Crossbearing · standards comparison

NIST AI RMF to ISO/IEC 42001

What you can reuse, what to extend and what is new when you add ISO/IEC 42001 to NIST AI RMF.

Compare another pair

I already have I want to add

What carries over from NIST AI RMF to ISO/IEC 42001

A good share carries over, but as raw material. Your AI RMF outcomes map onto most of ISO/IEC 42001, yet the standard asks for an audited management system: a scope, an AI policy, objectives, documented processes, internal audit, management review and a Statement of Applicability. That system, and the evidence it produces, is the new work.

Of the 65 clauses and controls ISO/IEC 42001 asks for: 62 to extend and 3 new.

62 Extend Keep what you have and add the new standard’s content.
3 New Nothing you have covers it: new work.

Clause and control numbers checked against NIST AI RMF and ISO/IEC 42001 themselves; descriptions are MajorCyber™’s own words. Links from NIST’s crosswalk, with notes and actions by MajorCyber™, last checked 24 October 2026. Going the other way? ISO/IEC 42001 to NIST AI RMF

Built on your device, with the documents you tick below. Nothing is uploaded.

Do I need to rewrite my policies?

Probably, at least in part. ISO/IEC 42001 requires an AI policy approved by top management, with commitments of its own, and documented processes for risk, impact assessment and the AI life cycle. Turn the practices your AI RMF profile describes into those documents rather than starting again.

The management system, clause by clause

ISO/IEC 42001 is a management-system standard with clauses 4 to 10; NIST AI RMF isn’t. Each row says what ISO/IEC 42001 asks for, and which parts of NIST AI RMF already support it.

