AI governance standards: NIST AI RMF and ISO/IEC 42001 explained

The short version

• AI governance standards are voluntary: an organisation chooses to adopt them to manage the risk of the AI it builds or uses, and they are not law.
• The United States NIST AI Risk Management Framework (AI RMF 1.0) is built on four functions, govern, map, measure and manage, and is “intended to be voluntary”.
• Its Generative AI Profile (NIST AI 600-1) adds twelve generative-AI risks, including “confabulation”, confidently stated but false content, known colloquially as AI hallucination.
• ISO/IEC 42001:2023 is an international standard for an AI management system (AIMS), run on a Plan-Do-Check-Act cycle.
• Adopting a voluntary standard is not the same as complying with binding law: the EU AI Act is “binding in its entirety”, and only a harmonised standard published in the Official Journal creates a presumption of conformity (Article 40).
• For legal and dispute work the standards point the same way: document the system, keep a person able to override it, and verify outputs before anyone relies on them. The binding EU regime is covered in the EU AI Act in dispute resolution and the US state statutes in the Colorado and Texas AI laws.^1,2,3,4

What are AI governance standards?

An AI governance standard is a published, voluntary framework an organisation adopts to manage the risks of the AI it builds or uses. It is not legislation and carries no penalty by itself. AI governance, more broadly, is how an organisation sets the roles, policies and checks around its AI; a standard gives that work a shared shape.^1,3

Three terms are worth defining up front. An AI management system is the set of policies, roles, risk and impact assessment, controls and review an organisation runs around its AI, which is the thing ISO/IEC 42001 describes. A voluntary standard is one an organisation chooses to follow, not one a law imposes. And a framework such as the NIST AI RMF is a catalogue of outcomes to work toward rather than a checklist, while a management-system standard such as ISO/IEC 42001 sets requirements whose management system can, in principle, be assessed for conformity.^1,3

The two we cover are the two main ones: the NIST AI RMF, from the United States, and ISO/IEC 42001, which is international. For how the law itself regulates AI and who is liable for what it says, see AI in law. Overstated claims about what an AI governance framework delivers are their own problem, covered in AI washing.^1,3

What is the NIST AI Risk Management Framework?

The NIST AI Risk Management Framework is the US framework “AI RMF 1.0”, published by the National Institute of Standards and Technology (NIST, part of the US Department of Commerce) as NIST AI 100-1 in January 2023. The framework is “intended to be voluntary, rights-preserving, non-sector-specific, and use-case agnostic”. It is a voluntary AI framework, not a rule anyone must follow.¹

The Core has four functions: GOVERN, MAP, MEASURE and MANAGE, often shortened to govern, map, measure and manage. NIST says the actions under them “do not constitute a checklist, nor are they necessarily an ordered set of steps”, and that GOVERN is “a cross-cutting function that is infused throughout AI risk management”.¹

The framework also names seven trustworthy AI characteristics it asks organisations to balance. AI systems should be “valid and reliable, safe, secure and resilient, accountable and transparent, explainable and interpretable, privacy enhanced, and fair with their harmful biases managed”. No single one settles a design; NIST frames them as trade-offs to weigh.¹

Is NIST AI RMF mandatory? No. As of 11 November 2026 it is the current version, and NIST calls it “a living document” that it will review, with “a review with formal input from the AI community” expected “no later than 2028”.¹

What does the NIST Generative AI Profile add?

The NIST Generative AI Profile, NIST AI 600-1 (July 2024), is “a cross-sectoral profile of and companion resource for” the AI RMF for generative AI, and, as a companion to the voluntary AI RMF, is itself for voluntary use (its primary considerations are “relevant for voluntary use by any organization”). A profile, in NIST’s words, is “an implementation of the AI RMF functions, categories, and subcategories for a specific setting”, here generative AI. It “defines risks that are novel to or exacerbated by the use of GAI” and gives suggested actions across govern, map, measure and manage.²

It names twelve generative AI risks: CBRN Information or Capabilities; Confabulation; Dangerous, Violent, or Hateful Content; Data Privacy; Environmental Impacts; Harmful Bias or Homogenization; Human-AI Configuration; Information Integrity; Information Security; Intellectual Property; Obscene, Degrading, and/or Abusive Content; and Value Chain and Component Integration.²

Confabulation is “the production of confidently stated but erroneous or false content (known colloquially as ‘hallucinations’ or ‘fabrications’) by which users may be misled or deceived”. This is the same failure a lawyer calls an AI hallucination, and where it reaches a filing it has drawn sanctions, covered in lawyers sanctioned for fake AI citations.²

Two of the twelve bear directly on legal work. The Intellectual Property risk is the “eased production or replication of alleged copyrighted, trademarked, or licensed content without authorization (possibly in situations which do not fall under fair use)”. Fair use is the US copyright doctrine that allows limited use of protected work without the owner’s permission; the questions it raises run into generative AI and copyright. The Human-AI Configuration risk names “automation bias, over-reliance”, the habit of deferring to a system’s output, which is the hook into why these standards matter for legal and dispute work.²

The Profile was developed pursuant to Executive Order 14110. NIST points to “the generally immature state of the science of AI measurement and safety” and says future revisions will add risks and actions, so as of 11 November 2026 the Profile is explicitly provisional, and it is still voluntary guidance, not law.²

What is ISO/IEC 42001?

