NIST AI RMF vs ISO/IEC 42001 vs the EU AI Act: which applies to a small US business?

By Hugh Donatello, LAN Service Group · Published October 25, 2026 · Updated October 25, 2026

✓ Checked on October 21, 2026 against NIST's AI RMF page and NIST AI 100-1, NIST's AI RMF crosswalks page, and the texts of Regulation (EU) 2024/1689 and Regulation (EU) 2026/1744 as published in the Official Journal of the European Union. ISO/IEC 42001 facts follow ISO's own pages. No prices are stated on this page.

Short answer

Usually none is legally required. The NIST AI RMF is voluntary guidance, and ISO/IEC 42001 is a standard you can choose to be certified against. The EU AI Act is law, but it reaches a US company only when it offers AI systems in the EU, has an EU establishment, or AI output it produces is used in the EU. A customer contract can also make any of the three a contractual obligation.

Free one-page NIST AI RMF worksheet

Editable Word document and PDF, one landscape page. No form or sign-up. List one row per AI tool, fill in the owner and responses, and review it each quarter. General guidance, not legal advice. What the template covers →

Download Word (.docx) Download PDF

Free AI risk register template

One row per AI use: owner, data touched, risk, likelihood and impact with the rating worked out for you, control, residual risk and review dates, six worked example rows and a NIST AI RMF mapping tab. No form or sign-up. General guidance, not legal advice; not published or endorsed by NIST. What the register covers →

Download Excel (.xlsx)

Three different kinds of thing

These three names come up together, but they are not alternatives to one another. The NIST AI Risk Management Framework (AI RMF 1.0, NIST AI 100-1) is guidance from a US federal agency. NIST says it is intended for voluntary use. NIST does not audit organizations against it or offer a certification for it.

ISO/IEC 42001:2023 is an international standard that sets requirements for an AI management system: the policies, roles, risk processes and reviews an organization runs to manage its AI. Because it is written as requirements, an organization can be audited against it. ISO says certification is voluntary and that ISO itself does not certify anyone; independent certification bodies do.

The EU AI Act, Regulation (EU) 2024/1689, is binding law in the European Union. It entered into force on 1 August 2024 and applies in stages. It was amended by Regulation (EU) 2026/1744, the Digital Omnibus on AI, published in the Official Journal on 24 July 2026, which moved the main high-risk deadlines later. For a small US business the first question is not what the Act requires but whether it reaches you at all.

The comparison at a glance

The table compares the three on the points that decide what a 10-50 person US company should do. Each row is cited to the framework's own publisher: NIST, ISO, and the Official Journal of the European Union.

NIST AI RMF, ISO/IEC 42001 and the EU AI Act compared for a small US business
Framework	Voluntary, certifiable or law	Who it applies to	Adoption effort	What a 10-50 person US company actually needs to do	Source
NIST AI RMF 1.0 (NIST AI 100-1), with the NIST AI 600-1 Generative AI Profile	Voluntary guidance. NIST does not offer or run a certification for it. NIST states AI RMF 1.0 is being revised as part of the White House AI Action Plan.	Any organization of any size or sector that wants to use it.	Low to moderate. NIST says organizations may choose which categories and subcategories to apply.	Nothing is required. A practical baseline is one AI risk owner, an acceptable-use policy, a register of AI tools and the data they touch, and tests on the uses that affect customers, money, hiring or regulated data.	[1] [2] [8]
ISO/IEC 42001:2023, AI management system	Certifiable international standard. Certification is voluntary and is done by independent certification bodies, not ISO.	Any organization that provides or uses AI and chooses to adopt it.	High. A management system has to be documented, operated, internally audited and reviewed by management; certification adds an external audit.	Nothing, unless a customer or partner asks for certification. Without that request, aligning with parts of it costs far less than certifying.	[4] [5]
EU AI Act, Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744	Law, applied in stages from 2 February 2025.	Providers placing AI systems on the EU market wherever they are based; deployers established in the EU; and providers and deployers outside the EU where the output of the AI system is used in the EU.	Low for most small businesses that only use general AI tools. Significant if you provide a high-risk system, or deploy one while in scope, for example AI used to screen job applicants or score people's credit; deployers of high-risk systems have their own duties under Article 26.	If you are out of scope, nothing. If you are in scope: avoid the prohibited practices, take measures to support staff AI literacy, label deepfakes and certain AI-generated public text, and check whether any use falls under the high-risk categories in Annex III.	[6] [7]

