- Home
- AI agents
- Governance and regulation
- NIST AI RMF and ISO 42001
Govern and secure · Governance and regulation
How do NIST AI RMF and ISO/IEC 42001 apply to AI agents?
The NIST AI Risk Management Framework is a voluntary US framework that sorts AI risk work into four functions: Govern, Map, Measure and Manage. ISO/IEC 42001 is a certifiable international standard for an AI management system. For agents, NIST names the risks to look for, and 42001 sets the management system an auditor checks.
In this guide: 83 pages
Key takeaways
- NIST AI RMF 1.0 (26 Jan 2023) and its Generative AI Profile, NIST AI 600-1 (26 Jul 2024), are voluntary guidance. ISO/IEC 42001:2023 is the standard an accredited body certifies against. Use NIST to find the agent risks and 42001 to run and prove the controls.
- Both were written before the agent platforms of 2025 and 2026, so you translate them. GOVERN 1.6 (an inventory of AI systems) becomes the agent registry, MEASURE 2.4 (behaviour monitored in production) becomes traces and online evaluation, and MANAGE 2.4 (a way to disengage or deactivate the system) becomes a tested off switch.
- Microsoft’s crosswalk, published on NIST’s AI Resource Center, maps each NIST subcategory to 42001 clauses and annex controls, so one control register and one evidence set can serve both.
- A vendor certificate covers the vendor. Microsoft lists Copilot Studio and Microsoft Foundry in its 42001 scope and says customers remain responsible for engaging an assessor for their own organization.
- NIST’s agent-specific work was unfinished on 2 Nov 2026: the AI Agent Standards Initiative (February 2026) listed no finished deliverables, and the SP 800-53 control overlays for single-agent and multi-agent systems were still proposed use cases.
What is the difference between NIST AI RMF and ISO/IEC 42001?
NIST AI RMF is guidance you align to; ISO/IEC 42001 is a set of requirements you can be audited and certified against. NIST tells you which risks and outcomes to consider for each AI system, and 42001 tells you how the organization must run the policies, roles, assessments and reviews around all of them.
The two documents side by side, as their publishers described them on 2 Nov 2026.
| Question | NIST AI RMF 1.0 and NIST AI 600-1 | ISO/IEC 42001:2023 |
|---|---|---|
| Who publishes it | The US National Institute of Standards and Technology | ISO and IEC, the international standards bodies |
| Kind of document | Voluntary framework with no certification scheme | Management system standard with requirements, certifiable by accredited bodies |
| Structure | Four functions broken into categories and subcategories; AI 600-1 adds 12 generative AI risks with suggested actions | Clauses 4 to 10 hold the requirements (context, leadership, planning, support, operation, performance evaluation, improvement); Annex A lists reference controls and Annex B gives guidance for them |
| Unit of work | Each AI system or use case | The organization’s AI management system within its stated scope |
| What you produce | Risk profiles, measurements and treatment plans per system | Policy, scope, risk and impact assessments, a statement of applicability, internal audit and management review records |
| Status on 2 Nov 2026 | Final; NIST says it is being revised under the July 2025 AI Action Plan, with no date given | 2023 edition current; the companion ISO/IEC 42005:2025 covers AI system impact assessment |
| Legal weight | Texas TRAIGA (effective 1 Jan 2026) gives a defence for substantial compliance with NIST AI 600-1 or another recognised framework | None on its own; customers and procurement teams ask for the certificate |
Since Executive Order 14434 (29 Sep 2026), some NIST pages say "Super Intelligence" where they used to say AI. The order changes terminology only, so the framework content and the subcategory numbers stay the same.
How do the four NIST functions translate into agent controls?
Each function becomes a handful of agent controls once you read its subcategories against what an agent does: it holds an identity, calls tools, reads data and can be switched off. The table paraphrases the subcategories that matter most for agents and names the evidence that shows each one is met.
