Crossbearing · standards comparison

ISO/IEC 42001 to NIST AI RMF

What you can reuse, what to extend and what is new when you add NIST AI RMF to ISO/IEC 42001.

Compare another pair

I already have I want to add

What carries over from ISO/IEC 42001 to NIST AI RMF

Almost everything carries over. NIST’s own crosswalk ties every AI RMF subcategory to ISO/IEC 42001 clauses or Annex A controls, so your AIMS already does most of the work. Using the AI RMF is mainly a matter of describing that work as outcomes in a profile, and taking up the measurement and testing detail the AI RMF and its Playbook spell out.

Of the 72 clauses and controls NIST AI RMF asks for: 72 to extend.

72 Extend Keep what you have and add the new standard’s content.

Clause and control numbers checked against ISO/IEC 42001 and NIST AI RMF themselves; descriptions are MajorCyber™’s own words. Links from NIST’s crosswalk, with notes and actions by MajorCyber™, last checked 24 October 2026. Going the other way? NIST AI RMF to ISO/IEC 42001

Built on your device, with the documents you tick below. Nothing is uploaded.

Do I need to rewrite my policies?

No. Keep your AI policy and procedures. The AI RMF doesn’t ask for any particular documents: map your existing ones to the subcategories in a current profile, and decide which outcomes to strengthen in a target profile.

Controls: NIST AI RMF subcategories, against ISO/IEC 42001 Annex A

Each AI RMF subcategory, with the ISO/IEC 42001 clauses and Annex A controls that NIST’s crosswalk ties to it.

