AI Frameworks Comparison Table
ISO/IEC 42001, NIST AI RMF and ISO/IEC 23894, side by side — what each covers, and which one to start with based on your real situation.
What's included
- 8-dimension comparison table: origin, certification, cost, what each covers, how they relate
- Decision guide based on 5 common situations
- Clarification of the most common mistakes when treating them as mutually exclusive
- Legal Notice
Why this document exists
The question that comes up most when starting to govern AI isn't "which framework is best?" — it's "which one do I actually need?". The three most cited frameworks — ISO/IEC 42001, NIST AI RMF and ISO/IEC 23894 — don't compete with each other: they cover different layers of the same problem.
The essential difference, one line each
- ISO/IEC 42001: the only one of the three that's certifiable — a complete management system for the whole AI organization.
- NIST AI RMF: a US voluntary framework, organized into 4 functions (Govern, Map, Measure, Manage), no certification path.
- ISO/IEC 23894: specific AI risk management guidance — the methodology ISO 42001 imports for its own risk clauses.
Frequently asked questions
Do I have to choose just one of the three?
No, and that's precisely the most common mistake this document corrects. All three cover different layers, and most organizations end up using more than one.
Does it include COSO and COBIT too?
They're mentioned as higher-level frameworks these three AI frameworks fit into, but the focus of the comparison is the three AI-specific frameworks.
Does this replace legal advice?
No. It's an informational comparison guide, it doesn't constitute legal advice — see the included Legal Notice.
What format is it delivered in?
A Word document with the full comparison table and decision guide, plus the Legal Notice, delivered instantly after purchase.