Turning the ISO/IEC 42001 to NIST AI RMF crosswalk into supplier evidence requests

A supplier may hold an ISO/IEC 42001 certificate, follow the AI RMF, or neither. The official NIST crosswalk gives a buyer a sourced starting point for asking the same question in either vocabulary.

What is sourced

For each AI RMF subcategory the PDF lists the management-system clauses and controls NIST associates with it. Examples taken directly from the PDF:

• Govern 1.6, mechanisms to inventory AI systems, lists B.4.2 resource documentation along with B.4.3 data, B.4.4 tooling, B.4.5 system and computing, and B.4.6 human resources.
• Govern 2.3, executive responsibility for AI risk decisions, lists 5.1 leadership and commitment, 9.3.1 to 9.3.3 management review, and 5.2 AI policy.
• Measure 4.1, measurement approaches tied to deployment context, lists B.6.2.4 verification and validation, B.5.4 and B.5.5 impact assessments, and 9.1 monitoring and evaluation (among others).
• Manage 4.1, post-deployment monitoring plans including incident response, lists 9.2.1, B.6.2.6 operation and monitoring, and B.8.3 external reporting (among others).

These clause labels follow the FDIS the crosswalk was written against, and NIST’s listing page says inclusion does not imply endorsement or comprehensive coverage. Check numbers against the published ISO/IEC 42001:2023.

What is editorial judgment

The steps below are the site’s suggested practice, not statements by NIST or ISO:

1. Pick the AI RMF subcategories that match the risk you are buying down, using the AI RMF 1.0 text.
2. For each, ask the supplier for the artifact that its management system would produce for the listed clauses: a policy, an inventory, a management-review record, a monitoring log.
3. Accept a certificate as evidence of a management system only. It does not show that a specific product meets a sector standard.
4. Record gaps as questions, not findings. A missing document may sit under a clause the crosswalk does not list.

The Pro kit “ISO/IEC 42001 ↔ NIST AI RMF crosswalk” turns the sourced rows into printable questions. See also the AI audit evidence checklist and the source-document caveats.