The short answer
For most US companies, start with the NIST AI RMF, add ISO/IEC 42001 when customers or auditors ask for a certificate, and treat the EU AI Act as a legal duty that applies only if your AI reaches the EU market.
That framing is the gap in most “NIST AI RMF vs ISO 42001” guides. The first two are voluntary tools you choose between or combine. The third is a law, and you do not get to choose it if you have EU customers or EU users.
- NIST AI RMF: voluntary US guidance for managing AI risk. No certificate.
- ISO/IEC 42001: an international standard for an AI management system. You can be audited and certified against it.
- EU AI Act: binding EU law with fines. It reaches many non-EU companies.
What each framework is
NIST AI RMF
The NIST AI Risk Management Framework (AI RMF 1.0, January 2023) is voluntary guidance from the US National Institute of Standards and Technology. NIST’s own FAQ states plainly that it is not mandatory. It organizes AI risk work into four functions: Govern, Map, Measure and Manage.
A companion NIST AI 600-1 Generative AI Profile (July 2024) adds risks specific to generative AI. NIST says AI RMF 1.0 is being revised under the White House AI Action Plan, and as of October 2026 no revised version has been published. Be careful with web pages that advertise an “AI RMF 2.0”: NIST has not named one. On 7 April 2026 it released only a concept note for a critical-infrastructure profile.
ISO/IEC 42001
ISO/IEC 42001:2023 is the first international standard for an AI management system (AIMS). It follows the same high-level structure and Plan-Do-Check-Act cycle as ISO 27001, so security teams will find it familiar. It has 38 Annex A controls.
The key difference is that an independent auditor can certify you against it. A certificate is only as credible as the body that issues it, so look for a certification body accredited under ISO/IEC 42006:2025. ANAB accredited Schellman as the first US body to issue ISO 42001 certificates.
EU AI Act
The EU AI Act (Regulation (EU) 2024/1689) entered into force on 1 August 2024 and rolls out in stages. It sorts AI into prohibited practices, high-risk systems, transparency-only systems and general-purpose AI models, with different duties for each. It applies to providers, deployers, importers and distributors that place AI on the EU market or whose AI outputs are used in the EU, wherever the company is based.
NIST AI RMF vs ISO 42001 vs EU AI Act: side by side
| NIST AI RMF | ISO/IEC 42001 | EU AI Act | |
| Type | Voluntary risk framework | Certifiable management system standard | Binding regulation |
| Issuer | US NIST | ISO/IEC | European Union |
| Legal force | None by itself; some US state laws point to it | None by itself; customers may require it | Yes, with fines |
| Certification | No, self-attestation | Yes, third-party audit | No general certificate; high-risk systems need conformity assessment |
| Structure | Govern, Map, Measure, Manage | Management system clauses plus 38 Annex A controls | Risk tiers: prohibited, high-risk, transparency, general-purpose AI |
| Focus | Risk of individual AI systems | Organization-wide AI governance | Obligations tied to the product and its use |
| Applies to a US company | Optional | Optional | Only if your AI is placed on the EU market or its output is used in the EU |
| Status (Nov 2026) | Version 1.0 from January 2023, under revision | 42001:2023 in use | Digital Omnibus in force; Annex III high-risk duties start 2 December 2027 |
NIST AI RMF vs ISO 42001: the key differences
The NIST AI RMF tells you how to think about and manage AI risk. ISO 42001 gives you a management system an auditor can verify. One is a playbook; the other is proof that you follow one.
- Certifiable or not. ISO 42001 requires an external audit and produces a certificate. The NIST AI RMF has no certification, so you can only self-attest alignment.
- Prescriptive or flexible. ISO 42001 sets fixed requirements for policies, roles, documentation, monitoring and continual improvement. The RMF is outcome-based and lets you decide how to get there.
- ISO 42001 defines a management system for one organization. The RMF centers on the risks of AI systems and their impacts on people.
