ISO 42001 · NIST AI RMF · EU AI Act
The three frameworks operators are actually asked about — what each one is, how they overlap, and what to do first. Written for the person who has to make a decision this quarter.
Most organisations don't pick one of these frameworks — they layer them. ISO/IEC 42001 gives you a management system, NIST AI RMF gives you a risk vocabulary, and the EU AI Act sets a legal floor for anything you ship into the EU. They answer different questions and shouldn't be treated as substitutes.
| ISO/IEC 42001 | NIST AI RMF 1.0 | EU AI Act | |
|---|---|---|---|
| WHAT IT IS | Certifiable management system standard for AI. | Voluntary risk management framework. | Binding EU regulation with penalties. |
| SCOPE | Any organisation developing or using AI. | Any organisation; lifecycle-focused. | AI systems placed on the EU market, by risk tier. |
| POSTURE | Process & governance. | Risk identification & treatment. | Prohibitions + obligations by risk class. |
| CORE ARTEFACTS | AIMS policy, AI inventory, Statement of Applicability, internal audits. | Govern · Map · Measure · Manage profiles. | Technical documentation, conformity assessment, post-market monitoring. |
| EVIDENCE ON DEMAND | Audit trail for ISO 42001 certification. | Internal — for auditors, customers, regulators. | Regulator-facing dossier; CE marking for high-risk. |
| BEST USED AS | Your management backbone. | Your risk vocabulary. | Your hard-floor compliance check. |
| START WITH | AI inventory + governance roles. | A Govern profile for one critical use case. | Risk classification of every AI system you ship into the EU. |
Pick ISO 42001 when…
You need an externally certifiable management system, customers ask for one, or you already operate ISO 27001 / 9001 and want a familiar shape.
Pick NIST AI RMF when…
You want a flexible, U.S.-aligned risk vocabulary to organise governance work without a certification commitment.
You must comply with the EU AI Act when…
Any AI system you build, sell, or operate is placed on the EU market or affects EU residents — regardless of where your company sits.
Need help mapping which framework applies to which of your AI systems — and producing the artefacts each one expects?
Talk to Morgan Signing House →