A method your engineers can use, and a system an auditor can certify.

• Valid and reliable
• Safe
• Secure and resilient
• Accountable and transparent
• Explainable and interpretable
• Privacy-enhanced
• Fair, with harmful bias managed

ISO 42001 asks you to set measurable AI objectives (clause 6.2), and its Annex C suggests themes such as fairness, privacy, robustness and transparency. The RMF's seven traits cover the same ground in plainer terms. Many teams lift them straight into the objectives table, then attach one metric and one owner to each.

1. GOVERN

   Set the house rules

   GOVERN runs across the other three. It is about culture, accountability and appetite for risk.

   What happens

   • Decide who may approve a model for use in hiring
   • Agree how much ranking error the business will tolerate

   You get

   • An AI policy and named roles (clause 5, A.2, A.3)
   • Risk criteria written into the clause 6.1 method

   Good practice

   • One named owner signs before launch

   Watch for

   • A policy that names no decision-maker

2. MAP

   Understand the setting

   MAP describes the system in its real context, before anyone measures anything.

   What happens

   • Describe the role, the applicants and the recruiters who rely on the ranking
   • List who could be hurt if rankings skew

   You get

   • Context and scope records (clause 4)
   • An AI system impact assessment (clause 6.1.4, A.5)

   Good practice

   • Applicants named as an affected group, not only paying customers

   Watch for

   • Mapping the model but not the hiring decision it feeds

3. MEASURE

   Put numbers on it

   MEASURE turns worries into tests, metrics and tracking.

   What happens

   • Test ranking quality and the gaps between applicant groups
   • Watch for drift after release

   You get

   • Verification and validation records (A.6)
   • Monitoring and measurement results (clause 9.1)

   Good practice

   • Metrics and pass thresholds fixed before testing starts

   Watch for

   • One headline accuracy figure with no breakdown

4. MANAGE

   Act on what you found

   MANAGE ranks the risks, picks treatments and handles failures in production.

   What happens

   • Choose a treatment for each ranked risk
   • Respond when the model misbehaves live

   You get

   • A risk treatment plan and Statement of Applicability (clause 6.1.3)
   • Nonconformity and corrective action records (clause 10)

   Good practice

   • A tested route for recruiters to override a ranking

   Watch for

   • Treatments that never reach the engineering backlog

Nothing in place yet: lead with the RMF vocabulary

Use GOVERN and MAP to produce an inventory and owners. Wrap that work in clauses 4 to 10 once buyers start asking for proof.

Buyers want proof now: lead with the AIMS

Certification answers procurement questionnaires. Borrow RMF subcategories as a prompt list inside your risk process.

RMF already running: keep it and certify around it

MAP and MEASURE outputs become impact assessments and test records. The AIMS adds internal audit, management review and corrective action.

• "We are NIST AI RMF certified". No such certificate exists. Say the program is aligned with, or informed by, the AI RMF.
• "Our ISO 42001 audit proves RMF alignment". The auditor tested the standard, not the RMF subcategories. Show your own mapping instead.
• Treating a crosswalk as evidence. A mapping table states intent. Auditors still sample records control by control.
• Mixing up the AI RMF and NIST CSF. The Cybersecurity Framework shapes a security program; the AI RMF deals with AI risk. Separate documents.

Sources: NIST AI 100-1, Artificial Intelligence Risk Management Framework (AI RMF 1.0), January 2023; NIST AI RMF Playbook; NIST AI 600-1, Generative Artificial Intelligence Profile, July 2024; NIST crosswalk material published on its AI Resource Center; public clause and Annex titles of ISO/IEC 42001:2023.