What is the difference between ISO/IEC 23894 and the NIST AI RMF?

ISO/IEC 23894 is not mentioned in the provided sources. However, the sources do discuss ISO/IEC 42001 and the NIST AI RMF, which are both AI governance frameworks.

The NIST AI RMF is structured around four functions: Govern, Map, Measure, and Manage, which guide organizations in establishing a culture, identifying risks, tracking performance, and responding to risks related to AI systems. ISO/IEC 42001, on the other hand, focuses on establishing, implementing, maintaining, and continually improving an AI Management System (AIMS) through clauses covering context, leadership, planning, support, operation, performance evaluation, and improvement.

Here are some key differences and overlaps:

• Framework Structure: The NIST AI RMF uses a functional approach (Govern, Map, Measure, Manage) to organize AI risk management activities. ISO/IEC 42001 follows a management system standard structure, similar to other ISO standards, with clauses like Context, Leadership, Planning, and Operation, culminating in Annex A controls for AI-specific aspects.
• Scope and Context: ISO/IEC 42001 emphasizes determining the organization's internal and external context, interested parties, and the scope of its AIMS (ISO/IEC 42001 Cl.4 Context). The NIST AI RMF's MAP function involves identifying and inventorying the AI system, its context, and its risks.
• Leadership and Policy: ISO/IEC 42001 requires top management to demonstrate leadership by establishing an AI policy, a documented AIMS, and assigning roles, responsibilities, and authorities for AI governance (ISO/IEC 42001 Cl.5 Leadership). This cross-maps to NIST-GOVERN-1.1, which addresses legal and policy requirements, and NIST-GOVERN-2.1, which focuses on roles, responsibilities, and accountability.
• Risk Assessment and Impact: ISO/IEC 42001 mandates processes for AI risk assessment and AI impact assessment (ISO/IEC 42001 Cl.6 Planning, A.5 AI impact assessment). The NIST AI RMF's MAP function also involves identifying and inventorying AI risks, and its MEASURE function includes analyzing and tracking risks.
• Continual Improvement: ISO/IEC 42001 explicitly includes a clause for continual improvement and corrective action for the AIMS (ISO/IEC 42001 Cl.10 Improvement). While the NIST AI RMF implies continuous improvement through its iterative functions, it does not have a dedicated top-level function named "Improvement" in the same way as ISO/IEC 42001.
• Generative AI Specifics: The NIST AI RMF includes a Generative-AI Profile (NIST AI 600-1) that names risks especially relevant to LLM/agent stacks, such as confabulation/hallucination, information security (e.g., prompt injection), data privacy, and value-chain integration. ISO/IEC 42001 addresses data governance (A.7 Data for AI systems) and third-party relationships (A.10 Third-party relationships) which are relevant to these GenAI risks.