ISO/IEC 42001 ↔ NIST AI Risk Management Framework
7 canonical controls in Keel's library satisfy clauses of both ISO/IEC 42001 and NIST AI Risk Management Framework. Implement each once, attach the evidence once, and it counts toward each standard. The overlap is the work you don't repeat.
Controls that satisfy both
| Canonical control | ISO/IEC 42001 clauses | NIST AI Risk Management Framework clauses |
|---|---|---|
| AI system inventory A maintained inventory of the AI systems the organization develops, deploys, or uses, with each system's purpose, owner, and risk classification. | A.4.2 | MAP-1 |
| AI system impact assessment A process to assess the potential impacts of AI systems on individuals, groups, and society, and to document and act on the results. | A.5.2, A.5.4 | MAP-5 |
| AI policy A documented, leadership-approved policy for the responsible development and use of AI, aligned with the organization’s other policies and reviewed at planned intervals. | A.2.2, A.2.3, A.2.4 | GOVERN-1 |
| AI roles & accountability Defined and allocated responsibilities for AI across the organization, plus a way for staff to raise concerns about the organization’s AI. | A.3.2, A.3.3 | GOVERN-2 |
| AI verification, validation & robustness Testing that an AI system meets its requirements and performs with appropriate accuracy, robustness, and security before and during use. | A.6.2.4 | MEASURE-2 |
| AI monitoring & malfunction reporting Ongoing monitoring of AI systems in operation, with a process to detect, communicate, and report malfunctions and serious incidents. | A.6.2.6, A.8.4 | MANAGE-4 |
| AI supplier & third-party management Allocation of responsibilities with, and oversight of, the suppliers and third parties involved in developing or providing AI systems and components. | A.10.2, A.10.3 | GOVERN-6, MANAGE-3 |
Clause identifiers (ISO/IEC 42001 and NIST AI Risk Management Framework) are referenced factually for mapping. Keel is not affiliated with or endorsed by the bodies that publish these standards. Control descriptions are Keel's own; a framework's full authored control count is on its framework page.
Why this is one project, not two
On a crosswalk-native model, NIST AI Risk Management Framework mostly lights up controls you already built for ISO/IEC 42001. You're not re-uploading the same screenshot for a second audit. You apply the framework and see the genuine delta worth working. That's the whole idea behind collect once, comply everywhere.