Customer security questionnaires now carry an AI section, and three references keep coming back: the EU AI Act, ISO/IEC 42001 and the NIST AI Risk Management Framework. All three deal with the governance of artificial intelligence, but they are objects of a different kind. The first is a European regulation; complying with it is mandatory. The second is an international standard an organisation can be certified against. The third is a voluntary framework, published free of charge, with no audit mechanism. Confusing them leads to inaccurate questionnaire answers and to programmes sized against the wrong target. This article describes what each one requires and produces, then how an SME can combine them.
The AI Act: legal obligations, not a reference framework
Regulation (EU) 2024/1689 is not something you opt into: it applies to any organisation that provides or deploys AI systems on the European market, with obligations graded by risk level (prohibited practices, high risk, transparency, minimal risk). The prohibited practices and the AI literacy obligation (Article 4) have applied since February 2025, the obligations on providers of general-purpose AI models and the penalty regime since August 2025, and the Article 50 transparency obligations since 2 August 2026. The obligations on Annex III high-risk systems were postponed to 2 December 2027 by Regulation (EU) 2026/1744. The timeline and the postponements are covered in a dedicated article.
What the AI Act does not provide is a method. The regulation states outcome requirements (a risk management system, data governance, technical documentation, human oversight for high-risk systems) without describing how to implement them. That is the role of the harmonised standards being drafted at CEN-CENELEC (technical committee JTC 21), none of which is cited in the Official Journal of the European Union as of September 2026. Until then, organisations rely on the Commission's guidance documents and on existing reference frameworks, including the two below.
ISO/IEC 42001: the certifiable standard
ISO/IEC 42001, published in December 2023, specifies the requirements of an AI management system (AIMS). The logic is that of ISO 27001 applied to AI: a policy and roles set by management, an assessment of the risks and impacts of AI systems, a statement of applicability covering the Annex A controls (system life cycle, data, information for interested parties, responsible use), internal audit, management review and continual improvement. The standard follows the harmonised structure of management system standards, so the AIMS can be integrated into an existing ISO 27001 ISMS rather than built as a parallel system: the same governance mechanisms, with the scope and the risk assessment extended to AI.
Accredited certification is recent. ISO/IEC 42006:2025, the standard that sets the requirements for certification bodies, was published in 2025, and the first accreditations based on it date from early 2026 (UKAS, the UK accreditation body, issued its first in January 2026; the American ANAB and the Dutch RvA also cover the standard). A certificate issued by a non-accredited body does not carry the same weight; the question to put to a certification body is whether it is accredited under ISO/IEC 42006. The cycle is the usual one for management system standards: a two-stage initial audit, a three-year certificate, annual surveillance.
One limitation deserves a precise statement, because it is often misunderstood: ISO 42001 does not equal AI Act compliance. CEN-CENELEC did not retain the standard as the harmonised standard for the quality management system required of high-risk system providers (Article 17) and is drafting a separate European text, draft prEN 18286. A certified AIMS covers part of the work the regulation asks for (governance, risk management, documentation) but triggers no presumption of conformity within the meaning of Article 40.
NIST AI RMF: the voluntary framework
The NIST AI Risk Management Framework (version 1.0, January 2023) is a framework published by NIST, free of charge and voluntary in application. There is no AI RMF certification and no AI RMF audit: the framework structures the internal management of AI-related risks. It is organised in four functions: GOVERN (policy, roles, risk culture), MAP (inventory the systems and their context), MEASURE (assess the identified risks) and MANAGE (treat and monitor them). NIST supplements it with sector or topic profiles: the generative AI profile NIST AI 600-1 (July 2024) describes twelve risks specific to generative AI and the associated actions, and a profile for critical infrastructure has been in preparation since April 2026.
For an organisation already working with the NIST CSF 2.0, the family resemblance is direct: same publisher, same logic of functions and expected outcomes, and a GOVERN function common in spirit. The AI RMF plays for AI risks the role the CSF plays for cyber risks: an assessment language, not an obligation and not a certificate.
Direct comparison
| Criterion | AI Act | ISO/IEC 42001 | NIST AI RMF |
|---|---|---|---|
| Nature | Binding European regulation | Certifiable international standard | Voluntary framework |
| Who requires it | The law, for any provider or deployer in scope | Customers or contracting parties, contractually | Nobody; internal use |
| Deliverable | Compliance (documentation, marking, registration as applicable) | Three-year certificate, annual surveillance | None; self-assessment |
| Verification | Market surveillance authorities, Article 99 penalties | Body accredited under ISO/IEC 42006 | None |
| Cost of the text | Free (EUR-Lex) | Paid standard, paid audit | Free |
| Relation to the other two | Sets the obligations | Structures the management system, no AI Act presumption of conformity | Structures the risk analysis |
How an SME combines them
The order of work follows from the nature of each framework. The AI Act first, because it is not optional: inventory the AI uses (built and bought), classify them against the regulation's categories and cover the obligations already in force, starting with Article 50 transparency and Article 4 awareness. The NIST AI RMF next, as a working method: its MAP and MEASURE functions give that inventory and risk assessment a structure, at no entry cost. ISO 42001 last, when the demand exists: certification makes sense when customers require it or when the organisation itself provides AI systems, and it reuses the mechanisms of an ISO 27001 ISMS where one is in place.
What the three have in common is that they rest on a risk governance most SMEs have already started building for cybersecurity. A poorly controlled AI use is a risk like any other: it belongs in the existing risk register, it falls under the GV.OC (organisational context and regulatory obligations) and GV.RM (risk management strategy) categories of the NIST CSF 2.0, and it is handled with the same follow-up mechanisms. Building an isolated AI governance, with its own register and its own committee, duplicates the work without improving the outcome.
The Komplyo assessment measures the maturity of the GOVERN function, including these categories, and the generated risk register takes in AI-related scenarios alongside the others. The free diagnostic (23 questions, about 5 minutes) gives a first reading of the GOVERN function.