The fast answer: the NIST AI Risk Management Framework (AI RMF) is a voluntary US framework, released by the National Institute of Standards and Technology on 26 January 2023, that organises AI risk work into four functions: Govern, Map, Measure and Manage. ISO/IEC 42001 is an international standard, published in December 2023, that sets requirements for an AI management system, and an organisation can be certified against it by an independent certification body. Both are about how an organisation runs its AI work. Neither one tests how a specific AI product actually behaves when a real person, or a real attacker, starts typing into it. That gap is where product-level testing fits.

If you build, buy, insure or regulate AI, you will meet both documents within weeks. Procurement questionnaires ask about them. Laws now refer to them by name. Below is what each one really says, what it does not do, how the supporting standards fit around them, and how to combine them with evidence about the product itself.

Why AI standards matter now

For a few years, AI standards were reading material for governance teams. In 2026 they started carrying legal weight.

In Texas, the Responsible Artificial Intelligence Governance Act (HB 149), which took effect on 1 January 2026, names the NIST framework directly. Under Section 552.105(e) of the enrolled bill text, a defendant "may not be found liable" if it discovers a violation through "testing, including adversarial testing or red-team testing," or through an internal review process while it "substantially complies with the most recent version of the" NIST Generative AI Profile "or another nationally or internationally recognized risk management framework for artificial intelligence systems." In plain terms, a recognised framework plus real testing became part of a legal defence.

In Europe, the EU AI Act relies on harmonised European standards to give companies a practical route to compliance. On 15 October 2026, CEN-CENELEC announced that EN 18286, "Artificial Intelligence: Quality management system for EU AI Act regulatory purposes," had been cited in the Official Journal of the European Union as the first harmonised standard under the Act. It translates the quality management system requirements of Article 17 of the EU AI Act into auditable requirements for providers of high-risk AI systems, and gives them a route to the "presumption of conformity" with those provisions.

So standards are no longer optional reading for anyone selling AI into regulated markets. They are the vocabulary in which buyers, lawyers and regulators now ask their questions. For the legal picture in more depth, see our complete guide to the EU AI Act and US AI laws.

The NIST AI Risk Management Framework (AI RMF 1.0)

What it is

NIST describes the AI RMF as "a guidance document for voluntary use by organizations designing, developing, deploying or using AI systems," in its January 2023 release announcement. The framework "follows a direction from Congress for NIST to develop the framework," and NIST spent 18 months on it, working "in close collaboration with the private and public sectors" and taking in comments from more than 240 organisations.

The framework text calls itself "voluntary, rights-preserving, non-sector-specific, and use-case agnostic." It is divided into two parts. Part 1 explains how to frame AI risk and describes what a trustworthy AI system looks like. Part 2 is the Core, built around the four functions.

The four functions: Govern, Map, Measure, Manage

NIST says the four functions "can be applied in context-specific use cases and at any stages of the AI life cycle." In practice they work like this:

• Govern sets up the culture, policies, roles and accountability for AI risk. It runs across the other three rather than coming first and then stopping.
• Map establishes context: what the system is for, who uses it, who could be affected and what could go wrong.
• Measure analyses, assesses and tracks the risks that Map identified, using quantitative and qualitative methods.
• Manage decides what to do about those risks, including prioritising, treating, monitoring and responding to them over time.

Measure is where testing lives. The framework expects an organisation to measure its systems, but it does not supply the tests, the pass marks or a way to compare one product with another. That is a deliberate choice for a framework meant to fit every sector, and it is the single most important thing to understand about how the RMF relates to product evaluation.

The seven characteristics of trustworthy AI

Part 1 of the framework lists the characteristics of trustworthy AI systems:

1. Valid and reliable
2. Safe
3. Secure and resilient
4. Accountable and transparent
5. Explainable and interpretable
6. Privacy-enhanced
7. Fair with harmful bias managed

NIST treats two of these as structural. "Valid & Reliable is a necessary condition of trustworthiness," and accountability and transparency is drawn as a vertical box "because it relates to all other characteristics." The framework also says plainly that "a comprehensive approach to risk management calls for balancing tradeoffs among the trustworthiness characteristics." A system tuned to refuse everything is safe in one sense and useless in another, and the RMF asks organisations to make those tradeoffs knowingly.

The companion resources

NIST's AI RMF home page lists a companion Playbook, which "suggests ways to navigate and use the framework," along with an AI RMF Roadmap, an AI RMF Crosswalk and various Perspectives documents. The Crosswalks map the RMF to other frameworks and standards, which helps teams that need to satisfy several at once. On 30 March 2023 NIST also launched the Trustworthy and Responsible AI Resource Center to support implementation.

