Three frameworks, one goal: ISO 42001, the EU AI Act and NIST AI RMF explained.

‍

Most businesses we speak to are asking some version of the same question: Do we need ISO 42001, the EU AI Act, or the NIST AI Risk Management Framework?

The short answer is usually yes, and you may need more than one.

These aren't competing options. They solve different, but related, problems. Yet it's easy for organisations to pick one and assume it covers everything. For an SME using AI to screen CVs, answer customer queries or draft client reports, that could prove a costly assumption. Simply put, one is a law, one is a management system and one is a risk framework.

EU AI Act: Regulation (EU) 2024/1689.

As the name suggests, this is law, not guidance. If you provide or deploy AI in the EU, you need to understand if and how the Act may apply, whatever your size.

Think of GDPR. If you handle personal data, GDPR may apply whether you’re a ten-person organisation or a multinational. The particular rules depend on what you’re doing. The EU AI Act takes a similar approach to AI: the relevant obligations depend on the system, its purpose and the organisation’s role.

Certain AI practices are banned, while systems considered high-risk, such as AI used for recruitment and candidate evaluation, face much more substantial requirements. Other uses may attract transparency requirements or fewer obligations.

The critical point for businesses is that the Act tells you the legal requirements you need to meet, but it doesn't tell you how to run your business to achieve it.

ISO/IEC 42001: Artificial Intelligence Management System (AIMS).

Published in 2023, ISO/IEC 42001 is an international standard for establishing and continually improving an Artificial Intelligence Management System.

Think of the quality system in a manufacturer, or the month-end close in a finance team: defined roles, a repeatable routine, sign-offs, internal checks, and an outside auditor confirming it all works.

If you're already ISO 27001 certified, the structure will feel familiar. In our experience the organisations we work with are further along than they expect, with many of the foundations already in place through security, risk, supplier and compliance processes.  The gap is often making AI-specific risks visible: transparency, bias, explainability, human oversight, AI suppliers and the ongoing monitoring of outcomes.

The certification also provides customers, partners and boards with independent assurance that AI governance is being managed systematically, which becomes increasingly valuable as clients begin asking how AI is governed within businesses they work with.

One misconception that is worth clarifying: ISO 42001 certification does not automatically mean compliance with the EU AI Act.

Certification shows your governance system works. The Act's legal obligations still have to be assessed against each AI system and use case.

NIST AI RMF: Artificial Intelligence Risk Management Framework (AI RMF 1.0).

Published by the US National Institute of Standards and Technology, this is the most flexible of the three. It is voluntary and isn’t a certification standard.

Think of a structured risk assessment. It helps organisations identify, assess, manage and communicate the things that could go wrong throughout an AI system's lifecycle. Its core is organised around four functions: Govern, Map, Measure and Manage.

For organisations at the start of their AI governance journey, it is often the easiest and most practical place to begin.

A practical example.

Take an SME using AI to shortlist job applicants. The same system looks different through each lens.

The EU AI Act classifies it as a high-risk use and attaches specific legal obligations.

NIST AI RMF prompts the questions:

• Could the model introduce bias?
• Are outputs sufficiently explainable?
• Is there appropriate human oversight?
• How will performance be monitored over time?
• What happens when something goes wrong?

ISO 42001 provides the governance that ensures those questions are consistently asked, documented, reviewed, approved and monitored.

Same system, three lenses:

• One focuses on legal compliance.
• One focuses on governance.
• One focuses on risk.

Although they approach AI from different directions, all three address recurring themes such as accountability, transparency, risk management, monitoring and human oversight.

What this means for organisations.

The practical starting point isn't choosing a logo or framework. It's knowing where AI is being used in your organisation, what decisions it influences and who is accountable for it. From there, the picture becomes much clearer.

If you already have mature security, risk and compliance practices, you may be closer than you think. The challenge is making AI visible within those processes and ensuring that the decisions surrounding it are understood, documented and owned.

For IT and security leaders, that's perhaps the most useful way to think about all three approaches: The EU AI Act establishes legal obligations. ISO 42001 helps build the management system. NIST AI RMF provides a practical way to think about risk.

Three approaches. Different purposes. One goal: trustworthy, well-governed AI.

‍