NIST AI RMF subcategories read as agent controls. Wording paraphrased from the AI RMF Core on NIST’s AI Resource Center.
| Subcategory | What it says | What it means for an agent | Evidence |
|---|---|---|---|
| GOVERN 1.6 | Mechanisms are in place to inventory AI systems, resourced by risk priority | One registry record per agent with owner, identity, tools, data and risk tier | A registry export with no ownerless agents |
| GOVERN 6.1 | Policies address AI risks from third-party entities | Model providers, MCP servers and hosted tools are suppliers with versions and terms | A supplier list linked to each agent record |
| MAP 1.1 | Intended purposes, context-specific laws, norms and expectations are understood and documented | A written purpose, the decisions the agent influences and the laws that attach to them | Purpose and risk tier fields, reviewed at approval |
| MEASURE 2.4 | The behaviour of the system and its components is monitored in production | Traces of model and tool calls, online evaluation on sampled runs | Dashboards and evaluation scores per agent version |
| MANAGE 2.4 | Mechanisms and named responsibilities exist to supersede, disengage or deactivate the system | A named person and a tested off switch on each platform the agent runs on | A kill-switch test record that says what kept running |
| MANAGE 4.1 | Post-deployment monitoring plans cover user input, appeal and override, decommissioning, incident response, recovery and change management | A runbook per agent and a regression run on every model change | Runbook, regression results, retirement record |
| MANAGE 4.3 | Incidents and errors are communicated, tracked and documented | An incident log tied to trace ids and the registry record | Incident tickets with root cause and the new test case |
NIST AI 600-1 adds the generative risks. In our agent work, five of its twelve matter most: Information Security (injected instructions and data leaks through tools), Confabulation (a confident wrong answer that turns into an action), Human-AI Configuration (automation bias, which turns approvals into a formality), Value Chain and Component Integration (models, MCP servers and plugins you did not build) and Data Privacy (personal data in prompts, memory and traces).
What does ISO/IEC 42001 ask for, and where do agents fit?
ISO/IEC 42001 asks for a working management system: a defined scope, a policy, assigned roles, risk and impact assessments, selected controls, monitoring, internal audit, management review and corrective action. Agents are AI systems inside that scope, and each one has to appear in the risk assessment, the impact assessment and the control selection.
Scope comes first. Clause 4.3 asks you to determine the scope of the management system, and the first agent question is whether agents that staff build in Copilot Studio or Agent Builder fall inside it. If they do, the inventory has to reach them. If you leave them out, write down why, because an auditor will ask.
Planning is where agents get specific. Clauses 6.1.2 (AI risk assessment), 6.1.3 (AI risk treatment) and 6.1.4 (AI system impact assessment) apply per system, and risk treatment is where you compare your controls with Annex A and record the choices in a statement of applicability. ISO/IEC 42005:2025 gives a method for the impact assessment itself.
Several annex controls read as if they were written for agents. AI system operation and monitoring (6.2.6) and recording of event logs (6.2.8) are your tracing and audit trail. Intended use of the AI system (9.4) is the boundary the agent must stay inside. Suppliers (10.3) covers model providers and tool servers, and communication of incidents (8.4) covers who hears about a failure. Annex A states each control and Annex B gives guidance under the same number.
Clauses 9 and 10 close the loop. Internal audit (9.2) and management review (9.3) check whether the agent controls work in practice, and nonconformity and corrective action (10.2) is where an agent incident ends: a root cause, a fix and evidence that the fix held.
How do you run one set of agent controls for both frameworks?
Keep one control register, map each control to the NIST subcategory and the 42001 clause or annex control it serves, and attach the evidence to the agent’s registry record. A NIST self-assessment and a 42001 audit then read the same records.
- Start from the crosswalk. Microsoft’s NIST AI RMF to ISO/IEC 42001 crosswalk on NIST’s AI Resource Center maps GOVERN 1.6 to the resource documentation controls (4.2 to 4.6) and MEASURE 2.4 to clause 9.1 plus operation and monitoring (6.2.6) and event logs (6.2.8). It was drafted against the final draft of the standard, so check numbers against the published text.
- Write each control at agent level. "Every agent has a named owner and its own identity" can be tested; "AI risks are managed" cannot.
- Use a template where one exists. Microsoft Purview Compliance Manager has premium templates for ISO/IEC 42001:2023 and NIST AI RMF 1.0, and the CSA AI Controls Matrix (243 control objectives in 18 domains) maps to 42001, NIST AI 600-1 and the EU AI Act. AWS Audit Manager has been in maintenance mode since 30 Apr 2026, so its generative AI framework gets no updates.
- Pull evidence from the platforms instead of writing it by hand: registry exports, evaluation runs, trace queries, approval logs and kill-switch test records.