ISO/IEC 42001 clauses 4 to 10 compared with NIST AI RMF
Clause	Your NIST AI RMF	ISO/IEC 42001 asks for	What to do
4.1 Context	GOVERN 1.1MAP 1.3MAP 1.4MAP 4.1	Issues that affect the AIMS, including whether climate change is relevant; the intended purpose of the AI systems the organisation develops, provides or uses; and its role for each — provider, producer, customer, partner and so on.	Extend Your GOVERN 1.1 work supports clause 4.1. Turn it into the documented, auditable process ISO/IEC 42001 requires.
4.2 Interested parties	Nothing here	Who has a stake in the organisation’s AI, what they require, and which of those requirements the AIMS will address.	New Nothing in NIST AI RMF corresponds: new work for the AIMS.
4.3 Scope	MAP 3.3	The boundaries of the AIMS, taking account of the AI systems and activities it covers.	Extend Your MAP 3.3 work supports clause 4.3. Turn it into the documented, auditable process ISO/IEC 42001 requires.
4.4 The management system	GOVERN 1.2MEASURE 3.1	An AIMS that is set up, run, maintained and continually improved, with its processes and how they interact.	Extend Your GOVERN 1.2 work supports clause 4.4. Turn it into the documented, auditable process ISO/IEC 42001 requires.
5.1 Leadership	GOVERN 2.3MAP 1.4	Top management directs and supports the AIMS: aligned with strategy, built into the business, resourced and communicated.	Extend Your GOVERN 2.3 work supports clause 5.1. Turn it into the documented, auditable process ISO/IEC 42001 requires.
5.2 Policy	GOVERN 1.2GOVERN 2.3MAP 1.3	An AI policy that fits the organisation’s purpose, frames AI objectives and commits to meeting requirements and improving.	Extend Your GOVERN 1.2 work supports clause 5.2. Turn it into the documented, auditable process ISO/IEC 42001 requires.
5.3 Roles	GOVERN 2.1	Responsibilities and authorities for the AIMS assigned and communicated.	Extend Your GOVERN 2.1 work supports clause 5.3. Turn it into the documented, auditable process ISO/IEC 42001 requires.
6.1.1 Risks and opportunities	GOVERN 1.3MAP 1.5MEASURE 1.1MANAGE 1.3MANAGE 2.3	Plan how the AIMS addresses its risks and opportunities, with criteria that tell acceptable AI risks from unacceptable ones.	Extend Your GOVERN 1.3 work supports clause 6.1.1. Turn it into the documented, auditable process ISO/IEC 42001 requires.
6.1.2 Risk assessment	GOVERN 1.3GOVERN 1.4MAP 5.1MEASURE 1.1MEASURE 1.3MEASURE 2.8MANAGE 1.2MANAGE 1.3MANAGE 2.3	An AI risk assessment process, informed by the AI policy and objectives, that takes the results of AI system impact assessments into account.	Extend Your GOVERN 1.3 work supports clause 6.1.2. Turn it into the documented, auditable process ISO/IEC 42001 requires.
6.1.3 Risk treatment	GOVERN 1.3GOVERN 1.4MANAGE 1.2MANAGE 1.3MANAGE 2.3	Choose treatments and controls, with Annex A as a reference, write a Statement of Applicability (6.1.3 f) and an AI risk treatment plan approved by designated management.	Extend Your GOVERN 1.3 work supports clause 6.1.3. Turn it into the documented, auditable process ISO/IEC 42001 requires.
6.1.4 AI system impact assessment	GOVERN 4.2MAP 1.1MANAGE 1.2MANAGE 1.3	A process for assessing the consequences an AI system’s use and foreseeable misuse could have for individuals, groups and society — documented, and fed into the risk assessment.	Extend Your GOVERN 4.2 work supports clause 6.1.4. Turn it into the documented, auditable process ISO/IEC 42001 requires.
6.2 Objectives	GOVERN 1.1MAP 1.3	AI objectives, with plans for who achieves them, how and by when.	Extend Your GOVERN 1.1 work supports clause 6.2. Turn it into the documented, auditable process ISO/IEC 42001 requires.
6.3 Planning changes	Nothing here	Changes to the management system are carried out in a planned way.	New Nothing in NIST AI RMF corresponds: new work for the AIMS.
7.1 Resources	GOVERN 2.1MANAGE 2.1MANAGE 2.2	The resources the management system needs are provided.	Extend Your GOVERN 2.1 work supports clause 7.1. Turn it into the documented, auditable process ISO/IEC 42001 requires.
7.2 Competence	GOVERN 2.1GOVERN 2.2GOVERN 3.2MAP 1.2MAP 3.4	People whose work affects AI performance are competent, with evidence kept.	Extend Your GOVERN 2.1 work supports clause 7.2. Turn it into the documented, auditable process ISO/IEC 42001 requires.
7.3 Awareness	GOVERN 2.1MAP 1.3	People know the AI policy, their part in the AIMS, and what not following it means.	Extend Your GOVERN 2.1 work supports clause 7.3. Turn it into the documented, auditable process ISO/IEC 42001 requires.
7.4 Communication	GOVERN 2.1GOVERN 4.2MAP 1.3	What is communicated, when, to whom and how.	Extend Your GOVERN 2.1 work supports clause 7.4. Turn it into the documented, auditable process ISO/IEC 42001 requires.
7.5 Documented information	MAP 1.3	Documents and records the AIMS needs are created, updated and controlled.	Extend Your MAP 1.3 work supports clause 7.5. Turn it into the documented, auditable process ISO/IEC 42001 requires.
8.1 Operational control	Nothing here	Processes planned, run and controlled, including outsourced ones, with evidence that they ran as planned.	New Nothing in NIST AI RMF corresponds: new work for the AIMS.
8.2 Risk assessment in operation	GOVERN 1.5MAP 3.2MEASURE 2.6MEASURE 3.1	AI risk assessments carried out at planned intervals and when significant changes happen.	Extend Your GOVERN 1.5 work supports clause 8.2. Turn it into the documented, auditable process ISO/IEC 42001 requires.
8.3 Risk treatment in operation	GOVERN 1.4GOVERN 1.5MAP 3.2	The AI risk treatment plan implemented, and its effectiveness checked.	Extend Your GOVERN 1.4 work supports clause 8.3. Turn it into the documented, auditable process ISO/IEC 42001 requires.
8.4 Impact assessment in operation	GOVERN 1.5MAP 3.2MEASURE 3.1	AI system impact assessments carried out at planned intervals and when significant changes happen.	Extend Your GOVERN 1.5 work supports clause 8.4. Turn it into the documented, auditable process ISO/IEC 42001 requires.
9.1 Monitoring and measurement	GOVERN 2.1MEASURE 2.4MEASURE 4.1MEASURE 4.2	What is monitored and measured, how and when, and how the results are evaluated.	Extend Your GOVERN 2.1 work supports clause 9.1. Turn it into the documented, auditable process ISO/IEC 42001 requires.
9.2 Internal audit	MEASURE 1.3MEASURE 4.2MANAGE 4.1	Internal audits at planned intervals, by objective auditors, against the standard and the organisation’s own requirements.	Extend Your MEASURE 1.3 work supports clause 9.2. Turn it into the documented, auditable process ISO/IEC 42001 requires.
9.3 Management review	GOVERN 2.3MEASURE 4.3MANAGE 1.2MANAGE 4.2MANAGE 4.3	Top management reviews the AIMS at planned intervals, with set inputs and recorded decisions.	Extend Your GOVERN 2.3 work supports clause 9.3. Turn it into the documented, auditable process ISO/IEC 42001 requires.
10.1 Continual improvement	MEASURE 3.2MANAGE 2.2	The AIMS keeps getting more suitable, adequate and effective.	Extend Your MEASURE 3.2 work supports clause 10.1. Turn it into the documented, auditable process ISO/IEC 42001 requires.
10.2 Nonconformity and corrective action	MANAGE 2.3	Nonconformities are corrected, their causes found and removed, and the actions checked.	Extend Your MANAGE 2.3 work supports clause 10.2. Turn it into the documented, auditable process ISO/IEC 42001 requires.

