NIST AI RMF vs ISO 42001
Compare NIST’s voluntary AI risk framework with ISO/IEC 42001’s certifiable management system and the delivery evidence both help organise.
ISO/IEC 42001 is a certifiable management system for AI. The NIST AI Risk Management Framework is voluntary and organised around four functions (govern, map, measure and manage), with a generative AI profile alongside it. Neither is law, and many organisations use NIST to structure the work and 42001 to certify how it is run. Tenhaw is not certified to ISO/IEC 42001; that is under assessment. This is not legal advice.
30 minutes with James · how this would work in your organisation
The basis for this approach
This is our function-level comparison, using the framework descriptions already published on Tenhaw’s industrial and energy page. Certification and independent auditing belong to appropriately qualified bodies. This is delivery guidance, not legal advice. Your legal owner determines the duties and classification for each system.
The demand signal
The existing sector guidance identifies a common failure: a policy and register can drift away from what the running system actually does. The practical starting point is an inventory, evaluation records and an ownership trail produced during delivery.
Bring the reason this is on your agenda to a 30-minute call with James, and we can explore what it would take in your organisation.
Book a 30-minute callWhy it stalls
2 failure modes we keep meeting
The framework becomes a separate document exercise
A well-written policy cannot show which model ran, which examples passed or who approved a change. Connect the control record to the workflow and its owners.
Framework adoption is mistaken for a legal conclusion
Neither framework is law. The legal owner still needs to determine the duties of the organisation and system, including any EU AI Act obligations. This is not legal advice.
If one of these sounds familiar, bring it to a 30-minute call with James and we can explore a way past it.
Book a 30-minute callHow we approach it
3 moves, in order
- 01
Choose around the decision you need to support
NIST supplies a voluntary structure for risk work through govern, map, measure and manage. ISO/IEC 42001 supplies a certifiable AI management system. Confirm what your procurement or assurance process actually asks for.
- 02
Build one connected evidence record
Keep the inventory, named ownership, evaluation results, approvals and review cadence connected to the system. Reuse evidence where it supports the relevant requirement rather than maintaining disconnected copies.
- 03
Keep status and responsibility clear
Tenhaw’s ISO/IEC 42001 status is under assessment, not certified. We design delivery practices and evidence; legal interpretation, certification and independent audit belong with the appropriate qualified owners.
NIST supplies a voluntary structure for risk work through govern, map, measure and manage.
Prefer to talk it through? Ask us on a discovery call →
Sources
Every source below was opened and read before it was attached. Where nothing survived that check, the claim on this page was softened rather than given a plausible-looking link.
Tenhaw, industrial and energy assurance frameworksTenhaw, AI governance and regulatory evidenceNIST AI Risk Management FrameworkTenhaw, security and assuranceISO/IEC 42001 is under assessment; Tenhaw is not certified.ISO, ISO/IEC 42001 AI management systemsThe closest guides to this one
Nearest first, then the rest. Each one carries the same label: written from delivery, or the method we would bring. All 34 are on the hub.
ISO 42001 certification in the UK: what it covers and what it doesn’t
Prepare your AI management evidence.
Our approachWhat should an AI governance framework include?
Keep the AI inventory, accountable decisions and evidence connected.
Our approachHow do we verify an AI agent beyond a vendor demo?
Give your release decision evidence the business can inspect.
Our approachAgent identity and access
Give each workflow the authority it needs, with a way to take it away.
DeliveredWhat does an AI-native software delivery lifecycle look like?
Connect requirements, AI engineering and human release decisions.
DeliveredTarget operating model for an AI-native organisation
Design what agents do, what people decide and how the work improves.
Or bring the problem to a call instead of reading three more of these.
Book a 30-minute callWork out the next step for your team.
A 30-minute call with James Rooney to discuss your workflow, people and budget. Leave with a rough scope and a useful next step.
90-day outcome programme · £120k or £180k fixed · 90 days · excluding VAT
No time that suits? Email hello@tenhaw.com. Calendar not loading? Open it on cal.com.
Describe the work
Describe the work in a paragraph. James replies with a rough scope and budget range within two working days.
Questions this guide answers
Which should we adopt first?
Start with the assurance decision you need to support. NIST offers a voluntary structure for AI risk work; ISO/IEC 42001 is relevant when a certifiable AI management system is required. Build the inventory and operating evidence whichever route you take.
Can we use both?
Yes. The disciplines can share a current inventory, decision ownership, evaluation records and review cadence. Map the records to the relevant functions and requirements without assuming one framework automatically satisfies the other.
Is either mandatory?
Neither is law. Procurement terms and per-system legal obligations are separate questions for the appropriate owners. This is not legal advice.
What evidence overlaps?
The published Tenhaw method starts with an AI inventory, evaluation results retained with their runs and ownership recorded where the work happens. Approval records, change history and review cadence keep the record connected to delivery.
Is Tenhaw certified to ISO 42001?
No. ISO/IEC 42001 is under assessment at Tenhaw. The security page publishes the current assurance position and distinguishes commitments held today from certifications still in progress.