NIST AI RMF, ISO standards and other frameworks
NIST AI Risk Management Framework 1.0 (January 2023)
Voluntary, sector-agnostic, and widely referenced in US policy and state laws. Colorado's 2024 AI Act made alignment with it part of an affirmative defense; Colorado replaced that law in 2026 before it took effect, but exam questions may still mention it.
| Function | What happens | Example activities |
|---|---|---|
| Govern | Culture, policies, accountability; cross-cutting, informs all others | Roles and responsibilities, risk tolerance, third-party policies, workforce diversity |
| Map | Establish context and identify risks | Intended purpose, users, affected people, legal requirements, potential impacts |
| Measure | Analyze, assess, benchmark and track risks | Metrics, testing for bias and robustness, independent review |
| Manage | Prioritize and act on risks | Treat, transfer, avoid or accept; incident response; decommissioning |
Supporting material: the AI RMF Playbook (suggested actions per subcategory), profiles for specific uses, and the Generative AI Profile (NIST AI 600-1, July 2024), which lists 12 risks unique to or worsened by generative AI, such as confabulation, information integrity and harmful bias.
ISO/IEC standards
| Standard | What it is |
|---|---|
| ISO/IEC 42001:2023 | AI management system (AIMS). Certifiable by third parties. Plan-Do-Check-Act; Annex A controls; requires AI risk and system impact assessment |
| ISO/IEC 23894:2023 | Guidance on AI risk management, adapting ISO 31000 |
| ISO/IEC 22989:2022 | AI concepts and terminology |
| ISO/IEC 38507:2022 | Governance implications of AI for boards |
| ISO/IEC 42005 | AI system impact assessment guidance |
Remember: 42001 certifies an organization's management system, not a specific AI product.
Other frameworks
- OECD AI Principles: the international baseline and source of the AI definition.
- Council of Europe Framework Convention on AI (2024): the first legally binding international AI treaty, on human rights, democracy and rule of law.
- G7 Hiroshima Process: guiding principles and code of conduct for advanced AI developers.
- UNESCO Recommendation on the Ethics of AI (2021).
- Singapore Model AI Governance Framework and the AI Verify testing toolkit.
- IEEE 7000 series: ethics in system design.
How they fit together
Laws say what is required. Frameworks and standards describe how to run a program that meets it. An organization might build its program on NIST AI RMF, certify it under ISO/IEC 42001, and map both to EU AI Act obligations.
Check your understanding
Choosing to avoid, mitigate, transfer or accept an identified AI risk falls under which NIST function?
What does ISO/IEC 42001 certification attest to?