Controls: ISO/IEC 42001 Annex A, against NIST AI RMF subcategories

Each ISO/IEC 42001 Annex A control, with the AI RMF subcategories that NIST’s crosswalk ties to it.

ISO/IEC 42001 Annex A controls, with the NIST AI RMF subcategories controls that support each
ISO/IEC 42001 control	Supported by your NIST AI RMF	What to do
Policies for AI
A.2.2 A documented policy for developing or using AI	GOVERN 1.1 Legal and regulatory requirements for AI understood and recorded Partly covers it GOVERN 1.2 Trustworthy-AI characteristics built into policies and practice Partly covers it MAP 1.4 Business value defined or re-evaluated Partly covers it MAP 4.1 Technology and legal risks of each component mapped, third parties too Partly covers it	Extend Your GOVERN 1.1 work supports control A.2.2. Implement it as a control and record it in your Statement of Applicability.
A.2.3 Other policies aligned with the AI objectives	MEASURE 2.7 Security and resilience evaluated Partly covers it MEASURE 2.10 Privacy risk examined Partly covers it	Extend Your MEASURE 2.7 work supports control A.2.3. Implement it as a control and record it in your Statement of Applicability.
A.2.4 AI policy reviewed at planned intervals	GOVERN 1.1 Legal and regulatory requirements for AI understood and recorded Partly covers it	Extend Your GOVERN 1.1 work supports control A.2.4. Implement it as a control and record it in your Statement of Applicability.
Organisation
A.3.2 Roles and responsibilities for AI	GOVERN 2.1 Clear roles and lines of communication for AI risk Partly covers it GOVERN 3.2 Defined roles for human oversight of AI Partly covers it MEASURE 2.7 Security and resilience evaluated Partly covers it	Extend Your GOVERN 2.1 work supports control A.3.2. Implement it as a control and record it in your Statement of Applicability.
A.3.3 A way to raise concerns about AI systems	MANAGE 2.2 The value of deployed systems sustained Partly covers it	Extend Your MANAGE 2.2 work supports control A.3.3. Implement it as a control and record it in your Statement of Applicability.
Resources
A.4.2 Resources for AI activities documented	GOVERN 1.6 An inventory of AI systems, resourced by risk Partly covers it MAP 2.1 The tasks and methods the AI system supports defined Partly covers it MEASURE 2.1 Test sets, metrics and tools documented Partly covers it MANAGE 2.1 Resources, and non-AI alternatives, considered Partly covers it	Extend Your GOVERN 1.6 work supports control A.4.2. Implement it as a control and record it in your Statement of Applicability.
A.4.3 Data resources documented	GOVERN 1.6 An inventory of AI systems, resourced by risk Partly covers it MAP 2.1 The tasks and methods the AI system supports defined Partly covers it	Extend Your GOVERN 1.6 work supports control A.4.3. Implement it as a control and record it in your Statement of Applicability.
A.4.4 Tooling resources documented	GOVERN 1.6 An inventory of AI systems, resourced by risk Partly covers it MAP 2.1 The tasks and methods the AI system supports defined Partly covers it MANAGE 3.2 Pre-trained models monitored Partly covers it	Extend Your GOVERN 1.6 work supports control A.4.4. Implement it as a control and record it in your Statement of Applicability.
A.4.5 System and computing resources documented	GOVERN 1.6 An inventory of AI systems, resourced by risk Partly covers it MAP 2.1 The tasks and methods the AI system supports defined Partly covers it MEASURE 2.12 Environmental impact assessed Partly covers it	Extend Your GOVERN 1.6 work supports control A.4.5. Implement it as a control and record it in your Statement of Applicability.
A.4.6 People and their competences documented	GOVERN 1.6 An inventory of AI systems, resourced by risk Partly covers it GOVERN 3.1 Diverse teams inform AI risk decisions Partly covers it GOVERN 3.2 Defined roles for human oversight of AI Partly covers it MAP 1.2 Diverse, competent people establish the context Partly covers it MAP 2.1 The tasks and methods the AI system supports defined Partly covers it MAP 3.4 Operator and practitioner proficiency processes defined Partly covers it	Extend Your GOVERN 1.6 work supports control A.4.6. Implement it as a control and record it in your Statement of Applicability.
Impact assessment
