Executive briefing: AI standards
ISO 42001 vs ISO 27001 vs NIST AI RMF: Which AI Standard Should You Adopt?
ISO 42001 vs ISO 27001 vs NIST AI RMF: each does a different job. ISO/IEC 42001 is the certifiable standard for AI management. ISO/IEC 27001 covers information security, not AI risks such as bias. The NIST AI RMF is voluntary, with no certificate. A common route: build on 27001, adopt 42001, use NIST as the risk method.
Correct as of 28 September 2026. Regulation and guidance change. If you are reading this later, check for updates before relying on it.
Read the full briefingIn brief
- ISO/IEC 42001:2023 is the international standard for an AI management system. Organisations can be certified against it by an independent certification body.
- ISO/IEC 27001:2022 governs information security. It protects the data AI uses, but it is not designed for AI-specific risks such as bias, transparency or impact on people.
- The NIST AI RMF is voluntary guidance built on four functions: Govern, Map, Measure and Manage. There is no NIST certificate.
- None of them is the law. The EU AI Act is. A well-run AI management system supports compliance but does not by itself make you compliant.
- If you hold ISO 27001, extending to ISO 42001 reuses the same management system structure. If you hold nothing, start with the basics before any standard.
Why the board should care
Buyers are asking
When a customer, tender or investor asks how you govern AI, a recognised standard gives a recognisable answer. A policy on file does not.
The wrong standard wastes a year
Certifying to a standard nobody asked for, or booking an audit before the organisation is ready, spends budget and credibility without reducing the risk that matters.
A standard is not compliance
Boards that treat a certificate as proof of legal compliance can be caught out. Standards support the law; they do not replace it.
Full briefing
Read the full briefing
Free for executives. Confirm your work email once and every AIPEX executive briefing opens for 12 months.
- The full written briefing
Next step
Know where you stand before you choose
The AI Readiness Assessment (£999 + VAT, one payment) scores 30 areas, including governance and risk, and ends with a 60-minute debrief with a senior partner. Prefer to talk first? A free 30-minute scoping call with a senior partner.
FAQ
Frequently asked questions
What is the difference between ISO 42001 and ISO 27001?
ISO/IEC 42001 is the standard for an AI management system: how AI is governed, risk-assessed and controlled across its lifecycle. ISO/IEC 27001 is the standard for information security. 27001 protects the data AI uses; 42001 covers AI-specific risks such as fitness for purpose, bias and impact on people.
Is ISO 42001 a certification?
ISO/IEC 42001 is a requirements standard that organisations can be certified against. ISO itself does not certify. Certification is carried out by independent certification bodies, and ISO/IEC 42006:2025 sets the requirements for bodies that audit and certify AI management systems.
Is ISO 42001 mandatory?
No. ISO/IEC 42001 is voluntary. It may become a practical expectation where customers, tenders or investors ask for evidence that AI is governed. Laws such as the EU AI Act are mandatory where they apply, and a management system helps evidence compliance without replacing it.
What is the difference between ISO 42001 and the NIST AI RMF?
ISO/IEC 42001 is an international requirements standard that can be certified. The NIST AI RMF is a voluntary US framework, built on four functions (Govern, Map, Measure and Manage), with no certificate. Many organisations use NIST as the risk method inside a 42001 management system.
Do we need ISO 42001 if we already have ISO 27001?
If you use AI in ways that affect customers, staff or decisions, 27001 alone leaves gaps: it is not designed for AI risks such as bias or impact on people. Because both share ISO's management system structure, extending 27001 to 42001 is less work than starting from scratch.
Does ISO 42001 make us compliant with the EU AI Act?
Not on its own. The EU AI Act is law and ISO/IEC 42001 is a voluntary standard. A working AI management system provides much of the structure, evidence and oversight the Act expects, but compliance depends on the specific systems you use or supply and your role for each.
Is ISO 42001 worth it?
It is worth certifying when customers, tenders or investors ask for independent evidence that AI is governed. Where nobody is asking yet, aligning to the standard without certifying still gives the board a working management system, which is where most of the value lies.
Does AIPEX certify ISO 42001?
No. AIPEX is not a certification body. We assess readiness for ISO/IEC 42001 and help build the AI management system. Certification is carried out by independent certification bodies, ideally accredited by a national accreditation body.
Correct as of 28 September 2026. This content reflects the law, official guidance and deadlines as published on that date. The EU AI Act and its guidance, standards and deadlines are still being amended and clarified. If you are reading this after 28 September 2026, check for later amendments, European Commission guidance and harmonised standards before relying on it. It is general information, not legal advice, and AIPEX accepts no liability for decisions taken on it without specific professional advice.
This briefing summarises ISO/IEC 42001, ISO/IEC 27001 and the NIST AI RMF in our own words, correct at the date last reviewed. It is governance guidance, not legal advice. AIPEX is not a certification body and does not certify organisations; certification is carried out by independent certification bodies.