# ISO 42001 vs NIST AI RMF vs EU AI Act (and US Rules) The EU AI Act is law. ISO/IEC 42001 is a management system standard. The NIST AI RMF is a voluntary framework. Here is how they differ, how they fit together, and what changed in US rules in 2026. Updated 2026-10-29. Also on the [web page](https://aigovernancetools.fyi/guides/iso-42001-vs-nist-ai-rmf-vs-eu-ai-act). Buyers often hear three names together: the EU AI Act, ISO/IEC 42001 and the NIST AI RMF. They are different kinds of things. This guide compares them, then covers the US rules that changed in 2026. This guide is general information. It is not legal advice. ## The three at a glance | | EU AI Act | ISO/IEC 42001 | NIST AI RMF | | --- | --- | --- | --- | | What it is | EU regulation (law) | International management system standard | Voluntary US framework | | Issued by | European Union | ISO and IEC | NIST | | Date | Entered into force 1 August 2024; amended by Regulation (EU) 2026/1744 | Published December 2023, edition 1 | Released 26 January 2023 | | Binding? | Yes, with fines | No, unless a contract requires it | No | | Focus | Duties per role and risk tier | A management system for AI | Risk management activities | | Structure | Prohibitions, high-risk rules, transparency, GPAI rules | Plan-Do-Check-Act management system | Four functions: govern, map, measure, manage | Sources: [implementation timeline](https://artificialintelligenceact.eu/implementation-timeline/), [ISO](https://www.iso.org/standard/42001), [NIST](https://www.nist.gov/itl/ai-risk-management-framework), [NIST AIRC](https://airc.nist.gov/airmf-resources/airmf/5-sec-core/). ## EU AI Act The AI Act sets legal duties. They depend on your role (provider or deployer) and the risk tier of the system. Prohibited practices have applied since 2 February 2025. Transparency duties under Article 50 have applied since 2 August 2026. After the Digital Omnibus on AI, Annex III high-risk duties apply from 2 December 2027 and Annex I duties from 2 August 2028 ([Article 113](https://artificialintelligenceact.eu/article/113/)). Fines reach EUR 35 million or 7% of worldwide annual turnover for prohibited practices ([Article 99](https://artificialintelligenceact.eu/article/99/)). See [EU AI Act deadlines](/guides/eu-ai-act-deadlines-what-buyers-need-to-know). ## ISO/IEC 42001 ISO/IEC 42001 specifies requirements for an AI management system (AIMS). The system covers policies, objectives and processes for responsible AI. It applies to organizations of any size that develop, provide or use AI. It does not look at the details of single AI applications. It manages AI risk across the organization ([ISO](https://www.iso.org/standard/42001)). ISO lists the standard as "to be revised". Check for a new edition before you plan a long certification project. ## NIST AI RMF The NIST AI RMF helps organizations manage AI risk. Its Core has four functions. Govern is cross-cutting. Map, measure and manage follow it ([NIST AIRC](https://airc.nist.gov/airmf-resources/airmf/5-sec-core/)). NIST published a Generative AI Profile, NIST AI 600-1, on 26 July 2024. NIST also says AI RMF 1.0 is being revised ([NIST](https://www.nist.gov/itl/ai-risk-management-framework)). ## How they fit together Many companies use all three: 1. **ISO/IEC 42001** as the management system: roles, policies, reviews, improvement. 2. **NIST AI RMF** as the risk method inside it: how to map, measure and manage each system. 3. **EU AI Act** as the legal floor for systems that touch the EU. A governance platform should map one control to all three. Then one piece of evidence serves several frameworks. Ask vendors to show this. See [questions to ask AI governance vendors](/guides/questions-to-ask-ai-governance-vendors). ## US rules that changed in 2026 **Bank model risk: SR 11-7 is replaced.