NIST AI RMF vs ISO 42001: which one should a small company document against?

ISO/IEC 42001:2023 is an international standard, published in December 2023, that specifies the requirements for an AI management system: the policies, roles, processes and records through which an organisation establishes, operates, monitors and improves its development or use of AI [3]. It uses the same harmonised structure as ISO/IEC 27001 and ISO 9001, so clauses 4 to 10 cover context, leadership, planning, support, operation, performance evaluation and improvement, in that order.

Annex A lists the reference controls, grouped under nine objectives (A.2 to A.10) that run from AI policies and internal organisation through resources, impact assessment, the system life cycle, data, information for interested parties, use of AI systems and third-party relationships. Annex B gives implementation guidance for each control, and clause 6.1.3 asks the organisation to produce a statement of applicability saying which controls it has adopted and why the others do not apply.

The standard is written to be audited. Every "shall" in clauses 4 to 10 is a requirement an accredited certification body can test, and each one expects documented information behind it. That is the trade: a fixed structure that takes more work to set up, in exchange for a certificate at the end.

In practice the question is settled by whoever is sending you the questionnaire. US enterprise customers and US public bodies tend to reference NIST, partly because the framework comes from a US federal agency, and partly because NIST frameworks are familiar from the security questionnaire that arrived first. The usual form of the request is "describe how your AI risk management aligns to the NIST AI RMF", and it is answered with a mapping document rather than a certificate.

Procurement that is driven by certification asks for ISO/IEC 42001 in the same breath as ISO/IEC 27001, because the buyer's vendor process is built around certificates and a management system standard fits the slot. European buyers, larger buyers with formal supplier assurance programmes and any buyer that already holds 42001 itself are the ones most likely to ask. Regulators, so far, name neither as mandatory.

The EU AI Act lets conformity with its requirements be shown through harmonised standards, and under Article 40(1) a standard gives that presumption only once its reference is published in the Official Journal [4]. The first European standard written for the Act, EN 18286:2026 on the quality management system that Article 17 asks of providers of high-risk systems, was published by CEN and CENELEC in July 2026 [5]. The Act is therefore a reason to watch both texts rather than a reason to hold a 42001 certificate today.

The framework changes slowly and informally. NIST updates the Playbook and adds profiles without reissuing the core, though its resource page states that AI RMF 1.0 is being revised as part of the White House AI Action Plan [2]. A document set aligned to it therefore needs a review when a relevant profile or the revised framework appears, and otherwise an annual check.

The standard changes rarely and formally, and its running cost sits elsewhere: in the certification cycle, the internal audits, the management reviews and the records those produce. A small company documenting against 42001 should expect the management system to need an owner with time set aside each quarter, where the NIST-aligned set needs an owner with time set aside each year. Under the maintenance plan, $29 to $99 a month, we track whichever you were drafted against and reissue the documents with the changes marked when the text moves.

For a SaaS or technology company with a few AI features and its first AI questionnaire, the sequence that works is the inventory first, because every other document refers to it; then the policy, because it assigns the owner; then the risk assessment and human oversight procedures, because those are what the questionnaire actually probes; then the incident procedure. The ISO-specific records come last and only if certification is in view. The security side of the same questionnaire is answered by the information security policy set, and the two sets are drafted to share one document ID convention and one revision block.

We draft the AI set as the AI governance suite, quoted at $3,000 to $5,000, reviewed by our legal team before delivery, with the mapping table included so one set of documents can be read against a NIST question, an ISO audit or an Article 26 questionnaire. The classification of each system, provider or deployer, high-risk or not, is yours to make; the suite records the answer and the reasons for it.