EU AI Act vs NIST AI RMF vs ISO 42001: Compared

Three Frameworks at a Glance

The global AI governance landscape is shaped by three landmark frameworks — each originating from a different authority, serving a distinct purpose, yet converging on a shared mission: enabling AI systems that are safe, transparent, and accountable.

EU AI Act

Regulatory Framework

European Union legislation establishing legally binding requirements for AI systems placed on the EU market, based on a tiered risk classification model.

NIST AI RMF

Risk Management Framework

A voluntary US-origin framework from the National Institute of Standards and Technology, providing structured guidance for identifying, assessing, and managing AI risks.

ISO/IEC 42001

Management System Standard

An internationally certifiable standard defining requirements for an AI Management System (AIMS), aligned with the ISO Annex SL structure used by ISO 9001 and ISO 27001.

Framework Comparison

A structured look at how each framework differs in nature, scope, intended audience, and enforcement — and where their strengths lie.

Dimension	EU AI Act	NIST AI RMF	ISO/IEC 42001
Nature	Legally binding regulation	Voluntary guidance framework	Certifiable international standard
Focus	Risk classification & compliance obligations	Risk identification, measurement & management	Organisational AI management system
Who It's For	Providers & deployers in the EU market	Any organisation developing or using AI	Organisations seeking certification or structured governance
Structure	Tiered risk pyramid with mandatory requirements	4 Core Functions: Govern, Map, Measure, Manage	Plan-Do-Check-Act (PDCA) management cycle
Key Strength	Legal clarity & market harmonisation	Practical, adaptable risk guidance	Systemic, auditable AI governance
Enforcement	Up to €35M or 7% global turnover	No enforcement — market-driven adoption	Third-party certification & audit

Risk-Based Classification

The EU AI Act classifies AI systems into four risk tiers. Obligations scale with risk — from outright prohibition at the top to near-zero requirements at the base. Enforcement is administered by national market surveillance authorities.

🔴 Unacceptable Risk — Prohibited

AI systems that pose unacceptable threats to fundamental rights. Includes social scoring, real-time biometric surveillance in public spaces, and subliminal manipulation.

🟠 High Risk — Mandatory Requirements

AI in critical infrastructure, education, employment, law enforcement, and medical devices. Subject to conformity assessments, data governance, and human oversight obligations.

🟡 Limited Risk — Transparency Obligations

Systems such as chatbots must disclose that users are interacting with AI. Deepfakes must be labelled.

🟢 Minimal Risk — No Obligations

The vast majority of AI applications, including spam filters and AI-enabled video games. Voluntary codes of conduct encouraged.

Penalties at a Glance

Up to €35M or 7% of global turnover

Maximum fine for prohibited AI violations

Up to €15M or 3% of global turnover

Maximum fine for high-risk AI non-compliance

Up to €7.5M or 1% of global turnover

Maximum fine for supplying incorrect information

Four Core Functions of the AI RMF

The NIST AI Risk Management Framework organises AI risk practices around four integrated functions — not a linear checklist, but a continuous, interconnected cycle that organisations can adapt to their context, sector, and risk appetite.

Govern

Establish organisational policies, accountability structures, and culture for responsible AI risk management across all levels.

Map

Identify, categorise, and contextualise AI risks — understanding the system's purpose, stakeholders, and potential harms before deployment.

Measure

Analyse and assess identified risks using quantitative and qualitative tools. Evaluate likelihood, severity, and the effectiveness of mitigations.

Manage

Prioritise, respond to, and monitor AI risks on an ongoing basis. Allocate resources, implement controls, and track residual risk over time.

The NIST AI RMF is voluntary and technology-neutral, making it one of the most widely adopted frameworks globally — applicable to any organisation, regardless of size, sector, or jurisdiction.

Plan-Do-Check-Act: The Management System Approach

ISO/IEC 42001 applies the globally recognised Plan-Do-Check-Act (PDCA) model to AI governance, embedding it within an organisation's existing management infrastructure. Its Annex SL structure ensures seamless integration with ISO 9001 (Quality) and ISO 27001 (Information Security).

Plan

Define the scope of the AI Management System. Identify AI risks, set objectives, and establish policies, roles, and responsibilities.

Do

Implement controls, processes, and procedures. Operationalise AI governance across the development and deployment lifecycle.

Check

Monitor and evaluate performance against objectives. Conduct internal audits and management reviews to assess conformance and effectiveness.

Act

Address nonconformities, apply corrective actions, and drive continual improvement across the AI management system.

Common Governance Themes Across All Three Frameworks

Despite their different origins and mechanisms, the EU AI Act, NIST AI RMF, and ISO/IEC 42001 converge on the same foundational governance principles. Organisations that address these six themes holistically will meet the core intent of all three frameworks simultaneously.

Governance & Accountability

Clear ownership of AI systems, defined roles, and board-level accountability for AI risk and ethics decisions.

Risk Management

Structured identification, assessment, and treatment of risks throughout the AI lifecycle — from design to decommission.

Data Governance

Ensuring training data quality, lineage, representativeness, and compliance with applicable data protection requirements.

Human Oversight

Maintaining meaningful human control over consequential AI decisions, with clear escalation paths and override mechanisms.

Transparency

Explainability of AI outputs, disclosure of AI involvement to affected individuals, and documentation for regulators and auditors.

Monitoring & Improvement

Post-deployment performance tracking, incident logging, and systematic processes for continual improvement over time.

Where the Frameworks Converge

Each framework approaches AI governance from a distinct angle — yet all three intersect at the same destination: Trustworthy AI.

Organisations that align all three frameworks gain regulatory compliance, operational resilience, and market credibility — simultaneously and without duplicating effort.

Your Integrated AI Governance Approach

Rather than treating each framework as a separate compliance exercise, leading organisations are adopting an integrated strategy that maximises coverage, minimises duplication, and builds lasting governance capability.

Build with ISO/IEC 42001

Use ISO/IEC 42001 as the structural foundation for your AI Management System. The PDCA cycle and Annex SL alignment make it the most practical starting point for organisations with existing ISO certifications.

Leverage NIST AI RMF for Risk Depth

Apply the NIST AI RMF's Govern-Map-Measure-Manage functions to build comprehensive, adaptable risk practices — especially valuable for organisations operating outside EU jurisdiction or seeking a more granular risk methodology.

Map Both to the EU AI Act

Once your management system and risk practices are established, map your controls to EU AI Act requirements. This targeted gap-closure approach is far more efficient than building EU compliance from scratch.

One Integrated Approach. Maximum Impact.

"ISO/IEC 42001 builds the system. NIST AI RMF manages the risk. The EU AI Act sets the bar. Together, they define what responsible AI governance looks like in practice."