TL;DR: The NIST AI RMF is a voluntary framework (Govern, Map, Measure, Manage) for structuring AI risk practices; nothing certifies against it. ISO/IEC 42001 is a certifiable management system standard: audited policies, roles, risk and impact assessments, controls and improvement. The EU AI Act is law: risk-tiered obligations on specific systems and on general-purpose model providers, enforced with penalties. None satisfies another automatically. Use the RMF to design practices, run them inside a 42001 management system, and use the resulting evidence toward AI Act obligations, while doing the system-specific work the law requires.
How to approach it
Contrast nature, scope, evidence and enforcement, then show how an organisation combines them in practice, and finish with the "satisfies" question directly.
A strong answer
NIST AI RMF
Voluntary framework
- Govern, Map, Measure, Manage
- Nothing certifies against it
Structures practice
ISO/IEC 42001
Certifiable management system
- Audited policies, roles, risk and impact assessments
Proves a system exists
EU AI Act
Law with penalties
- Risk tiers, provider and deployer duties
Legal obligations
| NIST AI RMF 1.0 | ISO/IEC 42001:2023 | EU AI Act | |
|---|---|---|---|
| Nature | Voluntary guidance | International management system standard | Regulation (EU) 2024/1689 |
| Unit of focus | AI risk practices across the lifecycle | The organisation's AI management system | Individual AI systems (by tier and role) and GPAI models |
| Structure | Four functions, categories, subcategories; profiles such as NIST AI 600-1 | Clauses 4 to 10 plus Annex A controls | Prohibitions, high-risk requirements, transparency, GPAI obligations |
| Evidence | Self-attested alignment | Certificate from an accredited body, within scope | Conformity assessment, technical documentation, registration, logs |
| Enforcement | None | Certification audits | Market surveillance authorities; fines up to EUR 35 million or 7 percent of turnover for the most serious breaches |
| Status (checked November 2026) | Version 1.0; revision under way since the 2025 US AI Action Plan | 2023 edition | In force; high-risk dates moved by the 2026 Digital Omnibus |
Do they satisfy each other?
- RMF to 42001: no; RMF alignment is not certification, though RMF practices can populate a 42001 system.
- 42001 to the AI Act: no; a certificate shows a working management system, not that each high-risk system meets Articles 9 to 15 or that a GPAI model's obligations are met. Harmonised standards under the Act, not 42001 itself, are the route to presumption of conformity.
- AI Act to the others: compliance work produces evidence useful for both, but neither requires nor is satisfied by legal compliance alone.
How organisations combine them. Inventory and classify all AI uses (AI Act and RMF Map); run risk and impact assessments and controls inside a management system (42001); use the RMF and its profiles to choose practices and metrics; produce system-level documentation, logging, oversight and cybersecurity measures for high-risk systems (AI Act); keep crosswalks so one control serves multiple requirements.
What interviewers probe next
- "A customer in the EU asks for our 42001 certificate as proof of AI Act compliance. Response?" Provide it as evidence of the management system, and separately provide system-specific documentation relevant to their use and our role.
- "We're a US company with no EU customers. Which matters?" The RMF and possibly 42001 for customer assurance; watch state laws and sector regulators; the AI Act only if systems reach the EU.
- "Which would you implement first?" The inventory and risk intake, because all three depend on it.
What if?
What if · interview follow-ups
Hold your answer as the constraints change
A company selling AI hiring tools in Europe asks whether ISO/IEC 42001 certification makes it compliant with the EU AI Act, and where the NIST AI RMF fits.
Start here
What kind of thing is each one?
Which is law, which is certifiable, which is guidance?
The NIST AI RMF is a voluntary framework (Govern, Map, Measure, Manage) for structuring AI risk practices; nothing certifies against it. ISO/IEC 42001 is a certifiable management system standard: audited policies, roles, risk and impact assessments, controls and improvement. The EU AI Act is law, with risk-tiered obligations and penalties.
Carry it forwardFramework, management standard and law do different jobs.
Weak answerTreating all three as interchangeable compliance badges.
Constraint changes
Does 42001 certification make the hiring tool compliant?
Does a management system certificate assess this specific product?
No. A certificate shows a functioning, audited management system within its scope. The AI Act requires system-specific work for a high-risk use such as employment: risk management, data governance, technical documentation, logging, human oversight, accuracy and cybersecurity, conformity assessment, registration and post-market monitoring.
Carry it forwardNo standard satisfies the law automatically.
Weak answerTelling customers certification equals compliance.
Constraint changes
How can the three work together?
Which produces evidence the others can reuse?
Use the RMF to design practices, run them inside a 42001 management system so they are owned, audited and improved, and use the resulting evidence toward AI Act obligations. Much evidence overlaps, such as risk assessments and monitoring records, but the law's specific requirements still need specific work.
Carry it forwardDesign with the RMF, run with 42001, evidence for the Act.
Weak answerRunning three separate programmes.
Constraint changes
What if a US customer asks for NIST alignment instead?
Can one programme be mapped to several frameworks?
Map the same management system to the RMF functions: Govern to policy and roles, Map to the use-case register and threat models, Measure to evaluations and red-teaming, Manage to release decisions and incidents. One set of practices can be shown against several frameworks.
Carry it forwardBuild once, map to many.
Weak answerRebuilding the programme per customer.
Constraint changes
What if the AI Act's dates or details change?
Who watches for changes to the law?
Track changes through official sources with a named owner. The 2026 Digital Omnibus moved Annex III high-risk obligations to 2 December 2027, for example. The management system should include a process for regulatory change, so updates become tasks rather than surprises.
Carry it forwardAssign an owner to track regulatory change.
Weak answerPlanning on dates read once and never checked again.
Now defend it
How would you answer the company?
Certification alone does not make the hiring tool compliant. Use the NIST AI RMF to design practices and ISO/IEC 42001 to run them as an audited management system, then do the AI Act's system-specific high-risk work (risk management, data governance, documentation, logging, oversight, accuracy and cybersecurity, conformity assessment, registration, monitoring), reusing evidence where it overlaps and tracking regulatory change.
How it's scored
Weak: Treats them as interchangeable or calls the RMF a certification.
Hire: Distinguishes framework, standard and law with correct evidence types.
Strong Hire: Explains precisely why none satisfies another, how harmonised standards relate to the Act, current status and dates, and how to combine them with crosswalks.
Common mistakes
- Claiming RMF certification.
- Presenting a 42001 certificate as AI Act compliance.
- Ignoring role (provider versus deployer) under the Act.