A.5.2 A process for AI system impact assessment	GOVERN 4.1 A safety-first, critical-thinking culture Partly covers it MAP 1.1 Intended purpose, uses, laws and settings documented Partly covers it MAP 1.4 Business value defined or re-evaluated Partly covers it MAP 3.1 Potential benefits examined Partly covers it MAP 3.2 Potential costs of errors examined Partly covers it MAP 3.3 Targeted application scope specified Partly covers it MAP 5.1 Likelihood and size of each impact identified Partly covers it MEASURE 1.2 Metrics and controls regularly reassessed Partly covers it MEASURE 1.3 Independent reviewers involved in assessments Partly covers it MEASURE 2.7 Security and resilience evaluated Partly covers it MEASURE 2.10 Privacy risk examined Partly covers it	Extend Your GOVERN 4.1 work supports control A.5.2. Implement it as a control and record it in your Statement of Applicability.
A.5.3 Impact assessments documented and kept	GOVERN 3.2 Defined roles for human oversight of AI Partly covers it GOVERN 5.1 Feedback from outside the team collected and used Partly covers it MAP 1.1 Intended purpose, uses, laws and settings documented Partly covers it MAP 3.1 Potential benefits examined Partly covers it MAP 3.2 Potential costs of errors examined Partly covers it MAP 3.3 Targeted application scope specified Partly covers it MANAGE 1.4 Residual risks to acquirers and users documented Partly covers it	Extend Your GOVERN 3.2 work supports control A.5.3. Implement it as a control and record it in your Statement of Applicability.
A.5.4 Impacts on individuals and groups assessed	GOVERN 3.1 Diverse teams inform AI risk decisions Partly covers it GOVERN 4.1 A safety-first, critical-thinking culture Partly covers it GOVERN 4.2 Teams record and communicate AI risks and impacts Partly covers it GOVERN 5.1 Feedback from outside the team collected and used Partly covers it GOVERN 5.2 Adjudicated feedback fed back into design Partly covers it MAP 1.1 Intended purpose, uses, laws and settings documented Partly covers it MAP 1.6 System requirements gathered, with socio-technical effects in mind Partly covers it MAP 3.1 Potential benefits examined Partly covers it MAP 3.2 Potential costs of errors examined Partly covers it MAP 3.3 Targeted application scope specified Partly covers it MEASURE 1.2 Metrics and controls regularly reassessed Partly covers it MEASURE 1.3 Independent reviewers involved in assessments Partly covers it MEASURE 2.8 Transparency and accountability risks examined Partly covers it MEASURE 2.11 Fairness and bias evaluated Partly covers it MEASURE 4.1 Measurement linked to deployment context and expert input Partly covers it MANAGE 1.4 Residual risks to acquirers and users documented Partly covers it	Extend Your GOVERN 3.1 work supports control A.5.4. Implement it as a control and record it in your Statement of Applicability.
A.5.5 Impacts on society assessed	GOVERN 4.2 Teams record and communicate AI risks and impacts Partly covers it GOVERN 5.2 Adjudicated feedback fed back into design Partly covers it MAP 1.1 Intended purpose, uses, laws and settings documented Partly covers it MAP 1.6 System requirements gathered, with socio-technical effects in mind Partly covers it MAP 3.1 Potential benefits examined Partly covers it MAP 3.2 Potential costs of errors examined Partly covers it MAP 3.3 Targeted application scope specified Partly covers it MEASURE 1.2 Metrics and controls regularly reassessed Partly covers it MEASURE 1.3 Independent reviewers involved in assessments Partly covers it MEASURE 2.8 Transparency and accountability risks examined Partly covers it MEASURE 2.11 Fairness and bias evaluated Partly covers it MEASURE 2.12 Environmental impact assessed Partly covers it MEASURE 4.1 Measurement linked to deployment context and expert input Partly covers it	Extend Your GOVERN 4.2 work supports control A.5.5. Implement it as a control and record it in your Statement of Applicability.
Life cycle
A.6.1.2 Objectives for responsible development	GOVERN 1.2 Trustworthy-AI characteristics built into policies and practice Partly covers it GOVERN 4.1 A safety-first, critical-thinking culture Partly covers it GOVERN 4.3 Testing, incident identification and information sharing enabled Partly covers it MEASURE 2.7 Security and resilience evaluated Partly covers it MEASURE 2.8 Transparency and accountability risks examined Partly covers it MANAGE 2.2 The value of deployed systems sustained Partly covers it	Extend Your GOVERN 1.2 work supports control A.6.1.2. Implement it as a control and record it in your Statement of Applicability.
