ISO 42001 vs NIST AI RMF vs EU AI Act: which one does your company need?

Cumplimiento y regulación
28 Oct 2026, 9:35 p.m. By Juan Carlos Hernandez 💬 0

The EU AI Act is mandatory for anyone who provides or uses AI in the Union, even from abroad. The NIST AI RMF is a voluntary US framework for managing AI risk. ISO/IEC 42001 is the international certifiable standard for an AI management system. They do not compete: the law says what to comply with, NIST helps manage the risk and ISO 42001 turns it into an auditable system that proves it.

What is each one?

EU AI Act (Regulation 2024/1689): a law with risk tiers (prohibited, high, transparency, minimal), duties by role and fines of up to €35 million or 7% of worldwide turnover.
NIST AI RMF 1.0 (January 2023): a voluntary framework with four functions: govern, map, measure and manage; it has a generative AI profile (NIST AI 600-1, July 2024).
ISO/IEC 42001:2023 (December 2023): a management system with clauses 4 to 10 and 38 controls in Annex A; an accredited body certifies it.

Which one is mandatory?

Only the EU AI Act, and only if your system is placed on the EU market or its output is used there (Art. 2). The NIST AI RMF and ISO 42001 are voluntary, but customers, tenders and regulators ask for them as evidence of due diligence.

Key EU AI Act dates

February 2, 2025: prohibited practices (Art. 5) and AI literacy (Art. 4).
August 2, 2025: general-purpose AI model obligations.
August 2, 2026: general application, including Art. 50 transparency (disclose it is an AI, mark generated content).
December 2, 2027: Annex III high-risk systems (employment, credit, education, biometrics…), postponed by Regulation 2026/1744.
August 2, 2028: high-risk AI in Annex I regulated products.

How do they map to each other?

Govern (NIST) ↔ clauses 4–5 and controls A.2–A.3 (ISO): policy, owners and culture.
Map (NIST) ↔ impact assessment (6.1.4, A.5): context, uses and affected people.
Measure (NIST) ↔ verification, validation and monitoring (A.6.2): accuracy, bias and security metrics.
Manage (NIST) ↔ risk treatment and improvement (6.1.3, 10): response, incidents and continual improvement.
EU law: the risk management, data governance, logging and human oversight it requires for high-risk AI fit inside the ISO 42001 system.

Where to start?

1. Inventory: list your AI systems, including shadow AI.
2. Classification: place each one with the AI risk classifier.
3. Starting point: measure your maturity with the ISO 42001 self-assessment.
4. System: use the NIST AI RMF as technical guidance and ISO 42001 as the certifiable system; if you already have ISO 27001, reuse its structure.

If you sell or use AI in the US, also review the new Colorado AI law.

Frequently asked questions

What is the difference between ISO 42001 and the NIST AI RMF?

The NIST AI RMF is a voluntary AI risk management framework with no certification; ISO 42001 is a management system standard certified by an accredited body. They complement each other.

Does the EU AI Act apply to US or Latin American companies?

Yes, if they place AI systems on the EU market or the output of their system is used in the Union (Art. 2 of Regulation 2024/1689).

When do the high-risk obligations apply?

From December 2, 2027 for Annex III uses and from August 2, 2028 for Annex I products, under Regulation 2026/1744.

Does ISO 42001 certification guarantee EU AI Act compliance?

Not by itself, but it covers much of the risk management, data, logging and oversight the law requires, and leaves auditable evidence.

Sources

  1. Unión Europea. Reglamento (UE) 2024/1689 de inteligencia artificial. 2024 https://eur-lex.europa.eu/eli/reg/2024/1689/oj
  2. Unión Europea. Reglamento (UE) 2026/1744 (Digital Omnibus sobre IA). 2026 https://eur-lex.europa.eu/eli/reg/2026/1744/oj
  3. Orrick. EU AI Act Update: Digital Omnibus Finalizes 8 Compliance Changes. 2026 https://www.orrick.com/en/Insights/2026/07/EU-AI-Act-Update-Digital-Omnibus-Finalizes-8-Compliance-Changes
  4. NIST. AI Risk Management Framework. 2023 https://www.nist.gov/itl/ai-risk-management-framework
  5. IEC Webstore. ISO/IEC 42001:2023 Artificial intelligence — Management system. 2023 https://webstore.iec.ch/en/publication/90574

Which framework does your company need?

We run the assessment and build one system that answers to the law, NIST and ISO 42001.

See the service

You may also like

Cumplimiento y regulación

AI and personal data in Colombia: what Law 1581 and SIC Circular 002 require
Cumplimiento y regulación

Colorado AI law SB 26-189: what changed and what companies must do from 2027

 Cybersecurity and Public Procurement in Colombia: Requirements You Must Meet
Cumplimiento y regulación

Cybersecurity and Public Procurement in Colombia: Requirements You Must Meet

Comments (0)

Be the first to comment.