NIST AI RMF subcategories controls, with the ISO/IEC 42001 Annex A controls that support each
NIST AI RMF control	Supported by your ISO/IEC 42001	What to do
Govern: policies, processes and accountability
GOVERN 1.1 Legal and regulatory requirements for AI understood and recorded	Clause 4.1 Context Partly covers it Clause 6.2 Objectives Partly covers it A.2.2 A documented policy for developing or using AI Partly covers it A.2.4 AI policy reviewed at planned intervals Partly covers it	Extend Clause 4.1 of your AIMS covers this ground. Show how it delivers the outcome in your AI RMF profile, and add what the Playbook suggests beyond it.
GOVERN 1.2 Trustworthy-AI characteristics built into policies and practice	A.9.3 Objectives for responsible use Partly covers it A.6.1.2 Objectives for responsible development Partly covers it A.6.1.3 Processes for responsible design and development Partly covers it A.10.3 Suppliers of AI services, products and data Partly covers it A.2.2 A documented policy for developing or using AI Partly covers it Clause 4.4 The management system Partly covers it Clause 5.2 Policy Partly covers it	Extend Control A.9.3 of your AIMS covers this ground. Show how it delivers the outcome in your AI RMF profile, and add what the Playbook suggests beyond it.
GOVERN 1.3 Risk management effort set by risk tolerance	Clause 6.1.2 Risk assessment Partly covers it Clause 6.1.1 Risks and opportunities Partly covers it Clause 6.1.3 Risk treatment Partly covers it	Extend Clause 6.1.2 of your AIMS covers this ground. Show how it delivers the outcome in your AI RMF profile, and add what the Playbook suggests beyond it.
GOVERN 1.4 A transparent, documented risk management process	Clause 6.1.2 Risk assessment Partly covers it Clause 6.1.3 Risk treatment Partly covers it Clause 8.3 Risk treatment in operation Partly covers it	Extend Clause 6.1.2 of your AIMS covers this ground. Show how it delivers the outcome in your AI RMF profile, and add what the Playbook suggests beyond it.
GOVERN 1.5 Risk management monitored and reviewed on a schedule, with owners	Clause 8.2 Risk assessment in operation Partly covers it Clause 8.3 Risk treatment in operation Partly covers it Clause 8.4 Impact assessment in operation Partly covers it	Extend Clause 8.2 of your AIMS covers this ground. Show how it delivers the outcome in your AI RMF profile, and add what the Playbook suggests beyond it.
GOVERN 1.6 An inventory of AI systems, resourced by risk	A.4.5 System and computing resources documented Partly covers it A.4.3 Data resources documented Partly covers it A.4.4 Tooling resources documented Partly covers it A.4.6 People and their competences documented Partly covers it A.4.2 Resources for AI activities documented Partly covers it	Extend Control A.4.5 of your AIMS covers this ground. Show how it delivers the outcome in your AI RMF profile, and add what the Playbook suggests beyond it.
GOVERN 1.7 Safe decommissioning of AI systems	A.6.2.6 Operation and monitoring Partly covers it	Extend Control A.6.2.6 of your AIMS covers this ground. Show how it delivers the outcome in your AI RMF profile, and add what the Playbook suggests beyond it.
GOVERN 2.1 Clear roles and lines of communication for AI risk	Clause 9.1 Monitoring and measurement Partly covers it Clause 5.3 Roles Partly covers it Clause 7.1 Resources Partly covers it Clause 7.2 Competence Partly covers it Clause 7.3 Awareness Partly covers it Clause 7.4 Communication Partly covers it A.3.2 Roles and responsibilities for AI Partly covers it	Extend Clause 9.1 of your AIMS covers this ground. Show how it delivers the outcome in your AI RMF profile, and add what the Playbook suggests beyond it.
GOVERN 2.2 AI risk training for staff and partners	Clause 7.2 Competence Partly covers it	Extend Clause 7.2 of your AIMS covers this ground. Show how it delivers the outcome in your AI RMF profile, and add what the Playbook suggests beyond it.
GOVERN 2.3 Senior leaders own AI risk decisions	Clause 5.1 Leadership Partly covers it Clause 9.3 Management review Partly covers it Clause 5.2 Policy Partly covers it	Extend Clause 5.1 of your AIMS covers this ground. Show how it delivers the outcome in your AI RMF profile, and add what the Playbook suggests beyond it.
GOVERN 3.1 Diverse teams inform AI risk decisions	A.4.6 People and their competences documented Partly covers it A.5.4 Impacts on individuals and groups assessed Partly covers it	Extend Control A.4.6 of your AIMS covers this ground. Show how it delivers the outcome in your AI RMF profile, and add what the Playbook suggests beyond it.
GOVERN 3.2 Defined roles for human oversight of AI	A.6.1.3 Processes for responsible design and development Partly covers it A.9.3 Objectives for responsible use Partly covers it A.4.6 People and their competences documented Partly covers it A.5.3 Impact assessments documented and kept Partly covers it Clause 7.2 Competence Partly covers it A.3.2 Roles and responsibilities for AI Partly covers it	Extend Control A.6.1.3 of your AIMS covers this ground. Show how it delivers the outcome in your AI RMF profile, and add what the Playbook suggests beyond it.
