Frameworks explained: NIST AI RMF, ISO 42001 and the EU AI Act

Three names come up again and again when people talk about using AI responsibly: the NIST AI RMF, ISO 42001 and the EU AI Act. This lesson explains what each one is, who it applies to, and which parts a small organization should use or keep an eye on. The short version is that one is a free guide you can borrow from today, one is a certificate you only need if someone asks for it, and one is a law that may apply to you if you work with people in the European Union.

You do not need to become an expert in any of them. You need to know enough to answer a funder’s question, read a vendor’s trust page, and organize your own AI work in a sensible way.

The idea: a guide, a certificate and a law

These three things are often mentioned together, but they are different kinds of things. Mixing them up is the most common source of confusion.

Name	What kind of thing it is	Who it applies to	Cost to use
NIST AI RMF	A voluntary framework (a guide)	Anyone who wants to use it	Free
ISO/IEC 42001	An international standard you can be certified against	Organizations that choose to seek certification	Certification needs an outside audit, which takes time and money
EU AI Act	Binding law	Those covered by EU law, depending on how they use AI	Compliance work varies by risk level

NIST AI Risk Management Framework

The NIST AI Risk Management Framework, usually shortened to AI RMF, comes from the US National Institute of Standards and Technology. Version 1.0 was released on January 26, 2023, and it is meant for voluntary use. Nobody can fine you for ignoring it.

Its goal is to help organizations build trustworthiness into how AI is designed, built, used and checked. It asks you to think about risks to individuals, to your organization and to society as a whole.

The heart of the framework is four functions. In plain terms:

• Govern: who decides, what the rules are, and who is responsible.
• Map: where AI is used in your work and what could go wrong in each place.
• Measure: how you check whether things are actually going well.
• Manage: what you do about the risks you found, and how you respond when something goes wrong.

In July 2024, NIST added a Generative AI Profile (NIST-AI-600-1), which applies the framework to tools like chatbots and image makers. NIST has also said that AI RMF 1.0 is being revised, so expect an updated version at some point. The framework is free to read and use.

ISO/IEC 42001

ISO/IEC 42001:2023, titled “AI management systems,” is an international standard from two standards bodies, ISO and IEC. In everyday language, a management system is the written rules, roles and routines an organization uses to run one area of its work in an orderly, checkable way.

The key fact for you: organizations can be certified against this standard. Several AI vendors list ISO/IEC 42001 certification on their own trust or compliance pages. So you are most likely to meet this name in two places: on a vendor’s website, or in a question from a large funder or partner.

EU AI Act

The EU AI Act, formally Regulation (EU) 2024/1689, is binding law in the European Union. It takes a risk-based approach: the more harm an AI use could cause, the stricter the rules.

Risk level	What it means	Examples
Unacceptable risk	Banned practices	Uses the law forbids outright
High risk	Strict obligations	AI used in employment, education, essential services and biometrics
Transparency risk	Duty to tell people	Telling people they are talking to a chatbot, labeling deepfakes
Minimal or no risk	No new rules	Most systems, such as spam filters

The law is coming into effect in stages. According to the European Commission:

• It entered into force on August 1, 2024.
• Bans and AI literacy obligations applied from February 2, 2025.
• Rules for general-purpose AI models applied from August 2, 2025.
• General application, including the transparency rules, starts August 2, 2026.
• High-risk rules for the areas listed in Annex III apply from December 2, 2027.
• High-risk rules for AI in regulated products (Annex I) apply from August 2, 2028.

For a fuller walk through these dates, see the EU AI Act timeline for small organizations.

A worked example from a small organization

Here is an illustration, not a real case. Picture a regional arts organization with a small staff. Over the past year it has put three things in place: an approved tools list, a short AI use policy, and a quarterly review where the director and office manager talk through how AI is being used.

