AI governance sounds like a big-company problem until the first enterprise customer asks for your AI risk documentation, or the first cyber insurance renewal includes an AI questionnaire. Then it’s your problem, and two framework names come up immediately: NIST’s AI Risk Management Framework and ISO/IEC 42001. They’re different tools for different jobs, and choosing wrong wastes a year. Here’s the short version.
NIST AI RMF: the method
The NIST AI RMF is voluntary guidance from the US standards agency, organized around four functions: Govern, Map, Measure, Manage. In practice: someone accountable for AI decisions (Govern), a clear picture of what AI systems you run and what could go wrong (Map), ways to measure whether they’re behaving (Measure), and processes to respond when they aren’t (Manage).
It costs nothing, requires no auditor, and gives you a structured way to think about AI risk that fits any size of company. What it doesn’t give you is a certificate. Nobody can be “compliant with NIST AI RMF” in a way a customer can verify with a checkbox.
ISO/IEC 42001: the certificate
ISO/IEC 42001:2023, titled in full “Information technology, Artificial intelligence, Management system,” is the certifiable version of the same discipline. It’s built on the same Harmonized Structure as ISO 27001, the information security standard, so if you already run an ISMS, an AI management system slots alongside it: an AI policy, AI risk assessment plus a separate impact assessment for AI systems, a set of controls, internal audit, and management review. Certification runs on a three-year cycle through accredited bodies, and it increasingly shows up in financial-sector and enterprise procurement, the same way SOC 2 did for software.
A certificate is worth money in deals. It’s also real work: expect months of documentation and an external audit, and budget accordingly.
The answer for most small businesses
Use both, in layers, and NIST publishes an official crosswalk between them so you’re not inventing the mapping yourself. Their document ties the RMF’s functions to ISO 42001’s clauses directly, for example mapping the RMF’s “Govern 2.1” outcome on roles and responsibilities to the standard’s clause 5.3 on the same subject.
The practical stack:
- Run NIST AI RMF as your method. Inventory your AI, assign ownership, write a one-page risk appetite for what AI may and may not do autonomously. This is an afternoon with the right template, and it’s the part that actually reduces risk.
- Adopt ISO 42001 only when a customer or regulator asks. The framework work above becomes the raw material, which cuts the certification project roughly in half.
- Feed both into third-party risk. Regulators already expect AI vendors to be assessed like any other critical supplier, and the framework mapping is what you demand from vendors rather than what you build for yourself.
The honest caveat
A framework doesn’t secure anything. A company with a shelf full of certificates and over-privileged AI agents is less safe than a company with a documented agent inventory, a permission map, and no certificates at all. Frameworks make the discipline visible and inspectable; the controls still have to exist underneath.
We help small businesses build the method first and add certification only when a deal requires it. If you’ve been asked for AI risk documentation and don’t know where to start, the start is smaller than you think.