GOVERN 4.1 A safety-first, critical-thinking culture	A.5.2 A process for AI system impact assessment Partly covers it A.6.1.2 Objectives for responsible development Partly covers it A.6.1.3 Processes for responsible design and development Partly covers it A.9.2 Processes for responsible use Partly covers it A.9.3 Objectives for responsible use Partly covers it A.10.3 Suppliers of AI services, products and data Partly covers it A.5.4 Impacts on individuals and groups assessed Partly covers it	Extend Control A.5.2 of your AIMS covers this ground. Show how it delivers the outcome in your AI RMF profile, and add what the Playbook suggests beyond it.
GOVERN 4.2 Teams record and communicate AI risks and impacts	A.5.4 Impacts on individuals and groups assessed Partly covers it A.8.5 Information owed to interested parties Partly covers it Clause 7.4 Communication Partly covers it Clause 6.1.4 AI system impact assessment Partly covers it A.5.5 Impacts on society assessed Partly covers it	Extend Control A.5.4 of your AIMS covers this ground. Show how it delivers the outcome in your AI RMF profile, and add what the Playbook suggests beyond it.
GOVERN 4.3 Testing, incident identification and information sharing enabled	A.6.2.4 Verification and validation Partly covers it A.6.2.6 Operation and monitoring Partly covers it A.6.2.7 Technical documentation for those who need it Partly covers it A.8.2 Information for the system’s users Partly covers it A.8.3 A channel to report adverse impacts Partly covers it A.8.4 A plan to tell users about incidents Partly covers it A.8.5 Information owed to interested parties Partly covers it A.6.1.2 Objectives for responsible development Partly covers it A.6.1.3 Processes for responsible design and development Partly covers it	Extend Control A.6.2.4 of your AIMS covers this ground. Show how it delivers the outcome in your AI RMF profile, and add what the Playbook suggests beyond it.
GOVERN 5.1 Feedback from outside the team collected and used	A.10.4 Customers’ needs and expectations met Partly covers it A.5.3 Impact assessments documented and kept Partly covers it A.5.4 Impacts on individuals and groups assessed Partly covers it A.8.3 A channel to report adverse impacts Partly covers it	Extend Control A.10.4 of your AIMS covers this ground. Show how it delivers the outcome in your AI RMF profile, and add what the Playbook suggests beyond it.
GOVERN 5.2 Adjudicated feedback fed back into design	A.8.3 A channel to report adverse impacts Partly covers it A.10.4 Customers’ needs and expectations met Partly covers it A.5.4 Impacts on individuals and groups assessed Partly covers it A.5.5 Impacts on society assessed Partly covers it A.6.1.3 Processes for responsible design and development Partly covers it A.6.2.6 Operation and monitoring Partly covers it	Extend Control A.8.3 of your AIMS covers this ground. Show how it delivers the outcome in your AI RMF profile, and add what the Playbook suggests beyond it.
GOVERN 6.1 Policies for third-party AI risks, including IP	A.10.2 Responsibilities shared across the AI supply chain Partly covers it A.10.3 Suppliers of AI services, products and data Partly covers it	Extend Control A.10.2 of your AIMS covers this ground. Show how it delivers the outcome in your AI RMF profile, and add what the Playbook suggests beyond it.
GOVERN 6.2 Contingency plans for failures in high-risk third-party data or AI	A.10.2 Responsibilities shared across the AI supply chain Partly covers it A.10.3 Suppliers of AI services, products and data Partly covers it	Extend Control A.10.2 of your AIMS covers this ground. Show how it delivers the outcome in your AI RMF profile, and add what the Playbook suggests beyond it.
Map: context and risks
MAP 1.1 Intended purpose, uses, laws and settings documented	Clause 6.1.4 AI system impact assessment Partly covers it A.5.2 A process for AI system impact assessment Partly covers it A.5.3 Impact assessments documented and kept Partly covers it A.5.4 Impacts on individuals and groups assessed Partly covers it A.5.5 Impacts on society assessed Partly covers it	Extend Clause 6.1.4 of your AIMS covers this ground. Show how it delivers the outcome in your AI RMF profile, and add what the Playbook suggests beyond it.
MAP 1.2 Diverse, competent people establish the context	A.4.6 People and their competences documented Partly covers it Clause 7.2 Competence Partly covers it	Extend Control A.4.6 of your AIMS covers this ground. Show how it delivers the outcome in your AI RMF profile, and add what the Playbook suggests beyond it.
MAP 1.3 Mission and goals for AI understood and documented	Clause 4.1 Context Partly covers it Clause 5.2 Policy Partly covers it Clause 6.2 Objectives Partly covers it Clause 7.5 Documented information Partly covers it Clause 7.3 Awareness Partly covers it Clause 7.4 Communication Partly covers it	Extend Clause 4.1 of your AIMS covers this ground. Show how it delivers the outcome in your AI RMF profile, and add what the Playbook suggests beyond it.
MAP 1.4 Business value defined or re-evaluated	Clause 5.1 Leadership Partly covers it Clause 4.1 Context Partly covers it A.2.2 A documented policy for developing or using AI Partly covers it A.5.2 A process for AI system impact assessment Partly covers it A.9.4 Use kept to the intended purpose Partly covers it A.6.2.2 Requirements and specifications for AI systems Partly covers it	Extend Clause 5.1 of your AIMS covers this ground. Show how it delivers the outcome in your AI RMF profile, and add what the Playbook suggests beyond it.