The office manager decides to test this setup against the NIST AI RMF. She writes the four functions on a page and sorts what they already do under each:

• Govern: the AI use policy and the named people who approve new tools. This is covered.
• Map: the approved tools list, which shows which tools are used for grant writing, social media and newsletters. Mostly covered.
• Measure: nothing. Nobody checks whether the text the AI tools produce is accurate before it goes out.
• Manage: the quarterly review, where problems are discussed and the tools list is updated. Covered, though informal.

The gap jumps out. Staff use an AI tool to draft grant reports, but no step checks those drafts for wrong figures or made-up details. The fix is small: one person compares every AI-made draft against the original records before it is sent, and the quarterly review notes any errors found.

They did not adopt a new system or buy anything. They used a free framework as a checklist and found a real weakness in an afternoon.

Steps to take

These are practical pointers, not legal advice. If you think the EU AI Act may apply to you in a serious way, talk to someone qualified to advise on it.

1. Use the NIST AI RMF as your organizing tool. Sort your existing AI rules and habits under Govern, Map, Measure and Manage. It costs nothing and gives you a shared language with funders, boards and IT support. Our guide to how an AI governance framework works shows how these pieces fit together.
2. Treat ISO/IEC 42001 as a response to a request, not a goal. Consider certification only if a funder or partner asks for it. Certification means an outside audit, and that takes staff time and money that most small organizations should spend elsewhere first.
3. Read vendor certification claims as one signal among several. If a vendor lists ISO/IEC 42001 certification on its trust page, note it. It does not replace your own checks on what the tool does with your data.
4. Check your EU exposure. If you work in the EU, or offer AI-powered services to people there, find out whether the transparency rules apply to you. For example, if your website has a chatbot that people in the EU use, they may need to be told they are talking to a machine.
5. Make sure staff who use AI have basic AI literacy. This is good practice everywhere and is part of the EU AI Act’s obligations. A short session on what AI tools can get wrong and how to check their output is a reasonable start.
6. Set a reminder to look again. NIST is revising its framework and the EU AI Act still has dates ahead. A yearly check is enough for most small organizations.

Common mistakes

Thinking you must “comply” with NIST. The AI RMF is voluntary. Use the parts that help and skip the rest. You will not fail an inspection for not using it.

Chasing a certificate nobody asked for. ISO/IEC 42001 certification can sound like a badge of seriousness. For a small organization, a clear policy, an approved tools list and a regular review usually matter far more, unless a funder or partner specifically requires certification.

Assuming the EU AI Act is only for tech companies. The law looks at how AI is used, not only who built it. An organization offering an AI-powered service to people in the EU may have transparency duties.

Assuming the EU AI Act has nothing to do with you because you are small. Size alone does not decide whether the law applies. What matters is where you operate, who you serve and how you use AI.

Treating a vendor’s certificate as proof the tool is safe for your use. A certificate tells you something about how the vendor runs its own processes. It does not tell you whether the tool fits your data, your clients or your policy.

Skipping the Measure step. Many organizations write rules and keep tool lists but never check results. As the example above shows, this is often where the real risk sits.

Try it this week

Set a timer for 15 minutes.

1. Write four headings on a page: Govern, Map, Measure, Manage.
2. Under each heading, write one thing your organization already does. For example, under Govern you might write “the director approves new AI tools.”
3. Under each heading, write one gap. For example, under Measure you might write “no one checks AI drafts for errors.”
4. Circle the gap that worries you most and pick one small fix you can try this month.

Keep the page. It is the start of your own AI governance record, and it gives you a clear answer if a board member or funder asks how you manage AI risk. For more on the term, see AI governance.

Key takeaways

• The NIST AI RMF is a free, voluntary guide whose four functions (Govern, Map, Measure, Manage) give you a simple way to organize your AI risk work.
• ISO/IEC 42001 is an international standard you can be certified against, and certification is worth considering only if funders or partners ask for it.
• The EU AI Act is binding law with four risk levels, and its transparency rules and general application start on August 2, 2026.
• If you work in the EU or serve people there, check whether the transparency rules apply to you and make sure staff using AI have basic AI literacy.
• A vendor’s certificate is one useful signal, not a substitute for your own checks.