AI Governance Frameworks: NIST AI RMF, ISO/IEC 42001, and the Law

Why use a framework if the law does not require one?

Use a framework because it produces, on a schedule, the inventory, testing, and records that the laws ask for. It does not make a company compliant by itself.

Every law covered in these guides asks for some mix of the same things: an inventory, an owner, a risk assessment, testing, notices, human review, vendor oversight, and records. A framework gives those tasks a structure and a schedule. Without one, they are done once for a launch and then forgotten.

This matters most at examination time. Regulators in insurance, banking, and the EU already examine against governance programs. When an examiner asks for your AI policy, inventory, and testing records, a framework is how you have them ready.

What is the NIST AI Risk Management Framework?

NIST released AI RMF 1.0 (NIST AI 100-1) on January 26, 2023. It is voluntary and sector-neutral.

It organizes AI risk work into four functions:

• Govern: policies, roles, accountability, and culture across the organization
• Map: the context of each system, its intended use, and who it affects
• Measure: testing and metrics for the risks identified
• Manage: prioritizing, treating, and monitoring those risks over time

Govern applies across the program. The other three repeat for each system.

The July 23, 2025 White House AI Action Plan directed NIST to revise the RMF to remove references to misinformation, diversity, equity, and inclusion, and climate change. NIST’s page states that a revision is in progress. No successor version had been published as of this writing. A program built on 1.0 will likely map to the revision with modest changes, because the four functions are the core of the document.

What does the Generative AI Profile add?

NIST AI 600-1, released July 26, 2024, is a companion profile for generative AI. It identifies risks that are unique to or made worse by generative AI, and lists more than 200 suggested actions organized under the four RMF functions.

The risks include confabulation (plausible but false output), harmful or dangerous content, data privacy, information security, intellectual property, and harmful bias, among others.

The profile carries legal weight in Texas. HB 149 provides that a defendant is not liable if it discovered a violation through an internal review process while substantially complying with the most recent version of the NIST AI RMF Generative AI Profile or another nationally or internationally recognized AI risk management framework. That is one of four discovery routes in Sec. 552.105(e); feedback, testing, and following state agency guidelines also qualify.

What is ISO/IEC 42001?

ISO/IEC 42001:2023, published in December 2023, specifies requirements for an artificial intelligence management system, or AIMS. It applies to organizations of any size that develop, provide, or use AI.

It differs from NIST in two ways that matter to buyers.

• It is certifiable. An accredited certification body can audit an organization against it. That gives customers and partners a third-party attestation instead of a self-description.
• It uses the ISO harmonized structure. Clauses on context, leadership, planning, support, operation, performance evaluation, and improvement match ISO/IEC 27001 and ISO 9001. A company already certified to 27001 can extend its existing management system rather than build a new one.

Annex A lists controls, and Annex B gives implementation guidance. ISO/IEC 42005 is a companion standard for AI system impact assessments.

How do the frameworks map to legal duties?

Each common legal duty has a home in a NIST AI RMF function and in an ISO/IEC 42001 clause or control. Neither framework guarantees compliance with any law in the table; each shows where in the program that legal duty gets done.

What happened to Colorado’s framework safe harbor?

Colorado’s framework safe harbor was repealed along with the 2024 law that created it, and its replacement does not include one.

Colorado’s 2024 AI Act, SB 24-205, named the NIST AI RMF and ISO/IEC 42001 directly; the Future of Privacy Forum describes it as the first US law to require deployers to run a risk management program aligned with frameworks like these. It required deployers to run such a program and gave an affirmative defense to companies that complied with a recognized framework and fixed violations they discovered.

That law was repealed before it took effect. The enacted text of its replacement, SB 26-189, contains no framework safe harbor, risk management program, or impact assessment duty, and does not mention NIST or ISO.

Frameworks still help in Colorado, because the duties that remain, such as documentation, notices, and human review, are easier to meet with a program in place. What changed is the legal credit. That depends on a specific statute, and statutes change.

What belongs in an AI policy?

An AI policy should set the rules below in a document short enough that people read it, with the detail in procedures.

• Scope: what counts as AI for the policy, including features inside licensed software
• Roles: who approves new AI uses, who owns each system, who can stop one
• Prohibited uses, including any practice banned in a jurisdiction you serve
• Risk tiers and what each tier requires before launch
• Data rules: what data may go into which tools, with health, financial, and personal data called out
• Testing: what is tested, how often, and who reviews results
• Transparency: when people are told AI is involved, and how adverse decisions are explained
• Human review: who can override, and how overrides are logged
• Vendors: minimum contract terms and documentation
• Incidents: what counts, who is told, and how fast
• Records: what is kept and for how long
• Review: at least once a year, and after any material law change

What should the AI inventory capture?

For each system, the inventory should record what it is, who owns it, what decision it touches, whom it affects and where, what data it uses, and how it is tested, reviewed, disclosed, and retained. It is the one document every framework and every law assumes you have.

NIST or ISO: which should a company choose?

Most companies should use both, in sequence: NIST to decide what to do, and ISO/IEC 42001 when someone needs outside proof.

Use the NIST AI RMF and the Generative AI Profile to decide what to do. They are free, detailed, and referenced by Texas law and by US regulators. Use ISO/IEC 42001 when customers or partners need proof from an outside auditor, or when the company already runs ISO management systems.

A company that sells AI to banks, insurers, or health systems will usually face buyer questionnaires that ask for one or the other. Certification shortens those conversations.

Start with the first-90-days checklist, then use a framework to keep it current. For the laws each element serves, see the EU AI Act guide and the state law guide.

This guide is general information as of October 2026, not legal advice. Framework adoption does not guarantee compliance with any law.