When a Colombian company decides to "get its house in order" on AI adoption, two frameworks appear in every whitepaper: ISO/IEC 42001:2023 and NIST AI RMF 1.0. Both cover governance, risk management, and AI system controls. But they differ in nature and practical application.
This is the comparison we do with our AI consulting clients from Neiva.
The two at a glance
ISO 42001: International, certifiable, HLS structure, prescriptive (39 controls Annex A).
NIST AI RMF: US-origin, voluntary, 4 functions (Govern/Map/Measure/Manage), guidance-oriented, strong on GenAI (2024 profile).
Which one for Colombia?
ISO 42001 if:
- You sell to Colombian public sector or its integrators.
- You have international clients (European, LATAM corporate) auditing suppliers.
- You already have ISO 27001 or 9001 — integration is natural.
- You want a clear market signal (badge, contract mention).
NIST AI RMF if:
- Main clients in the US.
- You deploy generative AI at scale and need detailed technical framing.
- Prefer flexibility over certification.
Both if:
Most common in mid-size exporters. ISO 42001 as governance framework (policy, roles, audit), NIST AI RMF as operational technical guide. They complement — ISO 42001 says WHAT, NIST says HOW.
Our rule: start with NIST (free, guidance-oriented) for 2-3 months to "read the terrain". Then build ISO 42001 on top. Total: 6-9 months to certification.
How we help
In our AI Consulting practice we do context assessment and recommend ISO 42001, NIST AI RMF or both based on your clients and sector. We work from Neiva (Huila) with companies in southern Colombia and LATAM in hybrid mode.