NIST AI Risk Management Framework
Published by the U.S. National Institute of Standards and Technology in January 2023 (AI RMF 1.0, NIST AI 100-1), the AI RMF is voluntary and not certifiable. It organizes AI risk management into four functions:
- Govern — culture, policies, accountability, and processes across the AI lifecycle.
- Map — establishing context and identifying risks for specific AI systems.
- Measure — analyzing, assessing, and tracking identified risks.
- Manage — prioritizing and acting on risks, including response and recovery.
NIST has published companion resources, including the AI RMF Playbook and a Generative AI Profile (NIST AI 600-1, July 2024) that addresses risks specific to generative AI.
ISO/IEC 42001:2023
ISO/IEC 42001, published in December 2023, specifies requirements for an AI management system (AIMS). Like ISO/IEC 27001 for information security, it follows the harmonized management system structure — context, leadership, planning, support, operation, performance evaluation, and improvement — with annexes describing AI-specific controls and objectives. Organizations can be audited and certified against it by accredited certification bodies.
Key differences
| NIST AI RMF | ISO/IEC 42001 | |
|---|---|---|
| Type | Voluntary risk management framework | Management system standard with requirements |
| Certification | No | Yes, via accredited certification bodies |
| Structure | Govern, Map, Measure, Manage | Management system clauses plus AI control annexes |
| Cost to access | Free | Purchased from ISO or national bodies |
| Best for | Structuring risk practices; U.S. public and private sector reference | Demonstrating a certified AI management system to customers and partners |
Using them together
Many organizations use the AI RMF to structure risk identification and treatment and ISO/IEC 42001 to operationalize and demonstrate a management system. Organizations already certified to ISO/IEC 27001 often find the management-system mechanics familiar.
FlashTower maps findings to NIST AI RMF subcategories and other frameworks to help organize remediation. A FlashTower assessment is not an audit and does not certify conformance with either framework.
Which should you use?
- If customers or partners ask for a certification, or you already operate ISO management systems, ISO/IEC 42001 is likely the target.
- If you need a flexible structure for identifying and treating AI risks — or you work with U.S. public-sector organizations that reference NIST — start with the AI RMF.
- If you are a small organization, neither needs to be adopted wholesale at first. Put practical controls in place, then map them to the framework your stakeholders care about.
Other frameworks may also be relevant depending on where you operate and what you build, including sector regulations and AI-specific laws. Map requirements once and reuse evidence across them where you can.
Frequently asked questions
Is the NIST AI RMF mandatory?
The AI RMF itself is voluntary. Some organizations adopt it by policy, and it may be referenced in contracts or procurement requirements.
Can FlashTower make us ISO/IEC 42001 certified?
No. Certification is performed by accredited certification bodies. FlashTower can help organize AI risk findings and remediation evidence that support a management system.