Which is easier to start?

The NIST AI RMF. It is free, flexible, and you can start by applying the four steps to your risk analysis, without an audit. ISO 42001 asks for more structure, because it ends in a certification audit. Many companies start with the framework and move to the standard when they need the certificate.

Can I use both together?

Yes, and it is the recommended approach. The NIST AI RMF's four steps feed the risk analysis ISO 42001 requires, so the work serves both. You use the framework to see the risk and the standard to certify. It is a single effort.

Where does the EU AI Act fit into this?

The NIST AI RMF and ISO 42001 are voluntary; the EU AI Act is law, mandatory for anyone offering AI in Europe. The first two help build the governance the law requires, but they don't replace AI Act compliance. If you sell AI into Europe, it pays to look at all three together.

Where should a company start?

If the pain is understanding where AI can fail, start with the NIST AI RMF and structure the risk analysis. If a customer or regulator already asks for proof, aim for ISO 42001. In many cases, it pays to use the framework for the risk and move straight to the certificate.

AI governance

ISO 42001 vs NIST AI RMF

Both help you use artificial intelligence responsibly, but in different ways. ISO/IEC 42001 is an international standard that earns a certificate: you follow it and an accredited body confirms that your company handles AI well. The NIST AI RMF is a free framework from the United States that organises AI risk into clear steps, with no certificate. In practice, the NIST AI RMF helps you build the risk analysis, and ISO 42001 proves the result with a recognised badge.

See AI Trust readiness Jump to the comparison

In short

ISO 42001 earns a certificate issued by an outside body. The NIST AI RMF has no certificate: it is a guide for handling AI risk.
The NIST AI RMF is free and great to start; ISO 42001 is what proves governance to customers and regulators.
Both look at the same care, so one gets the other going.
The common path: use the NIST AI RMF to organise risk and ISO 42001 to certify.

Side by side

What separates a standard from a framework

What to compare	ISO/IEC 42001	NIST AI RMF
What it is	An international standard for managing artificial intelligence. It earns a certificate.	A free framework for handling AI risk, from NIST in the United States. No certificate.
Where it comes from	International (ISO/IEC), from 2023.	The United States (NIST), from 2023.
How it is organised	A management system with about 38 controls and a continual-improvement cycle.	Four steps: Govern, Map, Measure and Manage AI risk.
Is there a certificate?	Yes, issued by an accredited body.	No. You use it as a guide and measure on your own.
Cost to adopt	There is a cost for the audit and for keeping the certificate.	The material is free. You pay only for the work of applying it.
Where it focuses	On organising AI end to end in the company and proving it.	On understanding and reducing the risk of each AI use.
Who it serves	Those who need to prove AI governance to customers, investors and regulators.	Those who want to structure AI risk analysis with a recognised method.
How long it lasts	3 years, with follow-up visits every year.	It doesn't expire. You review it when you want.

The NIST AI RMF and ISO 42001 pair up: the framework helps you build the risk analysis the standard requires. There is also an extra NIST guide for generative AI, from 2024, useful for anyone using language models.

The standard that earns a certificate

ISO/IEC 42001

It does for AI what ISO 27001 does for security: it creates an organised way to handle the topic and earns a certificate. You set the rules for using AI, assess risks and impacts, put controls in place and improve over time. In the end, the certificate proves to customers, investors and regulators that your company takes the topic seriously.

Earns a certificate issued by an accredited body
About 38 controls, on a continual-improvement cycle
Covers AI end to end in the company
Recognised worldwide

The free framework

NIST AI RMF

It is a United States guide that organises AI risk into four steps: govern, map, measure and manage. It earns no certificate. It helps you understand where AI can fail, measure that risk and reduce it. It is free, flexible and easy to start, and it helps a lot with building the risk analysis.

Free and easy to start
Four steps: govern, map, measure and manage
No certificate: you measure on your own
Great for structuring AI risk analysis

How they fit together

The NIST AI RMF organises risk; ISO 42001 certifies

Both look at the same problem: using AI without getting hurt. The NIST AI RMF is the method for seeing and reducing the risk of each AI use, in clear language. ISO 42001 turns that work into a management system that an outside body audits and certifies. That is why many companies use the framework to build the risk analysis and the standard to prove governance with a recognised badge.