MAP 1.5 Risk tolerances determined and documented	Clause 6.1.1 Risks and opportunities Partly covers it	Extend Clause 6.1.1 of your AIMS covers this ground. Show how it delivers the outcome in your AI RMF profile, and add what the Playbook suggests beyond it.
MAP 1.6 System requirements gathered, with socio-technical effects in mind	A.6.2.2 Requirements and specifications for AI systems Partly covers it A.5.4 Impacts on individuals and groups assessed Partly covers it A.5.5 Impacts on society assessed Partly covers it	Extend Control A.6.2.2 of your AIMS covers this ground. Show how it delivers the outcome in your AI RMF profile, and add what the Playbook suggests beyond it.
MAP 2.1 The tasks and methods the AI system supports defined	A.6.2.3 Design and development documented Partly covers it A.4.2 Resources for AI activities documented Partly covers it A.4.3 Data resources documented Partly covers it A.4.4 Tooling resources documented Partly covers it A.4.5 System and computing resources documented Partly covers it A.4.6 People and their competences documented Partly covers it	Extend Control A.6.2.3 of your AIMS covers this ground. Show how it delivers the outcome in your AI RMF profile, and add what the Playbook suggests beyond it.
MAP 2.2 Knowledge limits and human oversight of outputs documented	A.6.2.7 Technical documentation for those who need it Partly covers it A.9.3 Objectives for responsible use Partly covers it A.8.2 Information for the system’s users Partly covers it	Extend Control A.6.2.7 of your AIMS covers this ground. Show how it delivers the outcome in your AI RMF profile, and add what the Playbook suggests beyond it.
MAP 2.3 Scientific integrity and testing considerations documented	A.6.1.3 Processes for responsible design and development Partly covers it A.6.2.7 Technical documentation for those who need it Partly covers it A.7.2 Data management for development and enhancement Partly covers it A.7.3 How data is acquired and selected Partly covers it A.7.4 Data quality requirements Partly covers it A.7.5 Data provenance recorded Partly covers it A.7.6 Data preparation criteria Partly covers it A.6.2.4 Verification and validation Partly covers it	Extend Control A.6.1.3 of your AIMS covers this ground. Show how it delivers the outcome in your AI RMF profile, and add what the Playbook suggests beyond it.
MAP 3.1 Potential benefits examined	A.5.2 A process for AI system impact assessment Partly covers it A.5.3 Impact assessments documented and kept Partly covers it A.5.4 Impacts on individuals and groups assessed Partly covers it A.5.5 Impacts on society assessed Partly covers it	Extend Control A.5.2 of your AIMS covers this ground. Show how it delivers the outcome in your AI RMF profile, and add what the Playbook suggests beyond it.
MAP 3.2 Potential costs of errors examined	A.5.2 A process for AI system impact assessment Partly covers it A.5.3 Impact assessments documented and kept Partly covers it A.5.4 Impacts on individuals and groups assessed Partly covers it A.5.5 Impacts on society assessed Partly covers it Clause 8.2 Risk assessment in operation Partly covers it Clause 8.3 Risk treatment in operation Partly covers it Clause 8.4 Impact assessment in operation Partly covers it	Extend Control A.5.2 of your AIMS covers this ground. Show how it delivers the outcome in your AI RMF profile, and add what the Playbook suggests beyond it.
MAP 3.3 Targeted application scope specified	Clause 4.3 Scope Partly covers it A.5.2 A process for AI system impact assessment Partly covers it A.5.3 Impact assessments documented and kept Partly covers it A.5.4 Impacts on individuals and groups assessed Partly covers it A.5.5 Impacts on society assessed Partly covers it	Extend Clause 4.3 of your AIMS covers this ground. Show how it delivers the outcome in your AI RMF profile, and add what the Playbook suggests beyond it.
MAP 3.4 Operator and practitioner proficiency processes defined	Clause 7.2 Competence Partly covers it A.4.6 People and their competences documented Partly covers it	Extend Clause 7.2 of your AIMS covers this ground. Show how it delivers the outcome in your AI RMF profile, and add what the Playbook suggests beyond it.
MAP 3.5 Human oversight processes defined and assessed	A.6.1.3 Processes for responsible design and development Partly covers it A.6.2.7 Technical documentation for those who need it Partly covers it A.8.2 Information for the system’s users Partly covers it	Extend Control A.6.1.3 of your AIMS covers this ground. Show how it delivers the outcome in your AI RMF profile, and add what the Playbook suggests beyond it.
MAP 4.1 Technology and legal risks of each component mapped, third parties too	Clause 4.1 Context Partly covers it A.2.2 A documented policy for developing or using AI Partly covers it A.9.2 Processes for responsible use Partly covers it A.9.4 Use kept to the intended purpose Partly covers it	Extend Clause 4.1 of your AIMS covers this ground. Show how it delivers the outcome in your AI RMF profile, and add what the Playbook suggests beyond it.
