A technology company asks its legal team to compare ISO/IEC 42001 and the NIST AI RMF for adoption. Which statement BEST describes a key structural difference between the two frameworks?
Select an answer to reveal the explanation.
Short Explanation
Here's the deal — you're comparing a management-system standard to a risk framework. ISO/IEC 42001 is built around Plan-Do-Check-Act, while the NIST AI RMF is organized around Govern, Map, Measure, and Manage.
Full Explanation
The best structural difference is that ISO/IEC 42001 follows a Plan-Do-Check-Act management system structure, consistent with other ISO standards, while the NIST AI RMF organizes its guidance around four core functions: Govern, Map, Measure, and Manage. The claim that the NIST AI RMF is mandatory regulatory while ISO/IEC 42001 is voluntary is wrong because both are voluntary frameworks. The claim that ISO/IEC 42001 only applies to AI systems in the European Union is wrong because ISO/IEC 42001 is an international standard with global applicability. The claim that the NIST AI RMF requires third-party certification while ISO/IEC 42001 does not is wrong because ISO/IEC 42001 can be certified, while the NIST AI RMF does not require third-party certification.