A.6.1.3 Processes for responsible design and development	GOVERN 1.2 Trustworthy-AI characteristics built into policies and practice Partly covers it GOVERN 3.2 Defined roles for human oversight of AI Partly covers it GOVERN 4.1 A safety-first, critical-thinking culture Partly covers it GOVERN 4.3 Testing, incident identification and information sharing enabled Partly covers it GOVERN 5.2 Adjudicated feedback fed back into design Partly covers it MAP 2.3 Scientific integrity and testing considerations documented Partly covers it MAP 3.5 Human oversight processes defined and assessed Partly covers it MAP 5.2 Regular engagement with AI actors and their feedback Partly covers it MANAGE 1.1 A go or no-go decision on whether the system meets its purpose Partly covers it MANAGE 2.2 The value of deployed systems sustained Partly covers it MANAGE 2.4 Ways to supersede, disengage or deactivate a system Partly covers it	Extend Your GOVERN 1.2 work supports control A.6.1.3. Implement it as a control and record it in your Statement of Applicability.
A.6.2.2 Requirements and specifications for AI systems	MAP 1.4 Business value defined or re-evaluated Partly covers it MAP 1.6 System requirements gathered, with socio-technical effects in mind Partly covers it	Extend Your MAP 1.4 work supports control A.6.2.2. Implement it as a control and record it in your Statement of Applicability.
A.6.2.3 Design and development documented	MAP 2.1 The tasks and methods the AI system supports defined Partly covers it MEASURE 2.7 Security and resilience evaluated Partly covers it	Extend Your MAP 2.1 work supports control A.6.2.3. Implement it as a control and record it in your Statement of Applicability.
A.6.2.4 Verification and validation	GOVERN 4.3 Testing, incident identification and information sharing enabled Partly covers it MAP 2.3 Scientific integrity and testing considerations documented Partly covers it MEASURE 1.2 Metrics and controls regularly reassessed Partly covers it MEASURE 2.1 Test sets, metrics and tools documented Partly covers it MEASURE 2.2 Evaluations with human subjects meet requirements Partly covers it MEASURE 2.5 Validity and reliability demonstrated, with limits recorded Partly covers it MEASURE 2.6 Safety risks evaluated regularly Partly covers it MEASURE 2.13 The testing and evaluation methods themselves evaluated Partly covers it MEASURE 4.1 Measurement linked to deployment context and expert input Partly covers it MANAGE 1.1 A go or no-go decision on whether the system meets its purpose Partly covers it MANAGE 2.2 The value of deployed systems sustained Partly covers it MANAGE 4.2 Continual improvement built into updates Partly covers it	Extend Your GOVERN 4.3 work supports control A.6.2.4. Implement it as a control and record it in your Statement of Applicability.
A.6.2.5 Deployment planned and checked	MEASURE 2.5 Validity and reliability demonstrated, with limits recorded Partly covers it MEASURE 2.9 The model explained and its outputs interpreted in context Partly covers it	Extend Your MEASURE 2.5 work supports control A.6.2.5. Implement it as a control and record it in your Statement of Applicability.
A.6.2.6 Operation and monitoring	GOVERN 1.7 Safe decommissioning of AI systems Partly covers it GOVERN 4.3 Testing, incident identification and information sharing enabled Partly covers it GOVERN 5.2 Adjudicated feedback fed back into design Partly covers it MAP 5.2 Regular engagement with AI actors and their feedback Partly covers it MEASURE 2.3 Performance measured in deployment-like conditions Partly covers it MEASURE 2.4 Behaviour monitored in production Partly covers it MEASURE 2.6 Safety risks evaluated regularly Partly covers it MEASURE 2.13 The testing and evaluation methods themselves evaluated Partly covers it MEASURE 3.2 Tracking for risks that are hard to measure Partly covers it MEASURE 4.3 Performance changes measured and documented Partly covers it MANAGE 2.2 The value of deployed systems sustained Partly covers it MANAGE 3.2 Pre-trained models monitored Partly covers it MANAGE 4.1 Post-deployment monitoring, including user input Partly covers it MANAGE 4.2 Continual improvement built into updates Partly covers it MANAGE 4.3 Incidents and errors communicated and tracked Partly covers it	Extend Your GOVERN 1.7 work supports control A.6.2.6. Implement it as a control and record it in your Statement of Applicability.
