ISO 42001 vs NIST AI RMF: Which Do US AI Companies Need?

• Done for you, end to end

  We write the policies, set up the controls and evidence, run the internal audit and coordinate the independent audit. You deal with one team from first call to final report.

• Simple and quick

  A free gap assessment, then one plan with dates from day one. Effivity, our GRC automation platform, is included to keep the evidence moving.

• 8,100+ client engagements

  In 60+ countries over 20+ years, with experts who bring 30+ years of experience.

• Under US$10,000, all-inclusive

  For most start-ups and SMEs: SOC 2, ISO 27001, ISO 42001, HIPAA or ISO 9001, including the independent audit. A fixed quote follows a free gap assessment.

Every Sterling consulting engagement comes with the following, so you are not buying extras to get to the finish line:

• Effivity, Sterling's GRC automation platform, with a full-year subscription, to run your controls, evidence, tasks and audits in one place.
• Sterling Academy: preferential course access, with complimentary awareness training for your people.
• Internal auditor training for your audit team, as applicable to your standard.
• For information-security engagements, a vulnerability assessment.

These are part of the engagement, not a separate purchase. The details depend on the standard you are working toward, which we confirm during the free gap assessment.

Consulting and auditing are always separated: the people who consult never audit you. That keeps your internal audit objective and protects the independence of the CPA firm, Qualified Security Assessor or certification body that performs the final step.

Behind this are 8,100+ client engagements in 60+ countries over 20+ years, led by experts with 30+ years of experience.

What the fee covers, and what it doesn't:

• It is the fee for your first SOC 2 report or your first certification only.
• Annual work is always additional and billed the following year: later SOC 2 report periods, and ISO surveillance and recertification audits.
• It assumes a typical start-up or SME scope: one product or service and one main location.
• Larger or multi-site scopes get a fixed quote after the gap assessment.
• PCI DSS is quoted separately: a fixed quote follows a free gap assessment.

^[1] Occupational Employment and Wage Statistics, May 2025: 15-1212 Information Security Analysts, national annual median wage. US Bureau of Labor Statistics. accessed October 23, 2026.

What you get. One AI risk program that speaks NIST to US agencies and risk teams and carries an ISO/IEC 42001 certificate for buyers who want independent proof, built once by Sterling.

The two are not rivals. The NIST AI RMF 1.0 is a US framework intended for voluntary use^[2]. ISO/IEC 42001 is an international management system standard for AI^[1] that an accredited certification body can audit and certify; Sterling does not certify. NIST gives you shared outcomes and language. ISO gives you a system you operate and then have examined.

So the real question for a US founder is who is asking and what they will accept:

• US federal and state buyers, and risk teams fluent in NIST. They expect to hear how your process maps to Govern, Map, Measure and Manage^[3].
• US enterprise procurement and global tenders. In Sterling's experience, they increasingly want an independently audited standard, which a NIST mapping alone does not provide.
• Both. Most growing US AI companies end up serving both audiences from one set of records.

The NIST column follows NIST's own text. The ISO column is Sterling's description beyond the standard's title.

What you get. Claims to US customers that match the official texts exactly.

• NIST itself. The framework says it does not prescribe risk tolerance^[3], so there is no NIST pass mark. Govern is designed as a cross-cutting function informing the other three^[3]. NIST has added a generative AI profile, NIST-AI-600-1, released July 26, 2024^[2]. It also expects a formal review with AI community input no later than 2028^[3], and its overview page now states that AI RMF 1.0 is being revised^[2].
• Federal acquisition. OMB Memorandum M-25-22 (April 3, 2025) tells agencies to require enough descriptive information from vendors to complete the AI Impact Assessment for high-impact use cases^[4]. It names neither framework; both produce the records an agency will want.
• Colorado. The 2024 AI law, SB 24-205, measured a deployer's risk management program against the latest NIST AI RMF, ISO/IEC 42001 or an equivalent framework^[5]. SB 26-189, signed May 14, 2026, repealed and re-enacted that law around automated decision-making technology^[6], and its signed text no longer names either framework. Its duties, including developer documentation from January 1, 2027 and 3-year record retention^[6], still call for records that either framework produces.

What you get. A single management system that answers a NIST-framed questionnaire and passes an ISO/IEC 42001 audit. The mapping below is Sterling's working method, not an official crosswalk.

Precise wording protects deals and contracts:

• Avoid "NIST AI RMF certified." The framework describes no certificate. Say "our AI risk process is built around the NIST AI RMF functions" and attach the mapping.
• Avoid "ISO 42001 compliant." Use one of three accurate statements: in progress, internally audited, or certified by a named accredited body for a stated scope.
• Avoid "our certificate means we meet AI regulation." Laws have their own tests; for Europe see ISO 42001 and the EU AI Act.

When a US tender specifies an audited standard, a NIST mapping will not satisfy it. That is the moment to plan a certificate; our ISO 42001 explainer for US AI companies sets out what it involves.

What you get. Done-for-you consulting from experts with 30+ years of experience, and Sterling's 100% success and on-time completion record across 8,100+ client engagements in 60+ countries over 20+ years. The people who consult never audit you.