The first three columns follow each publisher's own text. The adoption-effort column and the small-company actions are CIO Support's assessment, not requirements set by NIST, ISO or the EU. This is general guidance, not legal advice.

Does the EU AI Act reach a US company?

Article 2(1) of the Act lists who it applies to. Three parts matter to a US business: providers that place AI systems on the EU market or put them into service in the EU, irrespective of where they are established; deployers of AI systems that are established or located in the EU; and providers and deployers established outside the EU where the output produced by the AI system is used in the EU.

The Act calls the company that builds an AI system, or has one built and offers it under its own name or trademark, the provider. The organization using an AI system under its authority is the deployer. Most small businesses that use AI are deployers: they use ChatGPT, Copilot or AI features inside software they already license.

In practice a US company with no EU office, no EU customers and no AI output going to people in the EU is unlikely to be in scope. The picture changes if you sell software with AI features to EU customers, run a customer-facing chatbot that EU residents use, or send AI-generated material into the EU. The output test in Article 2(1)(c) is broad, so if you have EU customers, get advice on your specific situation rather than assuming you are out of scope. This page covers only these three frameworks; other laws, including US state and local laws on AI, can apply separately.

EU AI Act dates that matter, as amended

The original dates are in Article 113 of Regulation (EU) 2024/1689. Regulation (EU) 2026/1744 replaced some of them. The table shows the dates as amended.

EU AI Act application dates after the Digital Omnibus on AI
Date	What applies from that date	Source
1 August 2024	The AI Act entered into force. Its obligations then apply in stages.	[6] [7]
2 February 2025	Chapters I and II: general provisions, AI literacy (Article 4) and the prohibited AI practices (Article 5).	[6]
2 August 2025	Rules for general-purpose AI models (Chapter V), notifying authorities and notified bodies, governance, and penalties, except the fines for general-purpose AI model providers in Article 101.	[6]
27 July 2026	Regulation (EU) 2026/1744 entered into force. Among other changes it replaced the Article 4 AI literacy duty with a duty to take measures to support AI literacy, and states that no specific level of AI literacy has to be guaranteed for any individual.	[7]
2 August 2026	General date of application, including the transparency obligations in Article 50.	[6]
2 December 2026	Providers of generative AI systems placed on the market before 2 August 2026 must comply with the machine-readable marking rule in Article 50(2). New prohibitions added by the amendment, on AI-generated non-consensual intimate material and child sexual abuse material, also apply from this date.	[7]
2 December 2027	High-risk obligations in Chapter III, Sections 1 to 3, for systems listed in Annex III, such as AI used in recruitment or creditworthiness assessment. This includes the deployer obligations in Article 26. Originally 2 August 2026.	[6] [7]
2 August 2028	High-risk obligations for AI systems that are products, or safety components of products, covered by the EU laws listed in Annex I. Originally 2 August 2027.	[6] [7]

Dates are taken from Article 113 of Regulation (EU) 2024/1689 and the amendments made by Regulation (EU) 2026/1744, both as published in the Official Journal of the European Union. Check EUR-Lex for any later amendment.

When a customer contract makes it mandatory

For most small US businesses the practical trigger is not a regulator but a customer. A voluntary framework becomes a binding obligation when a contract you sign says so. Read master services agreements, security questionnaires, data processing agreements and supplier codes of conduct for AI clauses before you sign them.

