AI Assurance DirectoryISO/IEC 42001 and NIST AI 100-1: the two source documents behind the crosswalk
Informational only, not professional or legal advice. Facts are linked to the source we checked; statuses can change after the date above.
A crosswalk is only as good as the two documents it joins. Before using one, cite both by their exact titles and know what NIST says about the mapping.
The two documents
- ISO/IEC 42001:2023, titled “Information technology — Artificial intelligence — Management system”, is the ISO standard for an AI management system.
- NIST AI 100-1, titled “Artificial Intelligence Risk Management Framework (AI RMF 1.0)”, is the NIST publication created on 26 January 2023. NIST says the framework is intended to be voluntary, rights-preserving, non-sector specific and use-case agnostic.
Neither document is sector-specific, so neither replaces the product-level standards for aviation, automotive, medical devices or machinery.
The official crosswalk, and what it is built on
NIST’s crosswalk listing hosts “NIST AI Risk Management Framework to ISO-IEC-42001 Crosswalk”. The PDF itself, “NIST AI RMF to ISO/IEC FDIS 42001 AI Management system Crosswalk”, maps AI RMF subcategories to clauses of the final draft (FDIS), not to the published standard. It lists each subcategory beside one or more clauses and controls, labeled in the PDF as 4.1, 6.1.2, 9.3.1, B.6.2.6 and so on.
Three practical consequences:
- Verify every clause number against your licensed copy of the published ISO/IEC 42001:2023 before putting it in an audit file.
- Treat the mapping as NIST’s, not ISO’s. The listing page states that inclusion of a crosswalk does not imply NIST endorsement of the other resource, nor that either resource comprehensively covers the other.
- Do not extend the mapping. If a subcategory is not listed against a clause in the PDF, any link you draw is your own judgment.
Sample rows from the official PDF
| AI RMF subcategory | Clauses and controls the PDF lists |
|---|---|
| Govern 6.2: contingency processes for failures or incidents in third-party data or AI systems deemed high-risk | B.10.2 allocating responsibilities, B.10.3 suppliers |
| Map 3.5: processes for human oversight are defined, assessed and documented | B.6.1.3, B.6.2.7, B.8.2 |
| Manage 2.4: mechanisms to supersede, disengage or deactivate AI systems inconsistent with intended use | B.9.4 intended use, B.8.2, B.6.2.7 (the PDF lists further entries) |
| Manage 4.3: incidents and errors are communicated and tracked | 9.3.2, B.8.5, B.6.2.6 (the PDF lists further entries) |
Analysis, not a NIST or ISO statement: these four rows show the pattern that the crosswalk ties AI RMF risk activities to supplier, documentation and operation controls in the management system. For a fuller walk-through see the practical crosswalk article, and for audit expectations see what auditors ask.
Sources
- ISO/IEC 42001:2023 — Information technology — Artificial intelligence — Management system - ISO
- Artificial Intelligence Risk Management Framework (AI RMF 1.0) - NIST
- Crosswalk Documents (NIST AI Resource Center) - NIST AI Resource Center
- NIST AI RMF to ISO/IEC FDIS 42001 crosswalk - NIST AI Resource Center