A.6.2.7 Technical documentation for those who need it	GOVERN 4.3 Testing, incident identification and information sharing enabled Partly covers it MAP 2.2 Knowledge limits and human oversight of outputs documented Partly covers it MAP 2.3 Scientific integrity and testing considerations documented Partly covers it MAP 3.5 Human oversight processes defined and assessed Partly covers it MAP 4.2 Internal risk controls for components documented Partly covers it MEASURE 2.1 Test sets, metrics and tools documented Partly covers it MEASURE 2.5 Validity and reliability demonstrated, with limits recorded Partly covers it MEASURE 2.9 The model explained and its outputs interpreted in context Partly covers it MEASURE 4.3 Performance changes measured and documented Partly covers it MANAGE 1.4 Residual risks to acquirers and users documented Partly covers it MANAGE 2.4 Ways to supersede, disengage or deactivate a system Partly covers it	Extend Your GOVERN 4.3 work supports control A.6.2.7. Implement it as a control and record it in your Statement of Applicability.
A.6.2.8 Event logs while AI systems are in use	MEASURE 2.4 Behaviour monitored in production Partly covers it MEASURE 2.6 Safety risks evaluated regularly Partly covers it MEASURE 3.2 Tracking for risks that are hard to measure Partly covers it	Extend Your MEASURE 2.4 work supports control A.6.2.8. Implement it as a control and record it in your Statement of Applicability.
Data
A.7.2 Data management for development and enhancement	MAP 2.3 Scientific integrity and testing considerations documented Partly covers it MEASURE 2.7 Security and resilience evaluated Partly covers it MEASURE 2.8 Transparency and accountability risks examined Partly covers it MEASURE 2.10 Privacy risk examined Partly covers it MANAGE 2.2 The value of deployed systems sustained Partly covers it	Extend Your MAP 2.3 work supports control A.7.2. Implement it as a control and record it in your Statement of Applicability.
A.7.3 How data is acquired and selected	MAP 2.3 Scientific integrity and testing considerations documented Partly covers it MEASURE 2.10 Privacy risk examined Partly covers it	Extend Your MAP 2.3 work supports control A.7.3. Implement it as a control and record it in your Statement of Applicability.
A.7.4 Data quality requirements	MAP 2.3 Scientific integrity and testing considerations documented Partly covers it MEASURE 2.3 Performance measured in deployment-like conditions Partly covers it	Extend Your MAP 2.3 work supports control A.7.4. Implement it as a control and record it in your Statement of Applicability.
A.7.5 Data provenance recorded	MAP 2.3 Scientific integrity and testing considerations documented Partly covers it MEASURE 2.9 The model explained and its outputs interpreted in context Partly covers it	Extend Your MAP 2.3 work supports control A.7.5. Implement it as a control and record it in your Statement of Applicability.
A.7.6 Data preparation criteria	MAP 2.3 Scientific integrity and testing considerations documented Partly covers it	Extend Your MAP 2.3 work supports control A.7.6. Implement it as a control and record it in your Statement of Applicability.
Transparency
A.8.2 Information for the system’s users	GOVERN 4.3 Testing, incident identification and information sharing enabled Partly covers it MAP 2.2 Knowledge limits and human oversight of outputs documented Partly covers it MAP 3.5 Human oversight processes defined and assessed Partly covers it MAP 4.2 Internal risk controls for components documented Partly covers it MEASURE 2.5 Validity and reliability demonstrated, with limits recorded Partly covers it MEASURE 2.9 The model explained and its outputs interpreted in context Partly covers it MEASURE 3.3 Ways for users and affected people to report problems and appeal Partly covers it MEASURE 4.2 Trustworthiness results informed by experts and affected people Partly covers it MANAGE 1.4 Residual risks to acquirers and users documented Partly covers it MANAGE 2.4 Ways to supersede, disengage or deactivate a system Partly covers it	Extend Your GOVERN 4.3 work supports control A.8.2. Implement it as a control and record it in your Statement of Applicability.
