---
id: ORG-STANDARDS-001
title: "Standards Bodies (ISO/IEC, NIST)"
alternative_names:
  - "AI Standardization Organizations"
  - "ISO/IEC JTC 1/SC 42"
  - "NIST AI Risk Management Framework"
category: "People & Organizations → Organizations"
volume: X
chapter: 56
entry_type: "Standard Article"
level: 3
status: "Draft"
last_reviewed: 2026-10-18
version: "0.1.0"
prerequisites:
  - "GOV-LAW-001"
related_entries:
  - "GOV-EU-001"
  - "GOV-US-001"
  - "GOV-INTL-001"
  - "ORG-SAFETY-001"
  - "ORG-LABS-001"
---

# Standards Bodies (ISO/IEC, NIST)

## 1. Concise Definition
A **standards body** is an organization that develops technical documents (standards, frameworks, guidance) intended to be used voluntarily by firms and, in some jurisdictions, referenced by regulation. For AI the principal bodies covered here are the joint ISO/IEC technical committee ISO/IEC JTC 1/SC 42, the U.S. National Institute of Standards and Technology (NIST), and the European committee CEN-CENELEC JTC 21. Their documents are not laws; their legal relevance depends on whether a statute or regulation refers to them.

## 2. Overview & Significance
Standards translate broad principles into auditable practice: definitions, management processes and risk-management steps. In AI governance they matter for two reasons. First, they provide a shared vocabulary, which regulation and contracts can reuse. Second, in the European Union, harmonised standards are designed to give companies a "legal presumption of conformity" with the AI Act once their references are published in the Official Journal (CEN-CENELEC, n.d.). This article describes what the named bodies and documents are, with dates read from official pages. It does not assess how widely any standard is adopted, which is not established by the sources used.

## 3. Historical Development
- **ISO/IEC JTC 1/SC 42.** ISO's committee page lists its creation date as 2017 and its scope as "Standardization in the area of Artificial Intelligence", serving as "the focus and proponent for JTC 1's standardization program on Artificial Intelligence" (ISO, n.d.-a).
- **ISO/IEC 22989:2022.** Title: *Information technology - Artificial intelligence - Artificial intelligence concepts and terminology* (ISO/IEC, 2022).
- **NIST AI RMF 1.0.** Released 26 January 2023 as NIST AI 100-1; NIST states that it was developed "through a consensus-driven, open, transparent, and collaborative process" including a request for information, draft versions, and workshops, and that it is "intended for voluntary use" (NIST, n.d.-a; Tabassi, 2023). NIST launched a Trustworthy and Responsible AI Resource Center on 30 March 2023.
- **ISO/IEC 23894:2023 and ISO/IEC 42001:2023.** ISO lists *Guidance on risk management* (23894) and *Management system* (42001) as published first editions in 2023; 42001 is dated 2023-12 on ISO's page (ISO, n.d.-b; ISO, n.d.-c).
- **CEN-CENELEC JTC 21.** The European committee states it was "established on June 1, 2021" and brings together "over 300 experts from more than 20 countries" (CEN-CENELEC, n.d.). The counts are the committee's own and were read on a page whose date was not recorded.
- **NIST Generative AI Profile.** On 26 July 2024 NIST released NIST AI 600-1, *Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile* (NIST, 2024; NIST, n.d.-a).
- **2026 updates.** NIST's AI RMF page, read 2026-10-15, states that on 7 April 2026 NIST released a concept note for an AI RMF Profile on Trustworthy AI in Critical Infrastructure, and that "the AI RMF 1.0 is being revised as part of the White House AI Action Plan" (NIST, n.d.-a). Details of the revision were not read.

## 4. Technical / Conceptual Explanation
### 4.1 The two main document types
- **Requirements standards** specify what an organization must do to claim conformity. ISO/IEC 42001 "specifies requirements for establishing, implementing, maintaining, and continually improving an Artificial Intelligence Management System (AIMS) within organizations" that provide or use AI-based products or services (ISO, n.d.-b). ISO describes it as "the world's first AI management system standard".
- **Guidance and frameworks** describe good practice without a conformity claim. ISO/IEC 23894 "provides guidance on how organizations that develop, produce, deploy or use products, systems and services that utilize artificial intelligence (AI) can manage risk specifically related to AI" (ISO, n.d.-c). The NIST AI RMF is a voluntary framework whose goal is "to offer a resource to the organizations designing, developing, deploying, or using AI systems to help manage the many risks of AI and promote trustworthy and responsible development and use of AI systems" (Tabassi, 2023).

