EU AI Act, NIST AI RMF and ISO 42001: one crosswalk
Three documents dominate AI governance, and they are three different kinds of thing: a law, a voluntary framework and a certifiable management system standard. Much of the work overlaps. Running them as three separate projects means doing the same work three times, in three different vocabularies.
In short
The EU AI Act is law: obligations depend on your role (provider, deployer, importer, distributor) and the system's risk class. The NIST AI RMF is a voluntary framework organized in four functions: Govern, Map, Measure, Manage. ISO/IEC 42001 is a certifiable management system with 38 controls in Annex A. They meet on the same eight themes: inventory, roles, risk assessment, impact on people, data, documentation, human oversight and monitoring. Build one control set around those themes and map it to all three; NIST publishes official crosswalks, including one to ISO/IEC 42001.
Three documents, three natures
| EU AI Act | NIST AI RMF | ISO/IEC 42001 |
|---|
| What it is | Regulation with legal force in the EU market | Voluntary framework from the US standards institute | International management system standard |
| Who it binds | Providers, deployers, importers and distributors of AI systems in the EU | No one by default, adopted by choice or by contract | Organizations that choose certification |
| Structure | Obligations by role and risk class | Four functions: Govern, Map, Measure, Manage | Clauses 4 to 10 plus 38 Annex A controls |
| Proof | Conformity assessment, documentation, registration where required | Your own profile and evidence | Certification audit by an accredited body |
The crosswalk by theme
| Theme | EU AI Act | NIST AI RMF | ISO/IEC 42001 |
|---|
| Inventory of AI systems | Implied by classification and registration duties | Map: context and system categorization | Clause 4 context; register of systems |
| Roles and accountability | Defined roles (Art. 3); a deployer can become a provider (Art. 25) | Govern: accountability structures | Clause 5 leadership; Annex A internal organization |
| Risk management | Risk management system for high-risk systems (Art. 9) | Map, Measure, Manage | Clause 6 planning; risk assessment and treatment |
| Impact on people | Fundamental rights impact assessment for some deployers (Art. 27) | Map: impacts on individuals and society | AI system impact assessment; Annex A impact controls |
| Data | Data and data governance for high-risk systems (Art. 10) | Measure and Manage: data quality and provenance | Annex A data controls |
| Documentation and logs | Technical documentation (Art. 11), record keeping (Art. 12), deployer log retention (Art. 26) | Govern and Manage: documentation practices | Clause 7 documented information; life cycle records |
| Human oversight | Human oversight (Art. 14); deployer assigns competent people (Art. 26) | Govern and Manage: human roles and oversight | Annex A use of AI systems |
| Transparency | Transparency to users and for certain content (Art. 13, Art. 50) | Govern: transparency | Annex A information for interested parties |
| Monitoring and incidents | Post-market monitoring, serious incident reporting | Manage: monitoring and response | Clauses 9 and 10; nonconformity and corrective action |
Article numbers refer to the EU AI Act text. The table is a working map, not a legal opinion: each row needs to be read against the current text and your role.
NIST publishes official crosswalks on its AI Resource Center, including a mapping between the AI RMF and ISO/IEC 42001. They are a better starting point than building your own from scratch.
Where they do not overlap
- Legal obligations the frameworks cannot satisfy. Conformity assessment, registration in the EU database and specific duties by role exist only in the AI Act. No management system replaces them.
- Certification exists only in ISO/IEC 42001. The NIST framework has no certificate, and the AI Act has conformity assessment, which is a different thing.
- Generative AI specifics. NIST adds a Generative AI Profile covering risks such as confabulation and information integrity. ISO/IEC 42001 addresses them through your own risk assessment.
- Dates. The AI Act applies in stages, and its dates have been amended. Check the current consolidated text before relying on any date.
One program instead of three
- Build the inventory first. Every framework needs it, and nothing else works without it.
- Assign your role per system under the AI Act. It decides which legal duties apply at all.
- Write one control set organized around the eight themes above.
- Map each control to the AI Act article, the NIST function and the ISO clause or Annex A control it satisfies.
- Collect evidence once, for each control, and reuse it for the audit, the customer questionnaire and the regulator.
The practical test of a good mapping is this: a customer security questionnaire asks about AI oversight, and you answer by pointing to the same evidence you would show an ISO auditor.
Frequently asked questions
What is the difference between the EU AI Act, NIST AI RMF and ISO 42001?
The EU AI Act is a law with obligations by role and risk class. The NIST AI RMF is a voluntary framework with four functions: Govern, Map, Measure, Manage. ISO/IEC 42001 is a certifiable management system standard. They overlap on inventory, roles, risk, impact, data, documentation, oversight and monitoring.
Is there an official mapping between NIST AI RMF and ISO 42001?
Yes. NIST publishes crosswalks on its AI Resource Center, including a mapping between the AI RMF and ISO/IEC 42001, as well as crosswalks to other standards.
Does ISO 42001 certification prove EU AI Act compliance?
No. It covers much of the groundwork, but the AI Act includes legal duties, such as conformity assessment and registration for some systems, that no management system can replace.
Which framework should we start with?
With the inventory of AI systems, because all three need it. Then your role under the AI Act if you operate in the EU, then one control set mapped to all three.
Is NIST AI RMF only for US companies?
No. It is voluntary and used internationally as a structure for AI risk management. Some customers and contracts ask for it regardless of where you are based.