Watch for four kinds of clause. A clause requiring you to 'maintain an AI risk management program aligned with the NIST AI RMF' makes the framework a contract term: keep the evidence, such as the owner, the register and the test records. A clause requiring ISO/IEC 42001 certification means an external audit by a certification body, which takes planning; agree a realistic date or ask whether alignment is acceptable for now. A clause passing EU AI Act obligations to you, for example when an EU customer is itself a deployer or provider, means you must understand which role you play in the Act. Under Article 25, a company that puts its name or trademark on a high-risk AI system, substantially modifies one, or changes an AI system's intended purpose so that it becomes high-risk is treated as its provider. Finally, a broad clause requiring you to 'comply with all applicable AI laws' turns a vague obligation into a breach risk; ask the customer to name the laws or frameworks they mean.

If you cannot meet a clause as written, say so before signing and propose what you can do. Promising a framework you do not run is a contract risk, and in a security questionnaire it can amount to a misstatement.

How the three fit together

Many small companies end up using the three in layers rather than choosing one. The NIST AI RMF is a free, flexible way to decide what to do about AI risk. ISO/IEC 42001 is the management system that keeps doing it and can be independently audited. The EU AI Act is the legal floor where it applies.

NIST lists crosswalks between the AI RMF and other frameworks on its AI Resource Center, including a crosswalk from the AI RMF to ISO/IEC 42001 contributed by Microsoft. A register and policy built on the NIST AI RMF can therefore largely be reused if you later pursue ISO/IEC 42001 certification. A crosswalk shows where the frameworks overlap; it does not make following one count as meeting another, and neither framework replaces the EU AI Act's own obligations where the Act applies.

A sensible order for a 10-50 person company: start with the NIST AI RMF on one page, using our free worksheet for the NIST AI RMF and an AI risk register. Check whether the EU AI Act reaches you, and if it does, which role you play and whether any use is high-risk. Consider ISO/IEC 42001 certification when a customer requires it or when an independent audit would win you business.

Common follow-up questions

Is the NIST AI RMF required by law for a small business?

No. NIST states the AI RMF is intended for voluntary use. It becomes an obligation only if a contract, a customer requirement or another rule you are subject to adopts it.

Can a small business get certified to the NIST AI RMF?

Not from NIST. NIST does not offer or run a certification for the AI RMF, so any 'NIST AI RMF certificate' comes from a third party, not NIST. If a customer wants independent certification of your AI management, the relevant standard is ISO/IEC 42001, which is audited by independent certification bodies, not by ISO.

Does the EU AI Act apply if we only use ChatGPT or Copilot internally in the US?

Usually not, if you have no EU establishment and none of the AI output is used in the EU. Article 2(1)(c) brings in deployers outside the EU where the output is used in the EU, so EU customers or EU-facing chatbots change the answer. Get advice for your specific situation.

When do the EU AI Act high-risk rules start?

After the Digital Omnibus on AI, Regulation (EU) 2026/1744, the high-risk rules apply from 2 December 2027 for systems listed in Annex III and from 2 August 2028 for AI in products covered by Annex I. The original prohibited practices have applied since 2 February 2025; the prohibitions added by the amendment apply from 2 December 2026.

Is ISO/IEC 42001 certification worth it for a 20-person company?

Only if someone will pay for the assurance, typically a customer that requires it or a market where an audited AI management system wins business. Otherwise, in our view, aligning with the NIST AI RMF and keeping good evidence is usually enough for a company that size.

Does following the NIST AI RMF make us compliant with the EU AI Act?

No. The NIST AI RMF is voluntary guidance and is not an EU compliance mechanism. Work done under it, such as an AI inventory and risk checks, helps you find out whether the Act applies and what it would require, but the Act's obligations have to be met on their own terms.

Need help with this?

LAN Service Group helps small and mid-size businesses map which AI frameworks and laws may apply to them, for confirmation with their legal adviser, stand up practical AI governance aligned to the NIST AI RMF, and prepare for customer AI requirements, including ISO/IEC 42001 audits carried out by independent certification bodies.

Talk to LAN Service Group LAN Service Group AI services → (888) 281-7243