### 4.2 Relationship between the documents
The ISO/IEC documents are international consensus standards developed by national delegations and sold by ISO. NIST documents are produced by a U.S. federal laboratory and are freely downloadable. NIST states that its framework was directed by the National Artificial Intelligence Initiative Act of 2020 (Tabassi, 2023). Whether and how particular clauses of the ISO and NIST documents correspond is addressed by crosswalk documents on NIST's site (NIST, n.d.-a); a clause-level comparison is not made in this article.

### 4.3 Standards and regulation in the EU
Regulation (EU) 2024/1689 (the Artificial Intelligence Act) is dated 13 June 2024 (European Parliament & Council, 2024). CEN-CENELEC JTC 21 states that its work includes developing harmonised standards for conformity under the Act, that "a standardization request is issued by the commission", and that once published in the Official Journal of the European Union they "will provide companies with a legal presumption of conformity" (CEN-CENELEC, n.d.). The progress of that work, the number of standards completed and any adjustment to the Act's application schedule were not confirmed from official sources for this draft. [VERIFICATION NEEDED: current status of AI Act harmonised standards and any change to application dates; see [GOV-EU-001]]

## 5. Types, Components & Classifications
| Body | Type | Selected documents (verified titles) | Binding force |
| :--- | :--- | :--- | :--- |
| ISO/IEC JTC 1/SC 42 | International standards committee | ISO/IEC 22989:2022; ISO/IEC 23894:2023; ISO/IEC 42001:2023 | Voluntary unless referenced by law or contract |
| NIST (U.S.) | National metrology and standards agency | AI RMF 1.0 (NIST AI 100-1, 2023); AI 600-1 Generative AI Profile (2024) | Voluntary |
| CEN-CENELEC JTC 21 | European standards committee | Harmonised standards for the EU AI Act (status unverified) | Presumption of conformity once cited in the Official Journal |

ISO's catalogue also lists further SC 42 publications, for example one numbered 42005:2025, on ISO's 42001 page; its subject was not read.

## 6. Applications & Concrete Examples
- An organization can adopt ISO/IEC 42001 as the basis of an internal AI management system, because the standard defines requirements for such a system (ISO, n.d.-b).
- Developers and deployers can use the NIST AI RMF and its Generative AI Profile as non-binding checklists for risk management. NIST states that example uses by other organizations are collected on its AI Resource Center use-case page (NIST, n.d.-a).
- A cross-reference to legal texts: an EU AI Act compliance programme may rely on harmonised standards once they exist (CEN-CENELEC, n.d.).

No claim is made here about market adoption, certification counts or enforcement actions; these were not researched.

## 7. Advantages, Limitations & Unresolved Questions
**Advantages.** Shared terminology (ISO/IEC 22989), repeatable process requirements (ISO/IEC 42001) and published frameworks (NIST) lower the cost of comparing practices across organizations.

**Limitations.**
- **Process, not outcome.** A management-system or framework document structures how risk is handled; it does not by itself fix model behavior or measure it.
- **Access.** ISO documents are sold (the 42001 page lists a price in Swiss francs), whereas NIST documents are free. That is a practical difference in availability, not a statement on quality.
- **Moving targets.** The NIST AI RMF is under revision according to NIST (2026), and the EU harmonised standards are in development; any description may become outdated.
- **Scope limits.** Standards address general organizational practice; whether they adequately address frontier-model or catastrophic risks (see [SAFE-XRISK-001]) is an open question not answered by the sources used.

**Unresolved questions.** (1) How closely standards track technical practice at the frontier. (2) Whether conformity to a standard correlates with safer outcomes. No evidence on either was gathered for this draft; both are **Contested/Unstudied** as far as this article can say.

## 8. Current State of Knowledge
As of 2026-10-15: ISO/IEC 22989:2022, 23894:2023 and 42001:2023 are published standards; NIST AI RMF 1.0 and the Generative AI Profile are published, with a revision of the former announced; CEN-CENELEC JTC 21 states it is developing harmonised standards. The status of the latter, and whether any of the EU harmonised standards have been cited in the Official Journal, is not confirmed here. For application dates and obligations under the AI Act see [GOV-EU-001], and for U.S. policy see [GOV-US-001].

## 9. Future Trajectory & Strategic Outlook
No registered forecasts. Observed items: a stated NIST revision of the AI RMF and a new critical-infrastructure profile concept note (April 2026); continuing work of JTC 21 on harmonised standards. Anything beyond these is outside the evidence gathered. Whether standards bodies will develop frontier-model-specific standards is **Hypothetical** and unsourced here.