- Effort and cost. Reported ISO 42001 implementations take roughly five to nine months from scratch, plus audit fees. An RMF alignment effort can start small and grow, because nothing forces you to finish it before you begin.
- Where each is recognized. ISO 42001 carries weight with global enterprise buyers and regulated industries. The RMF is the US reference point: Texas’s TRAIGA, in force since 1 January 2026, gives an affirmative defense to organizations that substantially comply with the NIST AI RMF Generative AI Profile or a similar recognized framework.
Where they overlap
Both cover governance, risk assessment, monitoring and accountability, so work done for one carries over to the other. A common pattern is to run the RMF as your day-to-day risk method and build an ISO 42001 system around it when a certificate is required.
What neither one does
Neither is the EU AI Act. An ISO 42001 certificate alone does not prove conformity with the Act, which has requirements beyond the standard. And aligning with the RMF does not satisfy a contract that demands a certifiable management system.
Does the EU AI Act apply to US companies?
Yes, if you place an AI system on the EU market or the output of your AI is used in the EU. Where your company is incorporated does not matter. A US SaaS company with EU customers can be a provider, and a US company using AI to screen EU job applicants can be a deployer.
The Digital Omnibus on AI (Regulation (EU) 2026/1744) was published on 24 July 2026 and entered into force on 27 July 2026. It delayed the high-risk rules but not everything else:
| Date | What applies | Status |
| 2 Feb 2025 | Prohibited practices; AI literacy (since reworded to a support duty on the Commission and member states) | In force |
| 2 Aug 2025 | General-purpose AI model obligations | In force |
| 2 Aug 2026 | Article 50 transparency duties for new systems (chatbot and deepfake disclosure); AI Office enforcement powers | In force |
| 2 Dec 2026 | Machine-readable marking of AI-generated content for systems already on the market; new ban on nudifier apps and AI-generated CSAM | Upcoming |
| 2 Dec 2027 | High-risk AI under Annex III (employment, education, credit, biometrics, critical infrastructure) | Delayed from 2 Aug 2026 |
| 2 Aug 2028 | High-risk AI built into regulated products under Annex I | Delayed from 2 Aug 2027 |
| 2 Aug 2030 | High-risk AI intended for public authorities | Delayed from 2 Aug 2026 |
The delay reflects missing technical standards, not a softer stance. Enforcement bodies are already operating, and the prohibited-practice and general-purpose AI rules apply today.
Fines are set in Article 99 of the Act: up to €35 million or 7% of worldwide annual turnover (whichever is higher) for prohibited practices, and up to €15 million or 3% for most other violations.
For a US company, the first step is not choosing a framework. It is listing which of your AI systems touch the EU and which risk tier each falls into.
Which one should you follow?
Pick by who is asking you to prove your AI governance: a regulator, a customer, or nobody yet.
| Your situation | Start with | Add when needed |
| US-only company, no EU users, building an AI program from scratch | NIST AI RMF | ISO 42001 if buyers ask for a certificate |
| US company whose AI is used by EU customers or EU residents | EU AI Act scoping: inventory and classify your systems | ISO 42001 as the management backbone, RMF as the risk method |
| AI or SaaS vendor facing enterprise security questionnaires | ISO 42001 certificate | RMF alignment for your internal risk process |
| Company operating in Texas or other states that reference the RMF | NIST AI RMF, including the Generative AI Profile | ISO 42001 for global customers |
| US federal contractor or government supplier | NIST AI RMF | ISO 42001 for commercial customers |
| Early-stage startup with a few AI features | A lightweight RMF alignment: inventory, owners, testing records | ISO 42001 once revenue depends on enterprise deals |
A caution on Colorado
Many older guides say that following the NIST AI RMF or ISO 42001 gives you a safe harbor under the Colorado AI Act. That is out of date. Colorado signed SB 26-189 on 14 May 2026, repealing and replacing the 2024 law, with substantive compliance starting 1 January 2027. Secondary summaries report that the framework-based safe harbor did not survive the rewrite. Check the new text with counsel before you rely on any framework as a legal defense there.