** On 17 April 2026 the Federal Reserve issued SR 26-2, "Revised Guidance on Model Risk Management". It supersedes SR 11-7 and SR 21-8 ([Federal Reserve](https://www.federalreserve.gov/supervisionreg/srletters/SR2602.htm)). The OCC issued Bulletin 2026-13 with the same guidance. Key points ([OCC](https://www.occ.gov/news-issuances/bulletins/2026/bulletin-2026-13.html)): - It is expected to be most relevant to banks with over $30 billion in total assets. - Generative AI and agentic AI models are not within its scope. - It sets no enforceable standards. Non-compliance alone will not result in supervisory criticism. - The agencies plan a request for information on model risk, including generative and agentic AI. **Colorado: SB24-205 is replaced.** SB24-205 first set duties from 1 February 2026 ([Colorado General Assembly](https://leg.colorado.gov/bills/sb24-205)). SB25B-004 extended that date to 30 June 2026 ([Colorado General Assembly](https://leg.colorado.gov/bills/SB25B-004)). Then SB26-189 repealed and reenacted the provisions. The Governor signed it on 14 May 2026 ([Colorado General Assembly](https://leg.colorado.gov/bills/sb26-189)). Under SB26-189: - It regulates automated decision-making technology (ADMT) used in consequential decisions. - Developer documentation duties start on 1 January 2027. - Developers and deployers keep compliance records for at least 3 years. - After an adverse decision, the deployer gives a plain-language description within 30 days. - Consumers can ask for meaningful human review. - Before 1 January 2030, the attorney general must give 60 days' notice and a chance to cure, where a cure is possible. **New York City: Local Law 144.** Employers may use an automated employment decision tool only after a bias audit within one year of use. They must publish the audit summary and give notices. Enforcement began on 5 July 2023 ([NYC DCWP](https://www.nyc.gov/site/dca/about/automated-employment-decision-tools.page)). ## Sources - [Implementation Timeline](https://artificialintelligenceact.eu/implementation-timeline/), [Article 99](https://artificialintelligenceact.eu/article/99/) and [Article 113](https://artificialintelligenceact.eu/article/113/), artificialintelligenceact.eu, accessed 2026-10-29 - [ISO/IEC 42001:2023](https://www.iso.org/standard/42001), International Organization for Standardization, accessed 2026-10-29 - [AI Risk Management Framework](https://www.nist.gov/itl/ai-risk-management-framework), NIST, accessed 2026-10-29 - [AI RMF Core](https://airc.nist.gov/airmf-resources/airmf/5-sec-core/), NIST Trustworthy and Responsible AI Resource Center, accessed 2026-10-29 - [SR 26-2: Revised Guidance on Model Risk Management](https://www.federalreserve.gov/supervisionreg/srletters/SR2602.htm), Federal Reserve Board, 17 April 2026, accessed 2026-10-29 - [OCC Bulletin 2026-13: Model Risk Management: Revised Guidance](https://www.occ.gov/news-issuances/bulletins/2026/bulletin-2026-13.html), Office of the Comptroller of the Currency, accessed 2026-10-29 - [SB24-205](https://leg.colorado.gov/bills/sb24-205), [SB25B-004](https://leg.colorado.gov/bills/SB25B-004) and [SB26-189](https://leg.colorado.gov/bills/sb26-189), Colorado General Assembly, accessed 2026-10-29 - [Automated Employment Decision Tools (AEDT)](https://www.nyc.gov/site/dca/about/automated-employment-decision-tools.page), NYC Department of Consumer and Worker Protection, accessed 2026-10-29 ## Questions ### If we implement ISO/IEC 42001, are we compliant with the EU AI Act? Not by itself. ISO/IEC 42001 gives you a management system for AI. The AI Act has specific legal duties per role and risk tier. A good AIMS makes those duties easier to meet and to prove. ### Is the NIST AI RMF required in the US? No. NIST says it is intended for voluntary use. Some customers and sector rules point to it, so many companies use it as their internal risk method. ### Does SR 11-7 still apply to banks? No. On 17 April 2026 the Federal Reserve, OCC and FDIC issued revised guidance that supersedes SR 11-7. The Federal Reserve letter is SR 26-2. It does not cover generative AI or agentic AI. ### Is the Colorado AI Act in effect? Colorado replaced it. SB25B-004 had moved the SB24-205 start date to 30 June 2026. Then SB26-189, signed on 14 May 2026, repealed and reenacted those provisions. Its main duties start on 1 January 2027.