MAP 4.2 Internal risk controls for components documented	A.6.2.7 Technical documentation for those who need it Partly covers it A.8.2 Information for the system’s users Partly covers it A.10.3 Suppliers of AI services, products and data Partly covers it	Extend Control A.6.2.7 of your AIMS covers this ground. Show how it delivers the outcome in your AI RMF profile, and add what the Playbook suggests beyond it.
MAP 5.1 Likelihood and size of each impact identified	Clause 6.1.2 Risk assessment Partly covers it A.5.2 A process for AI system impact assessment Partly covers it	Extend Clause 6.1.2 of your AIMS covers this ground. Show how it delivers the outcome in your AI RMF profile, and add what the Playbook suggests beyond it.
MAP 5.2 Regular engagement with AI actors and their feedback	A.6.1.3 Processes for responsible design and development Partly covers it A.6.2.6 Operation and monitoring Partly covers it A.8.3 A channel to report adverse impacts Partly covers it	Extend Control A.6.1.3 of your AIMS covers this ground. Show how it delivers the outcome in your AI RMF profile, and add what the Playbook suggests beyond it.
Measure: analysis, testing and tracking
MEASURE 1.1 Metrics chosen for the most significant risks first	Clause 6.1.1 Risks and opportunities Partly covers it Clause 6.1.2 Risk assessment Partly covers it	Extend Clause 6.1.1 of your AIMS covers this ground. Show how it delivers the outcome in your AI RMF profile, and add what the Playbook suggests beyond it.
MEASURE 1.2 Metrics and controls regularly reassessed	A.6.2.4 Verification and validation Partly covers it A.5.4 Impacts on individuals and groups assessed Partly covers it A.5.2 A process for AI system impact assessment Partly covers it A.5.5 Impacts on society assessed Partly covers it	Extend Control A.6.2.4 of your AIMS covers this ground. Show how it delivers the outcome in your AI RMF profile, and add what the Playbook suggests beyond it.
MEASURE 1.3 Independent reviewers involved in assessments	Clause 6.1.2 Risk assessment Partly covers it Clause 9.2 Internal audit Partly covers it A.5.2 A process for AI system impact assessment Partly covers it A.5.4 Impacts on individuals and groups assessed Partly covers it A.5.5 Impacts on society assessed Partly covers it	Extend Clause 6.1.2 of your AIMS covers this ground. Show how it delivers the outcome in your AI RMF profile, and add what the Playbook suggests beyond it.
MEASURE 2.1 Test sets, metrics and tools documented	A.8.4 A plan to tell users about incidents Partly covers it A.6.2.4 Verification and validation Partly covers it A.6.2.7 Technical documentation for those who need it Partly covers it A.4.2 Resources for AI activities documented Partly covers it	Extend Control A.8.4 of your AIMS covers this ground. Show how it delivers the outcome in your AI RMF profile, and add what the Playbook suggests beyond it.
MEASURE 2.2 Evaluations with human subjects meet requirements	A.6.2.4 Verification and validation Partly covers it	Extend Control A.6.2.4 of your AIMS covers this ground. Show how it delivers the outcome in your AI RMF profile, and add what the Playbook suggests beyond it.
MEASURE 2.3 Performance measured in deployment-like conditions	A.7.4 Data quality requirements Partly covers it A.6.2.6 Operation and monitoring Partly covers it	Extend Control A.7.4 of your AIMS covers this ground. Show how it delivers the outcome in your AI RMF profile, and add what the Playbook suggests beyond it.
MEASURE 2.4 Behaviour monitored in production	Clause 9.1 Monitoring and measurement Partly covers it A.6.2.6 Operation and monitoring Partly covers it A.6.2.8 Event logs while AI systems are in use Partly covers it	Extend Clause 9.1 of your AIMS covers this ground. Show how it delivers the outcome in your AI RMF profile, and add what the Playbook suggests beyond it.
MEASURE 2.5 Validity and reliability demonstrated, with limits recorded	A.6.2.4 Verification and validation Partly covers it A.6.2.5 Deployment planned and checked Partly covers it A.6.2.7 Technical documentation for those who need it Partly covers it A.8.2 Information for the system’s users Partly covers it	Extend Control A.6.2.4 of your AIMS covers this ground. Show how it delivers the outcome in your AI RMF profile, and add what the Playbook suggests beyond it.
MEASURE 2.6 Safety risks evaluated regularly	A.6.2.8 Event logs while AI systems are in use Partly covers it A.6.2.6 Operation and monitoring Partly covers it A.6.2.4 Verification and validation Partly covers it Clause 8.2 Risk assessment in operation Partly covers it	Extend Control A.6.2.8 of your AIMS covers this ground. Show how it delivers the outcome in your AI RMF profile, and add what the Playbook suggests beyond it.
MEASURE 2.7 Security and resilience evaluated	A.7.2 Data management for development and enhancement Partly covers it A.3.2 Roles and responsibilities for AI Partly covers it A.2.3 Other policies aligned with the AI objectives Partly covers it A.5.2 A process for AI system impact assessment Partly covers it A.6.1.2 Objectives for responsible development Partly covers it A.6.2.3 Design and development documented Partly covers it A.9.3 Objectives for responsible use Partly covers it	Extend Control A.7.2 of your AIMS covers this ground. Show how it delivers the outcome in your AI RMF profile, and add what the Playbook suggests beyond it.