The framework is being revised

Anyone citing the AI RMF should know it is changing. NIST's framework page now states: "The AI RMF 1.0 is being updated. A revised version is in progress." It ties the revision to the White House AI Action Plan of 23 July 2025, which tasked NIST with revising the framework to remove references to "misinformation, Diversity, Equity, and Inclusion" and climate change. NIST has always described the RMF as "intended to be a living document."

NIST is also extending the framework into specific sectors. On 7 April 2026 it released a concept note for an AI RMF Profile on Trustworthy AI in Critical Infrastructure, meant to guide critical infrastructure operators on risk practices for AI-enabled capabilities. For anything you write into a contract or a policy, refer to "the most recent version," as the Texas statute does, rather than pinning to a version that may soon be superseded.

The Generative AI Profile: NIST AI 600-1

The AI RMF was written before large language models became everyday products. NIST filled that gap with NIST AI 600-1, the Generative Artificial Intelligence Profile, published on 26 July 2024. It is a "cross-sectoral profile of and companion resource for" the AI RMF, focused on generative AI. The publication page shows it was last updated on 8 April 2026. Use the July 2024 publication; an April 2024 initial public draft still circulates online, and NIST marks it as withdrawn and superseded.

The twelve generative AI risks

The final profile lists twelve risks that are unique to, or made worse by, generative AI:

1. CBRN Information or Capabilities
2. Confabulation
3. Dangerous, Violent, or Hateful Content
4. Data Privacy
5. Environmental Impacts
6. Harmful Bias or Homogenization
7. Human-AI Configuration
8. Information Integrity
9. Information Security
10. Intellectual Property
11. Obscene, Degrading, and/or Abusive Content
12. Value Chain and Component Integration

Check the names when you see this list quoted elsewhere. The draft used different labels for several of them, such as "Dangerous or Violent Recommendations" and "Toxicity, Bias, and Homogenization," and those labels still turn up in compliance checklists. The final profile defines confabulation as "a phenomenon in which GAI systems generate and confidently present erroneous or false content." Most people call this hallucination.

Why the profile matters for testing

The Generative AI Profile is more explicit about testing than the base framework. Pre-deployment testing is one of its four primary considerations, alongside governance, content provenance and incident disclosure. Its suggested actions include sharing "results of pre-deployment testing with relevant GAI Actors," engaging "in internal and external evaluations, GAI red-teaming, impact assessments," and using "structured public feedback exercises such as AI red-teaming or independent external evaluations."

That last phrase is worth reading twice. NIST's own profile treats independent external evaluation as a recognised way to collect evidence about a generative AI system. It still does not say which tests to run or what score counts as good enough.

ISO/IEC 42001: the AI management system standard

What it is

ISO/IEC 42001, titled "Information technology: Artificial intelligence: Management system," was published in December 2023 as edition 1 by the joint ISO and IEC committee on AI, ISO/IEC JTC 1/SC 42. It specifies requirements for establishing, implementing, maintaining and continually improving an AI management system, and it is aimed at "organizations of any size involved in developing, providing, or using AI-based products or services."

ISO's own explainer defines an AI management system as "a structured set of policies, processes and controls." If you know ISO/IEC 27001 for information security, the shape will feel familiar: leadership commitment, risk assessment, documented controls, internal audit and continual improvement, applied to AI.

How certification to ISO/IEC 42001 works

Here the two documents part ways. NIST presents the AI RMF as voluntary guidance with no certification scheme. ISO/IEC 42001 can be certified, and ISO is careful about how it describes it:

• "Certification for ISO/IEC 42001 is voluntary."
• "ISO does not certify organizations."
• "Certification is carried out by independent certification bodies, which may be accredited by national accreditation bodies."
• "The standard does not replace laws or regulations."

In July 2025 ISO added ISO/IEC 42006, which "sets out the additional requirements for bodies that audit and certify artificial intelligence management systems." It builds on ISO/IEC 17021-1, the general standard for management system certification bodies, and is meant to ensure those bodies have the competence and rigour to assess organisations that develop, deploy or offer AI. If a supplier shows you a 42001 certificate, ask which body issued it and whether that body is accredited.

What an ISO/IEC 42001 certificate tells you

A 42001 certificate tells you that an organisation has a functioning management system for AI and that an auditor checked it. That is valuable. It tells you the company has policies, assigns responsibility, assesses risk and reviews itself.

The certificate is about the organisation, not any individual product. ISO's explainer only describes certifying organisations. A company can hold a valid 42001 certificate while one of its chatbots still invents a refund policy or gives way to a simple jailbreak, because the standard checks that a process exists to find and fix such problems, not that every product has passed a specific behavioural test.

