ISO 42001 vs NIST AI RMF: Which Should a Small Business Use?
A plain-language comparison of ISO/IEC 42001 and the NIST AI RMF for small businesses: structure, certification, cost, how they map, and how both relate to actual law.
By AI Compliance Tool editorial team · Published 2026-10-14 · Reviewed 2026-10-14 · Reviewer: Pending independent review · 9 min read
Key takeaways
- Both frameworks are voluntary. Neither is a law, and following either one does not by itself make you compliant with the EU AI Act, PIPEDA, Quebec Law 25 or any US state statute.
- ISO/IEC 42001 is a certifiable management-system standard (clauses 4-10 plus Annex A controls). NIST AI RMF is a free, non-certifiable framework built on Govern, Map, Measure and Manage.
- Most small businesses should start with NIST AI RMF as a working method and adopt 42001 structure only when a customer, insurer or regulator asks for a certificate.
- Texas TRAIGA (effective 1 January 2026) gives a rebuttable presumption of reasonable care to programs aligned with the NIST AI RMF. That is evidence of care, not a certification and not immunity.
If you run a 20-person agency or a 60-person manufacturer, you have probably been told to “align with NIST” or “get ISO 42001”. Both are reasonable suggestions. Both are also voluntary standards, and neither is a law. This guide explains what each is, how they fit together, what they cost in effort, and how they relate to the binding rules you may already be subject to.
The short answer
| ISO/IEC 42001:2023 | NIST AI RMF 1.0 | |
|---|---|---|
| What it is | International management-system standard for AI (an “AIMS”) | US government risk-management framework |
| Published | December 2023 (51 pages) | 26 January 2023 |
| Legal status | Voluntary standard | Voluntary framework |
| Certifiable | Yes, by accredited certification bodies (not by ISO) | No |
| Structure | Clauses 4-10 plus Annex A controls | Four functions: Govern, Map, Measure, Manage |
| Cost to read | Purchased from ISO or a national member body | Free download |
| Best first step for | Businesses whose customers or procurement teams will ask for a certificate | Businesses that need a practical method now and have no certification demand |
If nobody is asking you for a certificate, start with NIST AI RMF. If a customer contract, insurer questionnaire or tender already mentions ISO 42001, start building to the 42001 structure from day one so you do not have to re-file everything later.
What ISO/IEC 42001 actually requires
ISO/IEC 42001:2023 specifies requirements for establishing, implementing, maintaining and continually improving an AI management system. It follows the same structure as other ISO management-system standards, so holders of ISO 9001 or ISO 27001 will find it familiar.
The core clauses are:
| Clause | Theme | What a small business produces |
|---|---|---|
| 4 | Context of the organization | AIMS scope statement; list of interested parties (customers, staff, regulators) |
| 5 | Leadership | Signed AI policy; named owner with authority |
| 6 | Planning | AI risk assessment, AI system impact assessment, objectives |
| 7 | Support | Competence and training records, awareness, documented information |
| 8 | Operation | Operational controls applied to each AI system (Annex A) |
| 9 | Performance evaluation | Monitoring, internal audit, management review minutes |
| 10 | Improvement | Nonconformity and corrective-action log |
Annex A lists the reference controls you select and justify, covering the AI system lifecycle, data management, transparency to users and third-party relationships. You need not implement every control, but you must document why any is excluded.
Certification is optional. If you pursue it, an accredited certification body audits your AIMS and, if satisfied, issues a certificate that is typically subject to periodic surveillance. ISO publishes the standard but does not issue certificates. Fees are set by each certification body and depend on your size and scope, so get quotes rather than relying on online estimates.
What the NIST AI RMF actually requires
The NIST AI Risk Management Framework 1.0 was released on 26 January 2023 by the US National Institute of Standards and Technology. It is voluntary and organized around four functions:
- Govern – policies, roles, accountability, workforce competence and culture, including third-party and supply-chain risk.