MEASURE 2.8 Transparency and accountability risks examined	A.7.2 Data management for development and enhancement Partly covers it A.5.4 Impacts on individuals and groups assessed Partly covers it A.5.5 Impacts on society assessed Partly covers it A.6.1.2 Objectives for responsible development Partly covers it A.9.3 Objectives for responsible use Partly covers it Clause 6.1.2 Risk assessment Partly covers it	Extend Control A.7.2 of your AIMS covers this ground. Show how it delivers the outcome in your AI RMF profile, and add what the Playbook suggests beyond it.
MEASURE 2.9 The model explained and its outputs interpreted in context	A.7.5 Data provenance recorded Partly covers it A.6.2.5 Deployment planned and checked Partly covers it A.6.2.7 Technical documentation for those who need it Partly covers it A.8.2 Information for the system’s users Partly covers it	Extend Control A.7.5 of your AIMS covers this ground. Show how it delivers the outcome in your AI RMF profile, and add what the Playbook suggests beyond it.
MEASURE 2.10 Privacy risk examined	A.5.2 A process for AI system impact assessment Partly covers it A.7.2 Data management for development and enhancement Partly covers it A.7.3 How data is acquired and selected Partly covers it A.2.3 Other policies aligned with the AI objectives Partly covers it	Extend Control A.5.2 of your AIMS covers this ground. Show how it delivers the outcome in your AI RMF profile, and add what the Playbook suggests beyond it.
MEASURE 2.11 Fairness and bias evaluated	A.5.5 Impacts on society assessed Partly covers it A.5.4 Impacts on individuals and groups assessed Partly covers it	Extend Control A.5.5 of your AIMS covers this ground. Show how it delivers the outcome in your AI RMF profile, and add what the Playbook suggests beyond it.
MEASURE 2.12 Environmental impact assessed	A.5.5 Impacts on society assessed Partly covers it A.4.5 System and computing resources documented Partly covers it	Extend Control A.5.5 of your AIMS covers this ground. Show how it delivers the outcome in your AI RMF profile, and add what the Playbook suggests beyond it.
MEASURE 2.13 The testing and evaluation methods themselves evaluated	A.6.2.4 Verification and validation Partly covers it A.6.2.6 Operation and monitoring Partly covers it	Extend Control A.6.2.4 of your AIMS covers this ground. Show how it delivers the outcome in your AI RMF profile, and add what the Playbook suggests beyond it.
MEASURE 3.1 Existing and emerging risks tracked	Clause 8.2 Risk assessment in operation Partly covers it Clause 4.4 The management system Partly covers it Clause 8.4 Impact assessment in operation Partly covers it	Extend Clause 8.2 of your AIMS covers this ground. Show how it delivers the outcome in your AI RMF profile, and add what the Playbook suggests beyond it.
MEASURE 3.2 Tracking for risks that are hard to measure	A.6.2.8 Event logs while AI systems are in use Partly covers it A.6.2.6 Operation and monitoring Partly covers it Clause 10.1 Continual improvement Partly covers it	Extend Control A.6.2.8 of your AIMS covers this ground. Show how it delivers the outcome in your AI RMF profile, and add what the Playbook suggests beyond it.
MEASURE 3.3 Ways for users and affected people to report problems and appeal	A.8.2 Information for the system’s users Partly covers it A.8.4 A plan to tell users about incidents Partly covers it A.8.3 A channel to report adverse impacts Partly covers it	Extend Control A.8.2 of your AIMS covers this ground. Show how it delivers the outcome in your AI RMF profile, and add what the Playbook suggests beyond it.
MEASURE 4.1 Measurement linked to deployment context and expert input	A.6.2.4 Verification and validation Partly covers it A.5.4 Impacts on individuals and groups assessed Partly covers it A.5.5 Impacts on society assessed Partly covers it Clause 9.1 Monitoring and measurement Partly covers it	Extend Control A.6.2.4 of your AIMS covers this ground. Show how it delivers the outcome in your AI RMF profile, and add what the Playbook suggests beyond it.
MEASURE 4.2 Trustworthiness results informed by experts and affected people	Clause 9.1 Monitoring and measurement Partly covers it A.8.2 Information for the system’s users Partly covers it Clause 9.2 Internal audit Partly covers it A.8.3 A channel to report adverse impacts Partly covers it	Extend Clause 9.1 of your AIMS covers this ground. Show how it delivers the outcome in your AI RMF profile, and add what the Playbook suggests beyond it.
MEASURE 4.3 Performance changes measured and documented	Clause 9.3 Management review Partly covers it A.6.2.6 Operation and monitoring Partly covers it A.6.2.7 Technical documentation for those who need it Partly covers it	Extend Clause 9.3 of your AIMS covers this ground. Show how it delivers the outcome in your AI RMF profile, and add what the Playbook suggests beyond it.
Manage: treatment, monitoring and response
