As organisations formalise AI governance, two frameworks come up again and again: the NIST AI Risk Management Framework from the United States and the international standard ISO/IEC 42001.
NIST AI RMF
Published in 2023, the NIST AI RMF is voluntary and organised around four functions: Govern (culture, policies and accountability), Map (context and risks), Measure (analysis and tracking) and Manage (prioritising and responding to risks).
ISO/IEC 42001
Also published in 2023, ISO/IEC 42001 specifies requirements for establishing, implementing, maintaining and improving an AI management system. Like other ISO management system standards, it follows a familiar structure and organisations can seek certification against it.
Using them together
Many organisations use ISO/IEC 42001 as the management backbone — policies, roles, audits and continual improvement — and draw on the NIST AI RMF for detailed risk practices within that system.
Frameworks don't create responsible AI. People with clear accountability, applying them consistently, do.
Key takeaways
- NIST AI RMF is a voluntary framework organised around Govern, Map, Measure and Manage.
- ISO/IEC 42001 specifies requirements for an AI management system and supports certification.
- The two complement each other: one guides risk practice, the other structures management.
- Both reward a clear AI inventory and defined accountability.
