ISO 42001 vs NIST AI RMF: Which Should UK CIOs Adopt in 2026?
ISO/IEC 42001 certifies how your organisation governs AI; the NIST AI RMF assesses individual AI systems. Most UK CIOs need both.
For UK CIOs, the choice matters because the UK has no single AI statute. Regulators including the FCA, ICO and CMA apply existing law to AI, and the government’s approach, set out by the Department for Science, Innovation and Technology (DSIT), relies on assurance and standards to fill the gap. Our wider guide to UK AI regulation for CIOs covers the legal backdrop; this briefing covers which framework to build on.
What is the real difference between ISO 42001 and the NIST AI RMF?
ISO/IEC 42001, published in December 2023, is the first international standard for an AI management system. It follows the familiar ISO structure used by ISO 27001: mandatory clauses 4 to 10 covering context, leadership, planning, support, operation, performance evaluation and improvement, plus Annex A, which lists 38 reference controls across nine objectives. Accredited bodies can audit and certify an organisation against it.
The NIST AI RMF 1.0, released by the US National Institute of Standards and Technology in January 2023, is voluntary guidance organised around four functions: Govern, Map, Measure and Manage. A Generative AI Profile (NIST AI 600-1) followed in 2024. There is no certification; it is a toolkit for reasoning about risk in specific systems.
- Scope: ISO 42001 governs the organisation and its processes; NIST AI RMF addresses individual systems and their measured behaviour.
- Assurance: ISO 42001 produces an auditable certificate; NIST AI RMF produces internal evidence and self-assessment.
- Cost and effort: ISO 42001 demands a management system, internal audit and management review; NIST AI RMF is free and can be adopted selectively.
Executive Action
- Ask your team to map your current AI controls against both frameworks in a single table before choosing.
- Decide whether a customer, insurer or regulator is likely to ask for third-party evidence within 12 months.
- Confirm the board has seen the comparison, not just a vendor’s summary.
Which framework do UK regulators and customers actually expect?
Neither is mandated. The UK government’s trusted third-party AI assurance roadmap, published by DSIT in September 2025, describes a nascent market and notes that existing AI assurance certifications are not accredited by the UK Accreditation Service (UKAS). According to DSIT, the UK AI assurance sector comprised over 500 firms generating roughly £1 billion in value in 2024, and could reach £18.8 billion by 2035 if barriers are removed.
That matters for CIOs. A certificate is only as credible as its issuer, so check that your certification body holds accreditation for ISO/IEC 42001 and ask how it treats generative and agentic systems. Regulated firms should also read ISO 42001 evidence alongside sector rules, for example the FCA’s expectations on operational resilience and the PRA’s model risk management principles, discussed in our briefing on AI model risk management.
Executive Action
- Check whether the certification body is accredited for ISO/IEC 42001 and by whom.
- Review your top five customer contracts and tenders for AI governance or assurance clauses.
- Ask your general counsel which regulators in your sector already reference AI governance expectations.
How should a CIO sequence implementation?
The pragmatic answer for most UK enterprises is to use both, in a defined order. Begin with an AI inventory: you cannot govern what you cannot see, and unmanaged tools are a recurring weakness, as we set out in our shadow AI governance briefing. Then use the NIST AI RMF Map and Measure functions to risk-assess your highest-impact systems, and fold the results into an ISO 42001 management system that provides the policies, roles, internal audit and continual improvement.
- Months 0 to 2: inventory AI systems, assign accountable owners, set scope.
- Months 2 to 6: risk-assess high-impact systems using NIST Map and Measure; draft policy and Annex A statement of applicability.
- Months 6 to 12: internal audit, management review, then a stage one and stage two certification audit if the business case holds.
Executive Action
- Appoint a single accountable executive for the AI management system and name them in the board minutes.
- Reuse existing ISO 27001 and data protection governance rather than building a parallel structure.
- Pilot on one high-impact system before committing to enterprise-wide scope.
What should the board ask the CIO?
ISO 42001 requires demonstrable leadership commitment, so certification cannot be delegated entirely to technology. Directors do not need to master Annex A, but they should be able to answer three questions: which AI systems carry material risk, who is accountable for each, and what independent evidence exists that controls work. For the wider director-level picture, see our guide to AI governance for UK boards.
Our free AI governance assessment offers a quick baseline before you commit to either route.
Executive Action
- Request a one-page AI risk register covering the ten highest-impact systems for the next board meeting.
- Ask for the cost, timeline and expected commercial benefit of certification before approving scope.
- Set a review date to test whether the chosen framework is producing evidence, not just documents.
Frequently asked questions
No. ISO/IEC 42001 is a voluntary international standard. The UK follows a principles-based, regulator-led approach, so no statute requires certification. However, customers, insurers and procurement teams increasingly ask for it as evidence of AI governance maturity.
No. The NIST AI Risk Management Framework is voluntary guidance with no accredited certification scheme. Organisations can self-assess against it or commission an independent review, but they cannot obtain a certificate in the way ISO 42001 allows.
Most CIOs should start with ISO 42001 if they need certifiable, auditable governance for customers or regulators, and use the NIST AI RMF to structure technical risk assessment of individual systems. Start with an AI inventory either way.
The board sets risk appetite and approves the scope; the CIO, often with the CRO, owns implementation and evidence. ISO 42001 requires demonstrable top-management leadership, so the board cannot treat certification as a purely technical project.
About INFORMD. INFORMD provides intelligence briefings, tools and frameworks for senior business leaders across technology, finance, strategy and compliance. Based in Milton Keynes, UK, we help executives stay informed and act with confidence. Explore our full briefing library or access our free assessment tools. You can also download our technology strategy review template or contact us.
Stay ahead. Subscribe to INFORMD’s weekly executive briefing at informd.co.uk (/resources/).