## 10. Related Entries & Knowledge Graph
- **Foundational Concepts**:
  - [[GOV-LAW-001] AI Governance](../vol08_safety_governance/GOV-LAW-001_ai_governance.md): The legal landscape in which standards are used.
- **Related Methods & Technologies**:
  - [[GOV-EU-001] The EU AI Act](../vol08_safety_governance/GOV-EU-001_the_eu_ai_act.md): Regulation relying on harmonised standards.
  - [[GOV-US-001] United States AI Policy](../vol08_safety_governance/GOV-US-001_united_states_ai_policy.md): Context for NIST's work.
  - [[GOV-INTL-001] International AI Governance and Compute Governance](../vol08_safety_governance/GOV-INTL-001_international_ai_governance_and_compute_governance.md): International coordination.
- **Institutions**:
  - [[ORG-SAFETY-001] AI Safety Institutes and Research Organizations](./ORG-SAFETY-001_ai_safety_institutes_and_research_organizations.md): CAISI (named CAISSI on NIST's site as of 2026-10-18) sits within NIST.
  - [[ORG-LABS-001] Frontier AI Laboratories](./ORG-LABS-001_frontier_ai_laboratories.md): Developers who may reference these standards.

## 11. References & Foundational Literature
1. CEN-CENELEC. (n.d.). *Artificial Intelligence* (CEN-CENELEC topic page on JTC 21). https://www.cencenelec.eu/areas-of-work/cen-cenelec-topics/artificial-intelligence/. [Establishment date, scope and role in AI Act harmonised standards; page read 2026-10-15.]
2. European Parliament & Council of the European Union. (2024). *Regulation (EU) 2024/1689 of 13 June 2024 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act)*. Official Journal of the European Union. https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng (read via web archive). [Identifies the Regulation and its date.]
3. International Organization for Standardization. (n.d.-a). *ISO/IEC JTC 1/SC 42 - Artificial intelligence*. https://www.iso.org/committee/6794475.html (read via web archive, 2025 snapshot). [Committee creation date (2017) and scope.]
4. International Organization for Standardization. (n.d.-b). *ISO/IEC 42001:2023 - Information technology - Artificial intelligence - Management system*. https://www.iso.org/standard/81230.html (read via web archive, 2025 snapshot). [Scope of the AI management system standard and publication date 2023-12.]
5. International Organization for Standardization. (n.d.-c). *ISO/IEC 23894:2023 - Information technology - Artificial intelligence - Guidance on risk management*. https://www.iso.org/standard/77304.html (read via web archive, 2025 snapshot). [Abstract of the AI risk-management guidance.]
6. ISO/IEC. (2022). *ISO/IEC 22989:2022 - Information technology - Artificial intelligence - Artificial intelligence concepts and terminology*. https://www.iso.org/standard/74296.html (read via web archive). [Title and edition of the AI terminology standard.]
7. National Institute of Standards and Technology. (n.d.-a). *AI Risk Management Framework*. https://www.nist.gov/itl/ai-risk-management-framework. [Release dates, Resource Center, Generative AI Profile date, April 2026 concept note and revision notice; page read 2026-10-15.]
8. National Institute of Standards and Technology. (2024). *Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile* (NIST AI 600-1). https://doi.org/10.6028/NIST.AI.600-1. [Crossref record gives a release date of 2024-07-26.]
9. Tabassi, E. (2023). *Artificial Intelligence Risk Management Framework (AI RMF 1.0)* (NIST AI 100-1). National Institute of Standards and Technology. https://doi.org/10.6028/NIST.AI.100-1. [The framework itself; Crossref record gives 2023-01-26.]

## 12. Evidential Classification Matrix
| Section / Claim | Evidence Category | Supporting Source | Confidence / Status |
| :--- | :--- | :--- | :--- |
| NIST AI RMF 1.0 released 2023-01-26 as NIST AI 100-1 | Established (official record) | Tabassi (2023); NIST (n.d.-a) | High |
| NIST Generative AI Profile released 2024-07-26 | Established (official record) | NIST (2024); NIST (n.d.-a) | High |
| ISO/IEC 42001:2023 specifies AI management system requirements | Established (publisher description) | ISO (n.d.-b) | High |
| ISO/IEC 23894:2023 provides AI risk-management guidance | Established (publisher description) | ISO (n.d.-c) | High |
| ISO/IEC JTC 1/SC 42 created 2017 | Established (publisher record) | ISO (n.d.-a) | High |
| CEN-CENELEC JTC 21 established 2021-06-01; role in AI Act | Well Supported (committee's own statement) | CEN-CENELEC (n.d.) | Moderate |
| NIST AI RMF 1.0 under revision | Well Supported (NIST's own notice) | NIST (n.d.-a) | Moderate; details unread |
| Harmonised standards status for the AI Act | Not established | None | Unverified |
| Effect of standards on outcomes | Contested / Unstudied | None cited | Open question |

## 13. Revision History
- **v0.1.0** (2026-10-15): Initial draft. Citations checked against arXiv/Crossref/publisher pages where marked; not independently fact-checked.