FAQ
What do NIST AI RMF, ISO/IEC 42001 and the EU AI Act each require of a company our size?
Answer
The answer
None of the three sets a headcount threshold. NIST's AI RMF is voluntary guidance built around four functions: govern, map, measure and manage. ISO/IEC 42001 is a certifiable standard for running an AI management system. The EU AI Act is binding law: what you owe depends on being a provider (building AI into what you sell) or a deployer (only using it inside the business), plus the system's risk tier, not your size.
Published · Updated
Sources
- NIST AI Risk Management Framework
nist.gov
- ISO/IEC 42001:2023
iso.org
- Regulation (EU) 2024/1689
eur-lex.europa.eu