ISO 42001 vs NIST AI RMF for defense contractors

The clause-level walkthrough is ISO/IEC 42001 vs NIST AI RMF: a practical crosswalk. This page is the defense-contractor brief: which instrument is which, what DoD already said it builds on, and what neither one is.

Two different instruments

ISO/IEC 42001:2023 specifies requirements for an organizational Artificial Intelligence Management System. ISO says organizations may choose certification when they want independent confirmation, and that certification is performed by independent certification bodies. It is not a product certificate for a model. Audit evidence is in What auditors ask.

The NIST AI RMF Core is organized as Govern, Map, Measure and Manage. The Playbook provides suggested actions aligned to those functions and is neither a checklist nor set of steps to be followed in its entirety. Playbook suggestions are voluntary.

NIST hosts a crosswalk from the AI RMF to ISO/IEC FDIS 42001. NIST states that inclusion of a crosswalk does not imply NIST endorsement of the resource the AI RMF is mapped to. Use the PDF for example mappings; do not treat it as a certification shortcut.

What DoD already said about the RMF

CDAO’s RAI Toolkit announcement says the toolkit is built upon the DIU Responsible AI Guidelines and Worksheets, the NIST AI Risk Management Framework and Toolkit, and the IEEE 7000 standard, among other sources. It provides a voluntary process that identifies, tracks, and improves alignment of AI projects to RAI best practices and the DoD AI Ethical Principles. See DoD RAI Toolkit vs NIST AI RMF and the CDAO AIA Toolkit listing.

We have not found a DoD page that makes ISO/IEC 42001 certification a DFARS clause or a substitute for the five ethical principles. We have not found a page that says the RMF Playbook is a CMMC assessment.

How a DIB team should use both

Use the RMF (and the Playbook) to structure TEVV and roles. Govern / Map / Measure / Manage is the vocabulary CDAO already said it built on. The Playbook’s suggestions are voluntary; borrow what applies.

Use 42001 if leadership wants a certifiable AIMS. That is an organizational management-system certificate from an independent body, not a model approval and not a 3000.09 review. Platforms that map clauses, such as ISMS.online, are compliance automation. They are not the certificate.

Do not explode a template into every clause. A vendor page that says “ISO 42001 templates” is not a cited mapping to Clause 6.1.2 or Annex A.6.2.4 unless that page names the clause. Coverage cells on this site follow that rule.

Keep CMMC and 3000.09 on their own tracks. CMMC is about CUI on information systems. DoD Directive 3000.09 is about autonomy in weapon systems. Neither is an AIMS certificate.

Questions

Does 42001 certification satisfy DoD Responsible AI?

No source we cite says that. CDAO’s toolkit is voluntary and names the NIST RMF as a source, not ISO/IEC 42001 as a substitute for the ethical principles.

Does the NIST–ISO crosswalk certify my AIMS?

NIST says inclusion of a crosswalk does not imply NIST endorsement. Certification is performed by independent certification bodies.