- Map – establish the context and identify risks for each AI system before and during use.
- Measure – assess, analyse and track risks with appropriate metrics, including the framework’s trustworthiness characteristics.
- Manage – prioritize and act on risks, with ongoing monitoring and incident response.
NIST also published a companion Generative AI Profile (NIST AI 600-1) on 26 July 2024, which maps generative-AI-specific risks such as confabulation, harmful content and third-party model risk to the four functions. If you use ChatGPT-style tools or build on a foundation model, the profile is the more directly useful document.
One caveat: NIST states on its framework page that the AI RMF is being revised as part of the White House AI Action Plan. Treat version 1.0 as the current reference, but check for a revised edition before building a multi-year program on specific subcategory numbers.
Nobody is “NIST AI RMF certified”. NIST does not certify and there is no accredited scheme; a vendor’s NIST certificate is their own attestation.
How the two map to each other
The RMF describes what you do; 42001 describes the management system that proves you keep doing it.
| NIST function | Closest 42001 content |
|---|---|
| Govern | Clauses 4, 5 and 7 (scope, leadership, policy, competence) and Annex A policy and roles controls |
| Map | Clause 6 risk assessment and AI system impact assessment; Annex A lifecycle and data controls |
| Measure | Clause 9 performance evaluation and the metrics you attach to each system |
| Manage | Clause 8 operational controls, clause 10 improvement, incident and corrective-action handling |
A third document bridges both: ISO/IEC 23894:2023 (published February 2023) is guidance on AI risk management built on ISO 31000. It is the method most 42001 implementers use to satisfy clause 6, and its process (identify, analyse, evaluate, treat, monitor, record) is compatible with the RMF’s Map, Measure and Manage functions.
In practice, keep one risk register and one inventory and tag each entry with both the RMF function and the 42001 clause it satisfies, rather than running two parallel programs.
Cost and effort, realistically
NIST AI RMF. The document is free. Effort is internal time: an owner, an inventory, a per-system risk profile, a short policy and a review cadence. A 30-person company with five AI tools can usually stand up a credible first pass in a few working days spread over a month. There is no external audit cost.
ISO/IEC 42001. You buy the standard (and usually 23894), do everything in the NIST list, and add the management-system overhead: documented scope, internal audit, management review, corrective-action tracking and control-selection justification. If you certify, add the certification body’s fees and the time to host the audit; quotes vary widely with headcount and scope.
For most small businesses, 42001 roughly doubles the paperwork relative to a lean RMF program, and certification adds a recurring external cost. That is worth it when a certificate wins or protects revenue.
Which to start with: a decision path
- Does any customer contract, RFP, insurance application or partner questionnaire mention ISO 42001? If yes, build to the 42001 clause structure now, even if you certify later.
- Do you sell or deploy AI into the EU, or use AI for hiring, credit, insurance or health decisions? If yes, you will need documented risk management, logging and human oversight regardless of framework. Either works as the container; the obligations come from the law (see below).
- Are you mainly using off-the-shelf tools (chat assistants, CRM AI features, meeting summarizers)? Start with NIST AI RMF plus the Generative AI Profile, in a format you could later map to 42001.
- Do you build AI products for others? Consider 42001 earlier; customer due-diligence teams increasingly ask for it.
Example. Northwind Payroll Services, a fictional 35-person Calgary firm, uses an AI assistant for support tickets and a vendor’s model to flag payroll anomalies. No customer has asked for a certificate, so Northwind adopts the NIST AI RMF: a one-page policy (Govern), an inventory and risk profile for both systems (Map), monthly accuracy spot checks on the anomaly flags (Measure), and an incident procedure (Manage). Eighteen months later a national client requires ISO 42001 evidence. Because Northwind tagged every record with the matching 42001 clause, it builds an AIMS scope and internal audit on top of the existing program rather than starting over.
How both relate to legal obligations
This is where businesses most often get misled, so the distinctions matter.
