The EU AI Act, the NIST AI Risk Management Framework and ISO/IEC 42001 are usually summed up as the law, the framework and the standard. That tells you what each one is, and it doesn't tell you what to do with the three of them, which is where the work is.
The labels match the sources. The European Commission calls the Act "the first-ever comprehensive legal framework on AI worldwide", with "risk-based rules for AI developers and deployers regarding specific uses of AI". NIST says its framework "is intended for voluntary use", and that its core is four functions, "govern, map, measure, and manage". UKAS describes ISO/IEC 42001 as "the world's first management system standard for artificial intelligence", and in January it granted BSI the first accreditation to certify organisations against it.
I'm currently drafting an AI blueprint for a client, and the first decision in it is not whether to adopt the three. It is what job each published framework does, and what each one is not. For a UK public body the principles start with the AI Playbook for the UK Government; EU law is a later question, not the starting point. An organisation in another sector starts from whatever its regulator or its board has already set, and then faces the same choice.
Risk management is the job for NIST's four functions, run inside the corporate risk process the organisation already has. The alternative is a separate AI risk register beside the corporate one, which gives the board two lists and no single view of its risk. Its own page says AI RMF 1.0 "is being revised as part of the White House AI Action Plan", so I build around the four functions, which I expect to outlast the revision, rather than around the document.
ISO/IEC 42001 is the reference for the management system as a whole, the governance and the processes around it. It is not a maturity model, and I'm careful not to use it as one: it describes a system to run, not a scale to score yourself against.
Every candidate standard gets one of three verdicts, adopt, adapt or not adopt, with the reason and with what adopting it would ask of the organisation. That last part is the one that rarely gets written down.
Adopting ISO/IEC 42001 means building and running a management system for AI, and keeping it running after the consultants have gone; the certificate, if you want one, means being certified against it by an accredited body. Adopting the NIST functions means changing a risk process that people already use.
The Act is a different kind of decision. Whether it applies to a given organisation is a legal question, settled before anything is adopted or ruled out, not assumed either way.
The rest of the blueprint follows from the verdicts. It extends the AI policy the organisation already has rather than adding a second policy beside it. It is proportionate by risk: low-risk productivity use carries on under standing guidance, and anything that touches a decision with public effect, an outside party or personal data goes through formal assessment and leaves a record. The Commission's page takes the same line on the Act, which "does not introduce rules for AI that is deemed minimal or no risk". And it uses only published frameworks, no proprietary model, so the organisation can inspect, check and re-run every part of it without me.
The question left once the frameworks are chosen is which AI-assisted outputs are records: how provenance is shown in a formal document, and what is kept of the prompts and outputs behind it. It's a question about the organisation, how it keeps formal documents and what it has to be able to show later, not about any of the frameworks, and it usually comes up for the first time when a decision is challenged and the organisation has to show how the document behind it was produced.
Sources
- European Commission, AI Act (the quoted lines: the legal framework, risk-based rules for developers and deployers, and no rules for minimal or no risk).
- NIST, AI Risk Management Framework (intended for voluntary use; AI RMF 1.0 being revised) and AI RMF Core (the four functions).
- UKAS, UKAS grants first accreditation for artificial intelligence management systems, 15 January 2026 (the description of ISO/IEC 42001 and the first accreditation, to BSI).
- The blueprint, and the way it gives each framework one job, are my own work in progress; no client is named.
- Government Digital Service, AI Playbook for the UK Government, GOV.UK (named as the starting point for a UK public body; title checked 16 Oct).