- Decide on certification separately. Certify when customers or regulators ask for third-party evidence; align without certifying when they do not.
How do Microsoft, AWS and Google implement it?
Where the three clouds help with NIST and 42001 work, as the vendor pages showed on 2 Nov 2026.
Capability, Microsoft, AWS, Google
| Capability | Microsoft | AWS | |
|---|---|---|---|
| Framework templates | Purview Compliance Manager premium templates for ISO/IEC 42001:2023, NIST AI RMF 1.0, ISO/IEC 23894:2023 and the EU AI Act | Audit Manager Generative AI Best Practices Framework v2, frozen since maintenance mode began 30 Apr 2026; AWS points to an AWS Config conformance pack for AI and ML | Not verified for this page |
| Vendor ISO/IEC 42001 certificate | Copilot Studio, Microsoft Foundry, Microsoft Copilot, GitHub Copilot, Security Copilot and others in scope (page updated 11 Sep 2026) | Accredited certification announced 25 Nov 2024, initially covering Amazon Bedrock, Amazon Q Business, Amazon Textract and Amazon Transcribe; current scope in AWS Artifact | An ISO/IEC 42001 compliance page exists; scope not verified |
| Inventory for GOVERN 1.6 | Agent 365 registry, generally available 1 May 2026 | AWS Agent Registry, generally available 31 Aug 2026 | Agent Registry, generally available 18 Jun 2026 |
| Evidence for MEASURE 2.4 and event logs | Foundry tracing to Application Insights; Purview Audit for Copilot, Copilot Studio and Foundry interactions | AgentCore Observability in CloudWatch; CloudTrail for Gateway and Agent Registry calls | Agent Runtime tracing to Cloud Trace; Cloud Audit Logs |
Google Cloud’s ISO/IEC 42001 and governance pages did not render for our research pass, so the Google column states only what we could verify.
Frequently asked questions
Is the NIST AI RMF mandatory?
No. It is voluntary guidance. It does carry weight in one state law: Texas TRAIGA, effective 1 Jan 2026, gives a defence for substantial compliance with NIST AI 600-1 or another recognised framework. In practice it is the vocabulary many risk teams already use when they ask about AI.
Can a company be certified against the NIST AI RMF?
No. NIST runs no certification scheme for the AI RMF, so you can only state and evidence your alignment. When a customer asks for a certificate, ISO/IEC 42001 is the AI standard accredited bodies certify against, and a NIST-aligned control set is a good base for it.
Does ISO/IEC 42001 certification make an agent compliant with the EU AI Act?
No. A certificate shows that the management system around your AI works. The EU AI Act attaches duties to each system by its use, such as transparency under Article 50 since 2 Aug 2026 and the high-risk duties from 2 Dec 2027 for Annex III uses and 2 Aug 2028 for Annex I. Map those articles in the same control register and keep the evidence per agent.
Where should a team with only a few agents start?
With GOVERN 1.6 and MANAGE 2.4: an inventory with a named owner for every agent, and a tested way to switch each one off. We recommend them as the first two controls because they answer the opening questions of both frameworks, and every later control hangs off the registry record.
More in Governance and regulation
Sources
Each source was read on 2 November 2026. The date shown is the date on the page, or the page’s ms.date for Microsoft Learn; an undated page shows the date it was read.
- AI Risk Management Framework
- AI RMF Core (section 5)
- NIST AI 600-1, Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile
- NIST AI RMF to ISO/IEC FDIS 42001 AI management system crosswalk
- ISO/IEC 42001:2023 Artificial Intelligence Management System Standards
- Compliance Manager regulations list
- AWS Audit Manager availability change
- AWS achieves ISO/IEC 42001:2023 Artificial Intelligence Management System accredited certification
- AI Controls Matrix
- AI Agent Standards Initiative
- Control Overlays for Securing AI Systems (renamed COSIS on 20 Oct 2026)
- HB 149, Texas Responsible Artificial Intelligence Governance Act, enrolled text
- Executive Order 14434, Inaugurating the Era of Super Intelligence
Planning an AI program?
Talk to the team that builds it and runs it after launch.
- Built to SOC 2, HIPAA and GDPR standards
- EU AI Act-aligned delivery
- Microsoft Solutions Partner