The NIST AI RMF's four steps feed ISO 42001's risk analysis
The framework helps you organise; the certification proves the result
Together, they cover from the risk of each use to company-wide governance

Which is your case

Where to start

You need to prove AI governance to customers or regulators

Go with ISO 42001

It is the certificate recognised worldwide. It proves, right away, that your company handles AI well.

You want to understand and reduce AI risk first

Start with the NIST AI RMF

It is free and practical. It structures the risk analysis and becomes the base that shortens ISO 42001 later.

You want both: organise and certify

NIST AI RMF for risk, ISO 42001 to prove

The most efficient path. You use the framework for the risk analysis and the standard to certify, with a single effort.

Numbers that matter

4 steps

of the NIST AI RMF: Govern, Map, Measure and Manage

2023

year of both ISO/IEC 42001 and the NIST AI RMF

3 years

validity of the ISO 42001 certificate

How DM11 helps

Risk analysis and ISO 42001 certification, with DM11

We use the NIST AI RMF to build the risk analysis of your AI uses and prepare ISO 42001 so you earn the certificate, with a single effort.

You organise the risk and earn the certificate in one project, with no double work
We point out where your AI can fail before it turns into a problem
We handle the paperwork and evidence; your team keeps building
You reach the audit already knowing you'll pass, with no last-minute surprise

Explore AI Trust

Frequently asked

What people ask before deciding

Answers anchored in ISO/IEC 42001:2023 and the NIST AI Risk Management Framework.

No. The NIST AI RMF helps you organise and reduce AI risk, but it earns no certificate. When a customer, an investor or a regulator asks for proof that you handle AI well, ISO 42001 is what answers, since it earns a certificate issued by an outside body. One organises the risk, the other proves governance.

Find out your AI uses' risk and the path to ISO 42001

A short conversation shows where your AI can fail and the distance to the certificate. No commitment.

Talk to a specialist Explore AI Trust

ISO 42001 vs NIST AI RMF

What to compare

ISO/IEC 42001

NIST AI RMF

What it is

An international standard for managing artificial intelligence. It earns a certificate.

A free framework for handling AI risk, from NIST in the United States. No certificate.

Where it comes from

International (ISO/IEC), from 2023.

The United States (NIST), from 2023.

How it is organised

A management system with about 38 controls and a continual-improvement cycle.

Four steps: Govern, Map, Measure and Manage AI risk.

Is there a certificate?

Yes, issued by an accredited body.

No. You use it as a guide and measure on your own.

Cost to adopt

There is a cost for the audit and for keeping the certificate.

The material is free. You pay only for the work of applying it.

Where it focuses

On organising AI end to end in the company and proving it.

On understanding and reducing the risk of each AI use.

Who it serves

Those who need to prove AI governance to customers, investors and regulators.

Those who want to structure AI risk analysis with a recognised method.

How long it lasts

3 years, with follow-up visits every year.

It doesn't expire. You review it when you want.

ISO/IEC 42001

Earns a certificate issued by an accredited body

About 38 controls, on a continual-improvement cycle

Covers AI end to end in the company

Recognised worldwide

NIST AI RMF

Free and easy to start

Four steps: govern, map, measure and manage

No certificate: you measure on your own

Great for structuring AI risk analysis

The NIST AI RMF organises risk; ISO 42001 certifies

The NIST AI RMF's four steps feed ISO 42001's risk analysis

The framework helps you organise; the certification proves the result

Together, they cover from the risk of each use to company-wide governance

Risk analysis and ISO 42001 certification, with DM11

We use the NIST AI RMF to build the risk analysis of your AI uses and prepare ISO 42001 so you earn the certificate, with a single effort.

You organise the risk and earn the certificate in one project, with no double work

We point out where your AI can fail before it turns into a problem

We handle the paperwork and evidence; your team keeps building

You reach the audit already knowing you'll pass, with no last-minute surprise