Both frameworks are voluntary. Adopting either creates no legal obligation and satisfies no legal obligation on its own.
Some US state laws treat NIST alignment as evidence of reasonable care. The Texas Responsible Artificial Intelligence Governance Act (HB 149, TRAIGA), signed 22 June 2025 and effective 1 January 2026, gives the Texas Attorney General exclusive enforcement with a 60-day cure period and provides a rebuttable presumption of reasonable care for compliant AI programs, including programs aligned with the NIST AI RMF (Business & Commerce Code ss. 552.101-552.105). That presumption is valuable, but it is rebuttable, it only matters if TRAIGA applies to you, and it is not a certification.
The EU AI Act is binding law and sets its own dates. Providers of high-risk systems must run a documented risk management system (Art. 9), and the Annex III high-risk obligations apply from 2 December 2027 following the Digital Omnibus on AI (Regulation (EU) 2026/1744, in force 27 July 2026). ISO/IEC 23894 and 42001 are sensible ways to organize an Art. 9 process, but a certificate is not a conformity assessment and does not substitute for the Act’s requirements.
Canada has no federal AI statute. Bill C-27, which contained the proposed Artificial Intelligence and Data Act, died on the Order Paper when Parliament was prorogued on 6 January 2025. Bill C-36, introduced 15 June 2026, is a privacy bill that would require transparency about automated decision-making for significant decisions; it is a bill only and nothing in it is in force. Canada’s Voluntary Code of Conduct on advanced generative AI (September 2023) is, as its name says, voluntary. Your binding Canadian obligations today come from privacy law such as PIPEDA and Quebec’s Law 25, which neither framework replaces.
Put simply: use NIST or ISO to organize your program; use the law to decide what the program must contain; and never describe alignment as certification or certification as compliance.
Sources
- ISO/IEC 42001:2023 – https://www.iso.org/standard/42001
- ISO/IEC 23894:2023 – https://www.iso.org/standard/77304.html
- NIST AI Risk Management Framework – https://www.nist.gov/itl/ai-risk-management-framework
- NIST AI 600-1 Generative AI Profile – https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-generative-artificial-intelligence
- Texas HB 149 (TRAIGA) enrolled text – https://capitol.texas.gov/tlodocs/89R/billtext/html/HB00149F.htm
- EU AI Act 2024/1689 – https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng
- Digital Omnibus on AI 2026/1744 – https://eur-lex.europa.eu/eli/reg/2026/1744/oj/eng
- Bill C-27 – https://www.parl.ca/legisinfo/en/bill/44-1/c-27
- Bill C-36 – https://www.parl.ca/legisinfo/en/bill/45-1/c-36
- Canada Voluntary GenAI Code – https://ised-isde.canada.ca/site/ised/en/voluntary-code-conduct-responsible-development-and-management-advanced-generative-ai-systems
Frequently asked
- Can a small business get NIST AI RMF certified?
- No. NIST publishes the framework but does not certify organizations against it, and there is no accredited NIST AI RMF certification scheme. Anyone selling a NIST AI RMF certificate is selling their own attestation, not a NIST credential.
- Who issues ISO/IEC 42001 certificates?
- Accredited third-party certification bodies issue them after auditing your AI management system. ISO itself publishes the standard but does not certify anyone.
- Does ISO 42001 certification mean we comply with the EU AI Act?
- No. The EU AI Act is a binding regulation with its own obligations and dates (for example, Annex III high-risk duties apply from 2 December 2027). A 42001 management system can organize your work toward those obligations, but certification is not a legal finding of compliance.
- Can we use both at the same time?
- Yes, and this is common. Many organizations run NIST's four functions as the day-to-day method and use the 42001 clause structure as the container for policy, audit and management review.
This guide is general information, not legal advice. Laws and dates are drawn from our verified regulatory dataset and link to official sources; check them for changes after the review date.