ISO/IEC 42001:2023 is the international standard that, in the official listing, “specifies requirements for establishing, implementing, maintaining, and continually improving an Artificial Intelligence Management System (AIMS) within organizations”. It was published on 18 December 2023 by the International Organization for Standardization and the International Electrotechnical Commission, through the joint committee ISO/IEC JTC 1/SC 42. ISO 42001 is how most people refer to it.³

It is written for “organizations of any size involved in developing, providing, or using AI-based products or services”, across all industries. It is a management-system standard, and the listing says implementing it involves “using the Plan-Do-Check-Act methodology”. Plan-Do-Check-Act means an organisation plans its controls, runs them, checks whether they worked and acts to improve them, on a loop. So an organisation builds governance processes rather than meeting a single technical product spec.³

Is ISO 42001 mandatory? No; like the NIST framework it is a voluntary standard an organisation adopts, not a law. Is ISO 42001 certification required? The official ISO listing does not say organisations can be certified against the standard, who would certify, or that certification is required. It carries only a generic line that conformity assessment is “a set of processes that show your product, service or system meets the requirements of a standard”. So ISO/IEC 42001 is best described as a management-system standard whose management system can be assessed for conformity. A certificate, if an organisation obtains one, covers a management system within a stated scope; it is not “certified AI”, and it does not by itself mean compliance with any law.³

NIST AI RMF vs ISO/IEC 42001: how do they differ?

Both are voluntary and both ask an organisation to govern AI risk, but the NIST AI RMF is a free US framework of outcomes to work toward, while ISO/IEC 42001 is an international management-system standard whose management system can be assessed for conformity. That is the main difference between them. Neither is law, so neither on its own settles how the two stand against the binding EU regime, which the next section covers.^1,3

The two are complementary and can be run together: the framework to decide what good looks like, and the management-system standard to run the processes around it. Neither document claims to describe the other. The table sets the two standards and the binding EU law side by side.^1,3

How do voluntary standards relate to binding law like the EU AI Act?

A voluntary standard binds no one by itself; the EU AI Act does. A voluntary standard is not legally binding. The Act “shall be binding in its entirety and directly applicable in all Member States”.⁴

Under Article 40, only high-risk AI systems and general-purpose AI models “in conformity with harmonised standards … the references of which have been published in the Official Journal of the European Union” are “presumed to be in conformity” with the requirements the Act sets out for them. Harmonised standards are European standards the Commission has asked for and had published in the Official Journal; a presumption of conformity means a system that meets them is treated as meeting the Act, unless shown otherwise. The NIST AI RMF and ISO/IEC 42001 are not themselves EU harmonised standards, so adopting them does not of itself satisfy the Act. Adopting ISO 42001 does not amount to EU AI Act compliance.⁴

Under Article 95, the AI Office and the Member States “shall encourage and facilitate the drawing up of codes of conduct … intended to foster the voluntary application” of some requirements to AI systems other than high-risk ones. So binding law can invite voluntary measures, but it does not treat them as the same thing. Adopting a voluntary standard does not stand in for the Act.⁴

The EU AI Act, Regulation (EU) 2024/1689, applies generally from 2 August 2026, and some obligations were re-timed by the Digital Omnibus amendment, Regulation (EU) 2026/1744. The full timetable, and how the Act treats AI that helps a court or an alternative dispute resolution (ADR) body decide a case, belong to the EU AI Act in dispute resolution. For the US state statutes, see the Colorado and Texas AI laws. The plain rule holds throughout: adopting NIST or ISO does not make anyone “compliant” with any law.^4,5

Why do AI governance standards matter for legal and dispute work?

AI governance standards matter for legal and dispute work because the same controls they ask for, documentation, human oversight, bias management and verifying outputs, are what keep AI safe to use in legal advice, case administration and dispute resolution, where an invented citation or a biased output can reach the record. The controls are the same for a law firm, a dispute resolution body or an in-house team, and these settings are where the standards earn their keep.^1,2

The sources map onto this directly. The Generative AI Profile’s confabulation risk and its “automation bias, over-reliance” risk speak to legal work, where a confidently wrong answer can be relied on. The framework asks an organisation to keep a person able to supersede or deactivate a system and to measure and monitor AI risk before and during use, which is AI risk management in a legal setting. The AI RMF is use-case agnostic and the Generative AI Profile is cross-sectoral, so this is our reading of general text applied to legal work, not a claim that NIST addresses legal AI specifically.^1,2

Standards are not the only source of a duty here. Lawyers’ existing professional duties already require competence and the verification of outputs, as ABA Formal Opinion 512 sets out, and those duties, not a voluntary standard, are what a court enforces; the duties that govern autonomous tools are covered in agentic AI and the duties that govern it. People sometimes describe a standard as an emerging AI governance standard of care, but as of 11 November 2026 we found no controlling case making any of these voluntary standards the legal standard of care, so treat that as commentary to check with counsel, not settled law.^1,6

Human oversight runs through both the standards and the law. For how overstated AI claims are policed, see AI washing; for the duty not to discriminate when AI screens people, see AI in hiring and employment.¹

What does this mean for anyone building or buying AI?

In our view, existing duties already reach AI, and the standards mostly make an existing expectation explicit. A person or an organisation stays accountable for what an AI system produces, decides or claims; the standard does not move that responsibility onto the software. The NIST framework asks for the plain things, document the system, keep a person able to override it, measure and verify outputs, and ISO/IEC 42001 asks an organisation to run that work as a management system on a Plan-Do-Check-Act loop. None of it is law. Only a harmonised standard published in the Official Journal creates a presumption of conformity with the EU AI Act, and that Act binds while the standards do not. The safest reading is that an output a person relies on has to be checked, and a claim about what AI does has to be substantiated, before anyone leans on it. The pace of AI is ahead of the settled case law, so the standards are filling in the detail of duties that already apply. For the binding side of the line, see the EU AI Act in dispute resolution.^1,2,4