1. Free gap assessment. We list your AI systems, owners, models and data, and show how much of your current work already counts. 2. Policy and risk method. Written with NIST function headings if your customers think in NIST terms. 3. Real records. We run the method on your flagship product; evaluation, release and monitoring evidence goes into Effivity, Sterling's GRC automation platform. 4. Internal audit. Findings are closed before anyone external sees them. 5. Certificate, if buyers need one. We coordinate the audit with the accredited certification body you choose.

Steps 1 to 4 pay off on either route; step 5 depends on what your US buyers require.

A NIST-aligned process is often enough at the seed stage. In Sterling's experience, these signals mean US buyers now want independent proof:

• A tender or RFP names an audited AI standard. Self-assessment answers will not score.
• Questionnaires keep growing. Each new US enterprise prospect sends a longer AI section, and your team rewrites the same answers.
• Your product makes decisions about people. Hiring, lending, insurance, housing or health use cases draw closer scrutiny from customers' legal teams.
• European revenue is on the plan. Counsel on the buyer side will want evidence of governance, not just a framework reference.
• A lead investor or acquirer asks how models are approved. A certificate answers in one document.

If two or more apply, plan the audit now; the records take months to accumulate, so starting late is the usual cause of a missed deal date.

This is Sterling's recommendation, not a statement from NIST, ISO or any US agency.

1. Adopt NIST AI RMF vocabulary from day one if you sell to US government or NIST-fluent risk teams. 2. Build toward ISO/IEC 42001 when US enterprise buyers or tenders want an independently audited standard. 3. Run one risk method and one evidence set, mapped to both. 4. Re-check NIST's text before publishing claims, since a revision is under way^[2]. 5. Keep SOC 2 or ISO/IEC 27001 on its own track for security questions. More background sits on the NIST AI RMF hub and the ISO 42001 hub.

Ready to cover both with one program? Get a proposal from Sterling.

ISO management system standards such as ISO/IEC 27001, ISO/IEC 42001 and ISO 9001 are certified by an accredited certification body, not by a consultant^[1]. Sterling never certifies. The certificate carries the name of the body that issued it, and that independence is what makes it credible to your buyers.

What Sterling does is prepare your company so that the certification body's audit goes smoothly. We coordinate:

• a gap assessment against the standard;
• the management system itself: scope, risk assessment, policies, procedures and records, sized for your company;
• training for your people and an internal audit before the certification audit;
• management review and corrective actions;
• the certification audit process, from choosing an accredited body to closing any findings.

Consulting and auditing are always separated. The people who consult never audit you, so the internal audit is a genuine test and the certification body's audit is independent.

Sterling has completed 8,100+ client engagements in 60+ countries over 20+ years, and our experts bring 30+ years of experience.

^[1] About the IAF MLA (multilateral recognition arrangement). International Accreditation Forum (functions transferred to Global Accreditation Cooperation Inc., 1 Jan 2026). accessed October 23, 2026.

• NIST AI RMF: standard overviewStandard overview
• ISO/IEC 42001: standard overviewStandard overview
• EU AI Act: standard overviewStandard overview
• SOC 2: standard overviewStandard overview
• ISO/IEC 27001: standard overviewStandard overview
• Clear US Enterprise Security Reviews and Questionnaires FastUnited States
• ISO 42001 Explained for US AI CompaniesUnited States
• ISO 42001 and the EU AI Act for US CompaniesUnited States
• ISO/IEC 42001 for US AI Companies: What Buyers and Rules RequireUnited States
• Sterling in the United StatesUnited States

1. ISO/IEC 42001:2023, Information technology, Artificial intelligence, Management system (title as listed). ISO. accessed October 23, 2026.

2. AI Risk Management Framework (overview page: voluntary use; released January 26, 2023; NIST-AI-600-1 released July 26, 2024; AI RMF 1.0 being revised as part of the White House AI Action Plan). NIST. accessed October 26, 2026.

3. Artificial Intelligence Risk Management Framework (AI RMF 1.0), NIST AI 100-1. NIST. accessed October 26, 2026.

4. OMB Memorandum M-25-22, Driving Efficient Acquisition of Artificial Intelligence in Government (April 3, 2025). Executive Office of the President, OMB (whitehouse.gov). accessed October 26, 2026.

5. SB24-205 Consumer Protections for Artificial Intelligence (bill page and signed act). Colorado General Assembly. accessed October 26, 2026.

6. SB26-189 Automated Decision-Making Technology (bill page and signed act, May 14, 2026; status: became law). Colorado General Assembly. accessed October 26, 2026.

The information on this page is provided for general informational purposes only. It is not legal advice, and it is not a substitute for advice from a qualified attorney about your own situation.

Requirements depend on your scope, your customers' contracts, your industry and the regulations that apply to you. Two companies asking for the same standard can have very different obligations. We confirm yours during a gap assessment, and we update our content as standards change, but you should check the current text of any standard or rule that matters to you.

Sterling consults and prepares. It does not decide whether you meet a standard. That decision belongs to the independent party that performs the final step: the US-licensed CPA firm for a SOC 2 report, the Qualified Security Assessor or acquirer for PCI DSS, and the accredited certification body for ISO certificates. Timelines and outcomes depend on your readiness and on those parties.

Standards and marks named on this site belong to their respective owners.