A.8.3 A channel to report adverse impacts	GOVERN 4.3 Testing, incident identification and information sharing enabled Partly covers it GOVERN 5.1 Feedback from outside the team collected and used Partly covers it GOVERN 5.2 Adjudicated feedback fed back into design Partly covers it MAP 5.2 Regular engagement with AI actors and their feedback Partly covers it MEASURE 3.3 Ways for users and affected people to report problems and appeal Partly covers it MEASURE 4.2 Trustworthiness results informed by experts and affected people Partly covers it MANAGE 4.1 Post-deployment monitoring, including user input Partly covers it	Extend Your GOVERN 4.3 work supports control A.8.3. Implement it as a control and record it in your Statement of Applicability.
A.8.4 A plan to tell users about incidents	GOVERN 4.3 Testing, incident identification and information sharing enabled Partly covers it MEASURE 2.1 Test sets, metrics and tools documented Partly covers it MEASURE 3.3 Ways for users and affected people to report problems and appeal Partly covers it	Extend Your GOVERN 4.3 work supports control A.8.4. Implement it as a control and record it in your Statement of Applicability.
A.8.5 Information owed to interested parties	GOVERN 4.2 Teams record and communicate AI risks and impacts Partly covers it GOVERN 4.3 Testing, incident identification and information sharing enabled Partly covers it MANAGE 4.3 Incidents and errors communicated and tracked Partly covers it	Extend Your GOVERN 4.2 work supports control A.8.5. Implement it as a control and record it in your Statement of Applicability.
Responsible use
A.9.2 Processes for responsible use	GOVERN 4.1 A safety-first, critical-thinking culture Partly covers it MAP 4.1 Technology and legal risks of each component mapped, third parties too Partly covers it MANAGE 1.1 A go or no-go decision on whether the system meets its purpose Partly covers it	Extend Your GOVERN 4.1 work supports control A.9.2. Implement it as a control and record it in your Statement of Applicability.
A.9.3 Objectives for responsible use	GOVERN 1.2 Trustworthy-AI characteristics built into policies and practice Partly covers it GOVERN 3.2 Defined roles for human oversight of AI Partly covers it GOVERN 4.1 A safety-first, critical-thinking culture Partly covers it MAP 2.2 Knowledge limits and human oversight of outputs documented Partly covers it MEASURE 2.7 Security and resilience evaluated Partly covers it MEASURE 2.8 Transparency and accountability risks examined Partly covers it MANAGE 1.1 A go or no-go decision on whether the system meets its purpose Partly covers it	Extend Your GOVERN 1.2 work supports control A.9.3. Implement it as a control and record it in your Statement of Applicability.
A.9.4 Use kept to the intended purpose	MAP 1.4 Business value defined or re-evaluated Partly covers it MAP 4.1 Technology and legal risks of each component mapped, third parties too Partly covers it MANAGE 1.1 A go or no-go decision on whether the system meets its purpose Partly covers it MANAGE 2.4 Ways to supersede, disengage or deactivate a system Partly covers it	Extend Your MAP 1.4 work supports control A.9.4. Implement it as a control and record it in your Statement of Applicability.
Third parties
A.10.2 Responsibilities shared across the AI supply chain	GOVERN 6.1 Policies for third-party AI risks, including IP Partly covers it GOVERN 6.2 Contingency plans for failures in high-risk third-party data or AI Partly covers it MANAGE 3.1 Third-party risks and benefits monitored Partly covers it	Extend Your GOVERN 6.1 work supports control A.10.2. Implement it as a control and record it in your Statement of Applicability.
A.10.3 Suppliers of AI services, products and data	GOVERN 1.2 Trustworthy-AI characteristics built into policies and practice Partly covers it GOVERN 4.1 A safety-first, critical-thinking culture Partly covers it GOVERN 6.1 Policies for third-party AI risks, including IP Partly covers it GOVERN 6.2 Contingency plans for failures in high-risk third-party data or AI Partly covers it MAP 4.2 Internal risk controls for components documented Partly covers it MANAGE 3.1 Third-party risks and benefits monitored Partly covers it	Extend Your GOVERN 1.2 work supports control A.10.3. Implement it as a control and record it in your Statement of Applicability.
A.10.4 Customers’ needs and expectations met	GOVERN 5.1 Feedback from outside the team collected and used Partly covers it GOVERN 5.2 Adjudicated feedback fed back into design Partly covers it MANAGE 4.1 Post-deployment monitoring, including user input Partly covers it	Extend Your GOVERN 5.1 work supports control A.10.4. Implement it as a control and record it in your Statement of Applicability.

