A company selling into Europe is asked about EU AI Act readiness. A US customer asks which AI risk framework it follows. A procurement team asks whether it is certified to ISO/IEC 42001. The same team receives all three questions in one quarter.
Treating each as a separate project triples the work and produces three disconnected binders. The harder issue is that the three do not line up one-to-one: a law classifies systems by risk, a framework describes practices, and a standard describes a management system that an auditor can certify.
RAMP keeps one AI register and one governance workflow, then maps the same records to each source. The register supports system classification, the requirements document and approvals show the governance practices, and the board briefing and audit package provide the management-system evidence. RAMP prepares the evidence; it does not issue certifications or legal opinions.
EU AI Act: a law, applied by risk and role
NIST AI RMF: a voluntary framework in four functions
ISO/IEC 42001: a management system you can certify
Start with the register and the two approval gates. Every one of the three sources asks for them in some form.
Frequently asked questions
- Is NIST AI RMF mandatory?
- No. It is voluntary guidance. Customers, regulators, and contracts may still expect organizations to align with it.
- Can a company be certified to ISO/IEC 42001?
- Yes. ISO/IEC 42001:2023 is a certifiable AI management-system standard, assessed by an accredited certification body.
- Does one AI governance process satisfy the EU AI Act, NIST AI RMF, and ISO 42001?
- One register and governance workflow can supply evidence for all three, but they are different in nature, and each still needs its own mapping and, for the EU AI Act, legal review of your role and risk classification.
Build the register and the approval process once, then map them outward. Ask counsel to confirm your EU AI Act role and classification; use the process to produce the evidence.