EU AI Act, NIST AI RMF and ISO/IEC 42001: what each asks of you
These three are different kinds of thing. The EU AI Act is a law whose obligations depend on how risky a system is and on whether you are a provider or a deployer. The NIST AI Risk Management Framework is voluntary guidance built on four functions: Govern, Map, Measure and Manage. ISO/IEC 42001 is a certifiable management-system standard for AI. One well-run AI register and approval process can supply evidence for all three.
EU AI Act: a law applied by risk and role
The Act sorts AI systems by risk, from prohibited practices through high-risk systems to those with lighter transparency duties, and it assigns duties differently to providers and to those who deploy a system. It applies in phases, and amendments adopted in 2026 deferred the start dates for high-risk obligations, so confirm current application dates and your own classification with counsel.
In every case you need to know which systems you have, what each does and what your role is for each. That is an AI register.
NIST AI RMF: voluntary guidance in four functions
Govern sets policies, roles and culture. Map establishes context and identifies risks for each system. Measure analyzes and tracks those risks. Manage prioritizes and acts on them. It is widely used as a common language with customers and regulators, and it is not a certification, so you show alignment through documented practice.
ISO/IEC 42001: a management system you can certify
ISO/IEC 42001:2023 specifies requirements for an AI management system: scope, leadership, risk assessment and treatment, controls, monitoring and continual improvement, assessed by an accredited certification body. It rewards what a governance board and register produce: defined roles, recorded decisions and evidence that the process runs.
Side by side
- Nature: EU AI Act is law; NIST AI RMF is voluntary guidance; ISO/IEC 42001 is a certifiable standard.
- Organizes work by: risk class and role; four functions; a management-system cycle.
- How you show it: legal compliance and technical documentation; documented alignment; an external certification audit.
- Common evidence: the AI register, requirements documents, approval records, risk assessments and board decisions.
How RAMP helps
RAMP keeps one AI register and one governance workflow and maps those records to each source, and prepares an audit package. RAMP prepares evidence and assessments; it does not issue certifications, audit reports or legal opinions.
Frequently asked questions
- Is NIST AI RMF mandatory?
- No. It is voluntary guidance, although customers, regulators and contracts may expect organizations to align with it.
- Can a company be certified to ISO/IEC 42001?
- Yes. ISO/IEC 42001:2023 is a certifiable AI management-system standard assessed by an accredited certification body.
- Does the EU AI Act apply to companies outside the EU?
- It can, depending on whether AI systems are placed on the EU market or their output is used in the EU. Ask counsel to confirm your role and classification.