A route from NIST AI RMF to ISO/IEC 42001

01
Scope and roles
- Set the AIMS scope: which AI systems, and your role for each
- Name top management’s responsibilities
02
Policy and objectives
- Write the AI policy from your AI RMF governance practices
- Set measurable AI objectives
03
Risk and impact
- Turn your MAP and MEASURE work into a documented AI risk assessment and treatment process
- Formalise AI system impact assessment (ISO/IEC 42005 gives guidance)
04
Controls
- Go through Annex A and write the Statement of Applicability
- Use the crosswalk to find the AI RMF work behind each control
05
Run and check
- Operate the AIMS and keep its records
- Internal audit and management review
06
Certification
- Choose an accredited certification body for ISO/IEC 42001
- Plan the stage 1 and stage 2 audits

Certification and audits

ISO/IEC 42001 can be certified by an accredited certification body: a stage 1 and a stage 2 audit, then surveillance audits.
Your AI RMF profile helps auditors see how risk is managed, but it isn’t evidence on its own: they will look for the AIMS records.

Common pitfalls

Expecting the AI RMF profile to become the AIMS. The standard needs a managed system with documented information, audits and reviews.
Missing what the crosswalk leaves out: interested parties (4.2), planning changes (6.3) and operational planning (8.1).
Leaving the Statement of Applicability to the end. It drives the Annex A work and the audit.

NIST AI RMF and ISO/IEC 42001 at a glance

NIST AI RMF and ISO/IEC 42001 side by side
Fact	NIST AI RMF	ISO/IEC 42001
What it is	Voluntary framework	Certifiable standard
How it applies	Voluntary (adopted by choice)	Voluntary, often required by customers
How you show it	Voluntary: no certification of its own	Certification by an accredited certification body
Where	United States, International	International
Covers	AI governance, Risk management	AI governance, Risk management, Audit & assurance
Issued or enforced by	National Institute of Standards and Technology (NIST), US Department of Commerce	ISO and IEC (ISO/IEC JTC 1/SC 42 Artificial intelligence)
Current edition or status	AI RMF 1.0 (NIST AI 100-1, January 2023), with the Generative AI Profile (NIST AI 600-1, July 2024) and the online AI RMF Playbook.	ISO/IEC 42001:2023, first edition (December 2023). Supporting standards include ISO/IEC 42005 (impact assessment) and ISO/IEC 42006 (certification bodies).

Next steps on MajorCyber™

Sources

NIST AI RMF to ISO/IEC FDIS 42001 AI Management System Crosswalk — NIST AI Resource Center
Crosswalk documents — NIST AI Resource Center
Artificial Intelligence Risk Management Framework (AI RMF 1.0), NIST AI 100-1 — NIST
ISO/IEC 42001:2023, AI management system — ISO

Open questions

NIST’s crosswalk was made against the final draft of ISO/IEC 42001 and cites the Annex B guidance numbers. The published standard kept that numbering, and every reference here is checked against it.

An educational comparison, researched and drafted with AI assistance. A mapping shows where work you have already done supports a requirement; it never means the requirement is met. Your certification body decides what conforms. No standard’s text is reproduced: buy the standards from ISO or your national standards body.