The supporting ISO/IEC standards around 42001

ISO/IEC 42001 sits inside a family of standards from the same committee. Three are worth knowing by number.

ISO/IEC 23894: AI risk management guidance

ISO/IEC 23894:2023, published in February 2023, "provides guidance on how organizations that develop, produce, deploy or use products, systems and services that utilize artificial intelligence (AI) can manage risk specifically related to AI." It is guidance rather than a certifiable set of requirements, and it describes how to integrate AI risk management into an organisation's existing activities.

ISO/IEC 42005: AI system impact assessment

ISO/IEC 42005:2025, published in May 2025, "provides guidance for organisations conducting AI system impact assessments." It covers how AI systems and their foreseeable uses could affect individuals, groups or society, and helps organisations "identify, evaluate and document potential impacts throughout the AI system lifecycle." This is the closest of the family to the system level, though it is still guidance on how to assess, not a test suite.

ISO/IEC 42006: rules for the certifiers

Covered above. It governs the bodies that audit and certify against 42001, which matters to anyone relying on a certificate.

NIST AI RMF vs ISO/IEC 42001 at a glance

• Publisher: NIST, a US federal agency, for the AI RMF. ISO and IEC jointly, through JTC 1/SC 42, for 42001.
• Released: 26 January 2023 for the AI RMF; December 2023 for 42001.
• Nature: the AI RMF is voluntary guidance. ISO/IEC 42001 is a requirements standard that can be audited.
• Certification: NIST describes no certification scheme for the AI RMF. For 42001, voluntary certification by independent certification bodies, with ISO/IEC 42006 governing those bodies.
• Structure: the AI RMF has four functions and seven trustworthiness characteristics. 42001 follows the management system pattern of policy, risk assessment, controls, audit and improvement.
• Generative AI: the AI RMF has a dedicated profile, NIST AI 600-1. 42001 covers all AI without a separate generative profile.
• Status in 2026: NIST says the AI RMF is being revised. 42001 remains at its first edition.
• Tests a specific product's behaviour: neither.

The two work well together. Many organisations use the AI RMF as the thinking framework and 42001 as the auditable system, and NIST's Crosswalks exist to help with exactly that mapping.

Where the EU's harmonised standards fit

The EU AI Act sets legal obligations, and European standards translate them into technical requirements. CEN-CENELEC Joint Technical Committee 21, established in 2021, writes those standards in response to the European Commission's standardisation request. When a harmonised standard is cited in the Official Journal, following it gives a presumption of conformity with the provisions it covers.

EN 18286, the first to reach that point, covers the quality management system required by Article 17. It is still a process standard: it tells a provider how to run its quality system, not what score its model must reach on a particular test. ISO/IEC 42001 and EN 18286 cover related ground, but they are different documents with different legal effects. A 42001 certificate is not, on its own, an EU AI Act presumption of conformity.

The gap: standards govern processes, not products

Put everything above side by side and one pattern stands out. The AI RMF asks you to measure. The Generative AI Profile asks you to test, red-team and invite independent evaluation. ISO/IEC 42001 asks you to run a disciplined management system. ISO/IEC 42005 asks you to assess impact. EN 18286 asks you to run a quality system.

None of them answers the question a buyer, a parent or an insurer actually asks: does this particular product behave safely, and how does it compare with the alternatives?

Process assurance and product assurance answer different questions, and mature industries use both. A factory can hold a quality management certificate while each product it makes still has to pass its own safety tests. AI is arriving at the same arrangement. The standards above establish that a company is managing risk. Product-level testing produces the measurements that the Measure function and the Generative AI Profile's testing actions call for.

For the certification side of this picture in detail, read our complete guide to AI safety certification.

How A.E.G.I.S.™ connects standards to product behaviour

RateAI's A.E.G.I.S.™ rating system is a product-level evaluation framework. It tests a specific AI system's behaviour across seven independently scored pillars:

1. Hallucination Integrity: factual reliability under pressure, ambiguity and domain-specific questioning. This is the behaviour NIST's profile calls confabulation.
2. Guardrail Resistance: jailbreak attempts, prompt injection and boundary-pushing scenarios.
3. Data Handling and Privacy: data collection behaviour, PII exposure and privacy compliance posture.
4. Ethical Alignment: behaviour with vulnerable users and sensitive topics.
5. Autonomy and Control: autonomous behaviour, escalation paths and the integrity of human override.
6. Adversarial Robustness: red-team exercises and multi-agent simulations against a motivated attacker.
7. Explainability and Transparency: traceability, disclosure quality and the evidence trail behind decisions.