MANAGE 1.1 A go or no-go decision on whether the system meets its purpose	A.9.3 Objectives for responsible use Partly covers it A.9.2 Processes for responsible use Partly covers it A.9.4 Use kept to the intended purpose Partly covers it A.6.1.3 Processes for responsible design and development Partly covers it A.6.2.4 Verification and validation Partly covers it	Extend Control A.9.3 of your AIMS covers this ground. Show how it delivers the outcome in your AI RMF profile, and add what the Playbook suggests beyond it.
MANAGE 1.2 Risk treatment prioritised	Clause 9.3 Management review Partly covers it Clause 6.1.2 Risk assessment Partly covers it Clause 6.1.3 Risk treatment Partly covers it Clause 6.1.4 AI system impact assessment Partly covers it	Extend Clause 9.3 of your AIMS covers this ground. Show how it delivers the outcome in your AI RMF profile, and add what the Playbook suggests beyond it.
MANAGE 1.3 Responses to high-priority risks planned	Clause 6.1.1 Risks and opportunities Partly covers it Clause 6.1.2 Risk assessment Partly covers it Clause 6.1.3 Risk treatment Partly covers it Clause 6.1.4 AI system impact assessment Partly covers it	Extend Clause 6.1.1 of your AIMS covers this ground. Show how it delivers the outcome in your AI RMF profile, and add what the Playbook suggests beyond it.
MANAGE 1.4 Residual risks to acquirers and users documented	A.5.3 Impact assessments documented and kept Partly covers it A.5.4 Impacts on individuals and groups assessed Partly covers it A.6.2.7 Technical documentation for those who need it Partly covers it A.8.2 Information for the system’s users Partly covers it	Extend Control A.5.3 of your AIMS covers this ground. Show how it delivers the outcome in your AI RMF profile, and add what the Playbook suggests beyond it.
MANAGE 2.1 Resources, and non-AI alternatives, considered	A.4.2 Resources for AI activities documented Partly covers it Clause 7.1 Resources Partly covers it	Extend Control A.4.2 of your AIMS covers this ground. Show how it delivers the outcome in your AI RMF profile, and add what the Playbook suggests beyond it.
MANAGE 2.2 The value of deployed systems sustained	A.3.3 A way to raise concerns about AI systems Partly covers it A.6.1.2 Objectives for responsible development Partly covers it A.6.1.3 Processes for responsible design and development Partly covers it A.6.2.4 Verification and validation Partly covers it A.6.2.6 Operation and monitoring Partly covers it A.7.2 Data management for development and enhancement Partly covers it Clause 7.1 Resources Partly covers it Clause 10.1 Continual improvement Partly covers it	Extend Control A.3.3 of your AIMS covers this ground. Show how it delivers the outcome in your AI RMF profile, and add what the Playbook suggests beyond it.
MANAGE 2.3 Response to previously unknown risks	Clause 10.2 Nonconformity and corrective action Partly covers it Clause 6.1.1 Risks and opportunities Partly covers it Clause 6.1.2 Risk assessment Partly covers it Clause 6.1.3 Risk treatment Partly covers it	Extend Clause 10.2 of your AIMS covers this ground. Show how it delivers the outcome in your AI RMF profile, and add what the Playbook suggests beyond it.
MANAGE 2.4 Ways to supersede, disengage or deactivate a system	A.9.4 Use kept to the intended purpose Partly covers it A.8.2 Information for the system’s users Partly covers it A.6.2.7 Technical documentation for those who need it Partly covers it A.6.1.3 Processes for responsible design and development Partly covers it	Extend Control A.9.4 of your AIMS covers this ground. Show how it delivers the outcome in your AI RMF profile, and add what the Playbook suggests beyond it.
MANAGE 3.1 Third-party risks and benefits monitored	A.10.3 Suppliers of AI services, products and data Partly covers it A.10.2 Responsibilities shared across the AI supply chain Partly covers it	Extend Control A.10.3 of your AIMS covers this ground. Show how it delivers the outcome in your AI RMF profile, and add what the Playbook suggests beyond it.
MANAGE 3.2 Pre-trained models monitored	A.4.4 Tooling resources documented Partly covers it A.6.2.6 Operation and monitoring Partly covers it	Extend Control A.4.4 of your AIMS covers this ground. Show how it delivers the outcome in your AI RMF profile, and add what the Playbook suggests beyond it.
MANAGE 4.1 Post-deployment monitoring, including user input	Clause 9.2 Internal audit Partly covers it A.6.2.6 Operation and monitoring Partly covers it A.8.3 A channel to report adverse impacts Partly covers it A.10.4 Customers’ needs and expectations met Partly covers it	Extend Clause 9.2 of your AIMS covers this ground. Show how it delivers the outcome in your AI RMF profile, and add what the Playbook suggests beyond it.
MANAGE 4.2 Continual improvement built into updates	Clause 9.3 Management review Partly covers it A.6.2.4 Verification and validation Partly covers it A.6.2.6 Operation and monitoring Partly covers it	Extend Clause 9.3 of your AIMS covers this ground. Show how it delivers the outcome in your AI RMF profile, and add what the Playbook suggests beyond it.
MANAGE 4.3 Incidents and errors communicated and tracked	Clause 9.3 Management review Partly covers it A.8.5 Information owed to interested parties Partly covers it A.6.2.6 Operation and monitoring Partly covers it	Extend Clause 9.3 of your AIMS covers this ground. Show how it delivers the outcome in your AI RMF profile, and add what the Playbook suggests beyond it.

