ISO/IEC 42001 vs NIST AI RMF: a practical crosswalk

Teams in regulated industries often ask whether to adopt ISO/IEC 42001 or the NIST AI RMF. The two are not alternatives of the same kind, and NIST publishes a mapping between them.

Status as of 14 October 2026: ISO’s explained page still says the standard does not replace laws or regulations, Certification for ISO/IEC 42001 is voluntary, and ISO does not certify organizations. NIST’s AIRC crosswalks listing still hosts the FDIS 42001 PDF below, and now also lists a Microsoft row titled ISO-IEC-42001 plus INCITS/AI rows for ISO/IEC 23894 (Revised, 14 August 2025) and ISO/IEC 42005 (14 August 2025). Inclusion still does not imply NIST endorsement.

Two different kinds of document

ISO/IEC 42001 specifies requirements for an Artificial Intelligence Management System, and ISO says organizations may choose certification by independent certification bodies. The NIST AI RMF is intended for voluntary use, is organized into four functions: Govern, Map, Measure and Manage, and NIST says its actions do not constitute a checklist.

In short: one is a standard you can be audited against, the other is a framework you use to structure risk work. Analysis: that difference is why the common advice is to use them together rather than pick one.

What NIST’s crosswalk says

NIST’s AI Resource Center hosts a crosswalk from the AI RMF to ISO/IEC FDIS 42001. The PDF title is still “NIST AI RMF to ISO/IEC FDIS 42001 AI Management system Crosswalk” as of 14 October 2026. Two cautions from the sources themselves:

• It maps to the FDIS (final draft) of the standard, as its title says, so verify clause numbers against the published standard.
• NIST’s listing page says inclusion of a crosswalk does not imply NIST endorsement of the resource the AI RMF is mapped to, nor that either resource comprehensively covers the other.

Example mappings

These rows are taken from the NIST-hosted crosswalk. Subcategory text is paraphrased.

How to use both

Analysis, not sourced fact: a workable pattern is to treat ISO/IEC 42001 as the auditable management system (policy, roles, internal audit, management review, corrective action) and use the AI RMF’s Map and Measure activities as the technical content that feeds the system’s risk assessments. The crosswalk rows above show where the evidence from one answers a requirement in the other.

Limits for aerospace and defense

Neither document is a product-level assurance method. ISO describes 42001 as managing AI-related risks and opportunities across an organization rather than looking at details of specific AI applications. For airborne systems, see the FAA roadmap, the EASA concept paper and DO-178C and ML gaps. For generative AI on a defense contract, see NIST AI 600-1 for defense contractors. For the evidence each side expects, see the AI audit evidence checklist.