requirements in all four functions |
Together, OFF-3 and MFF-3 have all subcategories of NIST AI 100-1. Use these steps to set up the two:
- If your organization has no organization AI System, contact Modulos.
- Add
OFF-10andOFF-3to the organization AI System. - For each AI system in your scope, add
MFF-10andMFF-3to its AI System in Modulos. - Follow the Requirement procedure for each Framework.
For the Requirement of each clause, Annex A control, and subcategory, see Operationalizing ISO/IEC 42001 in Modulos and Operationalizing NIST AI RMF in Modulos.
The ISO 42001 and NIST AI RMF Frameworks share some Controls:
- AI System level:
MFF-10andMFF-3share 12 Controls. This is 41% of the Controls ofMFF-10and 20% of the Controls ofMFF-3. - Organization level:
OFF-10andOFF-3share 7 Controls. This is 9% of the Controls ofOFF-10and 37% of the Controls ofOFF-3.
Most Controls of each Framework are not shared. An organization executes a shared Control one time. Its Evidence is then available to each Requirement that maps the Control. The Requirement of each Framework does not become Fulfilled automatically: its Requirement Owner does a Review of it. For the figures of all Frameworks, see Control overlap.
Where to go next
ISO/IEC 42001 guide
AI management system, Clauses 4 to 10, Annexes A to D, certification
NIST AI RMF guide
GOVERN, MAP, MEASURE, MANAGE, Profiles, Generative AI Profile
ISO/IEC 42001 vs EU AI Act
The AI management system next to the duties of the EU AI Act, and EN 18286
Control overlap
The number of Controls that two Modulos Frameworks share, at each level
Frameworks compared
Legal status and scope of each framework that Modulos documents, and the pages that compare two of them
Frequently asked questions
Answers to frequent questions that compare AI governance frameworks
Sources of this page
- ISO/IEC 42001:2023, Information technology — Artificial intelligence — Management system, first edition, 2023-12 (ISO catalog page). Clauses: the Introduction, 1, 4.1, 4.3, 4.4, 5.2, 5.3, 6.1.1 to 6.1.4, 7.5, 8.2 to 8.4, 9.1 to 9.3, 10.1, and 10.2. Annexes: A.1 to A.3, A.5, A.6, A.10, and D.2.
- NIST AI 100-1, Artificial Intelligence Risk Management Framework (AI RMF 1.0), January 2023. Parts: the Executive Summary, Sections 1 to 3, Section 5 with Tables 1 to 4, Section 6, and Appendix A.
- NIST AI 600-1, the Generative AI Profile, July 2024: Section 1.
- NIST AI Risk Management Framework to ISO-IEC-42001 Crosswalk, with Microsoft as the provider on the AI RMF crosswalks page: the rows for the subcategories.
Disclaimer
This page gives general information. It is not legal advice.