A route from ISO/IEC 42001 to NIST AI RMF

01
Current profile
- Set your AIMS processes and Annex A controls against the 72 subcategories, using NIST’s crosswalk
- Note where your evidence already shows each outcome
02
Target profile
- Choose the outcomes that matter most for your AI systems and context
- Use the Generative AI Profile (NIST AI 600-1) if you build or use generative AI
03
Measure
- Strengthen testing, evaluation, verification and validation: test sets, metrics, independent review
- Track fairness, privacy, security, safety and environmental risks with named metrics
04
Engage
- Set up ways for users and affected people to give feedback and appeal
- Bring diverse perspectives into risk decisions
05
Keep it current
- Review the profile alongside management review
- Watch for new AI RMF profiles and Playbook updates

Certification and audits

The AI RMF is voluntary and has no certification scheme: nobody is “AI RMF certified”. Your ISO/IEC 42001 certificate stays the external assurance.
An AI RMF profile is still useful for customers and regulators who ask how you manage AI risk, especially in the United States.

Common pitfalls

Treating the crosswalk as proof that every outcome is met. It shows where the topics meet, not how well your controls work.
Skipping the measurement detail. The AI RMF goes further than ISO/IEC 42001 on testing and evaluation metrics.
Forgetting that the crosswalk was made against the final draft (FDIS) of ISO/IEC 42001.

ISO/IEC 42001 and NIST AI RMF at a glance

ISO/IEC 42001 and NIST AI RMF side by side
Fact	ISO/IEC 42001	NIST AI RMF
What it is	Certifiable standard	Voluntary framework
How it applies	Voluntary, often required by customers	Voluntary (adopted by choice)
How you show it	Certification by an accredited certification body	Voluntary: no certification of its own
Where	International	United States, International
Covers	AI governance, Risk management, Audit & assurance	AI governance, Risk management
Issued or enforced by	ISO and IEC (ISO/IEC JTC 1/SC 42 Artificial intelligence)	National Institute of Standards and Technology (NIST), US Department of Commerce
Current edition or status	ISO/IEC 42001:2023, first edition (December 2023). Supporting standards include ISO/IEC 42005 (impact assessment) and ISO/IEC 42006 (certification bodies).	AI RMF 1.0 (NIST AI 100-1, January 2023), with the Generative AI Profile (NIST AI 600-1, July 2024) and the online AI RMF Playbook.

Next steps on MajorCyber™

Sources

NIST AI RMF to ISO/IEC FDIS 42001 AI Management System Crosswalk — NIST AI Resource Center
Crosswalk documents — NIST AI Resource Center
Artificial Intelligence Risk Management Framework (AI RMF 1.0), NIST AI 100-1 — NIST
ISO/IEC 42001:2023, AI management system — ISO

Open questions

NIST’s crosswalk was made against the final draft of ISO/IEC 42001 and cites the Annex B guidance numbers. The published standard kept that numbering, and every reference here is checked against it.

An educational comparison, researched and drafted with AI assistance. A mapping shows where work you have already done supports a requirement; it never means the requirement is met. Your certification body decides what conforms. No standard’s text is reproduced: buy the standards from ISO or your national standards body.