Pillar results determine the A.E.G.I.S.™ Certified seal, from A-5 Guardian, the highest safety assurance, down to A-1 Unrestricted. Certified systems also receive a standardised A.E.G.I.S.™ scorecard with an Overall Safety Rating from A (Maximum Safety) to F (Dangerous) and a grade for each pillar.

Several design choices make the results usable as evidence alongside the standards described above:

• Reproducibility. Pillar weights, A-Scale thresholds and quorum parameters are defined by the active scoring epoch, and epochs freeze those parameters so evaluations stay comparable across time.
• A tamper-evident record. Every prompt case, validator vote, consensus decision and certification is chained by SHA-256 hash, and records are write-once.
• Continuous measurement. Certifications carry a re-certification cycle, and material changes to a system trigger reassessment, which suits the AI RMF's view of risk management as ongoing work.
• Pipeline integration. The platform runs through a documented REST API with Python and Node.js samples, so evaluations can run inside a CI/CD pipeline rather than once a year.

RateAI's Pro and Enterprise tiers include compliance mapping to the EU AI Act, NIST AI RMF and ISO 42001, and certification artifacts are designed as defensible evidence in regulatory reviews. To be precise about the limits: a RateAI certification does not make a product compliant with any law or standard, and formal regulatory determinations remain with the relevant authorities. What it adds is measured evidence of how the product behaves, which is the piece the process standards ask you to produce but do not produce for you.

A practical way to use the standards together

For a company building or deploying customer-facing AI, a workable sequence looks like this:

1. Adopt the AI RMF as your shared language. Use Govern and Map to decide who owns AI risk and to write down each system's context and foreseeable misuse. If you ship generative AI, work through the twelve risks in NIST AI 600-1.
2. Build the management system. If customers or regulators expect auditable assurance, implement ISO/IEC 42001, use ISO/IEC 23894 for risk method and ISO/IEC 42005 for impact assessments. Choose a certification body that operates under ISO/IEC 42006.
3. Check the EU picture. If you provide high-risk AI in the EU, track the harmonised standards as they are cited, starting with EN 18286 for your quality management system.
4. Measure the product. Test each system's actual behaviour, before release and after every material change, with adversarial and red-team testing that the Texas statute and the NIST profile both name.
5. Keep the evidence. Retain test records in a form you could hand to a buyer, an insurer or a regulator, with versions and dates that line up with your management system records.

Questions procurement teams ask about AI standards

If you buy AI, the standards give you better questions to ask a vendor:

• Which framework do you use to manage AI risk, and which version? If the answer is the NIST AI RMF, ask how they will handle the revision NIST says is in progress.
• Do you hold an ISO/IEC 42001 certificate? Which body issued it, is that body accredited, and what is the scope?
• For generative AI products, how do you address each of the twelve NIST AI 600-1 risks, and what testing evidence supports that?
• Has this specific product been tested by someone other than you, and can you show the results?

The last question is the one the standards cannot answer on the vendor's behalf.

Frequently asked questions

Is the NIST AI RMF mandatory?

No. NIST describes it as a guidance document "for voluntary use." Some laws now give it legal weight, though; Texas HB 149, for example, treats substantial compliance with the NIST Generative AI Profile or another recognised framework as part of a defence.

Can a company be certified to the NIST AI RMF?

No. NIST publishes the AI RMF as voluntary guidance, and its framework pages describe no certification scheme. A company can explain how it aligns with the framework, but that is a self-description rather than a certificate.

Who certifies ISO/IEC 42001?

Independent certification bodies, which may be accredited by national accreditation bodies. ISO itself does not certify organisations, and ISO/IEC 42006 sets the extra requirements those bodies must meet.

Does ISO/IEC 42001 certification mean an AI product is safe?

Not by itself. ISO/IEC 42001 certifies an organisation's AI management system, meaning its policies, processes and controls, rather than the measured behaviour of any single AI product.

What is the difference between NIST AI 600-1 and the AI RMF?

The AI RMF is the general framework for all AI systems. NIST AI 600-1, published in July 2024, is a companion profile that applies the framework to generative AI and lists twelve risks such as confabulation, data privacy and information security.

Does A.E.G.I.S.™ replace NIST AI RMF or ISO/IEC 42001?

No. A.E.G.I.S.™ tests how a specific AI product behaves across seven pillars, while the NIST AI RMF and ISO/IEC 42001 govern organisational processes. RateAI's Pro and Enterprise tiers include compliance mapping to both frameworks, and formal regulatory determinations remain with the relevant authorities.

Turn your standards work into product evidence

If your team is aligning with the NIST AI RMF or working toward ISO/IEC 42001 and needs measured evidence of how your AI products actually behave, talk to RateAI about an A.E.G.I.S.™ evaluation.