Compare

NIST AI RMF vs ISO/IEC 42001: how they differ, side by side

How NIST AI RMF and ISO/IEC 42001 differ: what each is, who owes it, when it applies and who enforces it.

NIST AI RMFVoluntary framework

ISO/IEC 42001Voluntary standard; certifiable by accredited bodies

Checked21 Oct 2026

01 / Side by side

NIST AI RMF and ISO/IEC 42001, side by side

	NIST AI RMF	ISO/IEC 42001
What it is	voluntary framework	international standard
Jurisdiction	United States (federal)	International
Legal force	Voluntary framework	Voluntary standard; certifiable by accredited bodies
Status	Published standard	Published standard
Applies from	26 Jan 2023	18 Dec 2023
Who owes it	Any organization that designs, develops, deploys, evaluates or uses AI systems and chooses to adopt it; no one is required to by the framework itself.	Any organization that provides or uses products or services that use AI systems, regardless of size, type or nature, if it chooses to adopt or certify.
Enforcement	None; voluntary. Contracts, agency policies or other laws may reference it.	None; voluntary. Accredited certification bodies audit and certify; customers may require certification by contract.

02 / NIST AI RMF

What NIST AI RMF requires

AI-specific. It addresses risks such as validity, reliability, safety, security, accountability, explainability, privacy and harmful bias in AI systems across their lifecycle.

01GOVERN: set policies, accountability, culture and third-party controls for AI risk across the organization.
02MAP: establish each AI system's context, purpose, categorization, benefits, costs and impacts.
03MEASURE: select metrics and test, evaluate, verify and validate AI systems for trustworthiness characteristics; track risks over time.
04MANAGE: prioritize and treat AI risks, manage third-party risk, and monitor deployed systems with response and recovery plans.
05Optionally build use-case or sector profiles that select and tailor the subcategories that matter.

03 / ISO/IEC 42001

What ISO/IEC 42001 requires

AI-specific. It is a governance system for how an organization develops, provides or uses AI systems, not a technical test of any one model.

01Define the AIMS scope, the organization's role toward AI (e.g. provider, user) and relevant interested parties.
02Top management sets an AI policy, AI objectives and assigns roles and responsibilities.
03Run AI risk assessments, AI risk treatment and AI system impact assessments, and record a Statement of Applicability.
04Plan, operate and control AI processes, applying the Annex A controls selected in risk treatment.
05Monitor, measure and evaluate AIMS performance through internal audits and management reviews.
06Correct nonconformities and continually improve the AIMS.

Optional evidence · where Planisphere fits

Keep a record anyone can check

When your team meets a duty, Planisphere can seal the event it reports as a receipt.

01 · Your teamRecord the event

A disclosure shown, a review signed, a model change approved: the event your system reports.

02 · PlanisphereSeal it

The event becomes a sealed receipt, dated and attributed to whoever is signed in.

03 · AnyoneCheck it

Paste the receipt into Verify. No account or key.

A record supports your compliance evidence process. It is not a legal finding or a certification. Systems that call Planisphere's gate API can also hold or refuse an action before it runs.

SOURCES