ISO/IEC 23894 vs NIST AI RMF: Which AI Risk Framework Should Insurers, Banks, and Health Systems Use?

What each framework is

NIST released AI RMF 1.0 on January 26, 2023, as guidance for voluntary use by organizations that design, develop, deploy or use AI systems. NIST developed it following a direction from Congress, in collaboration with the private and public sectors. The NIST Generative AI Profile (NIST AI 600-1) is a cross-sectoral companion resource. It is not specific to healthcare or any other single industry.

ISO/IEC 23894:2023 is published as "Information technology, Artificial intelligence, Guidance on risk management." ISO describes it as setting out processes for the effective implementation and integration of AI risk management.

Both documents are guidance on risk management. Neither is a statute or a regulation. Obligations such as HIPAA, NAIC expectations or NYDFS expectations come from separate regulatory sources, and a framework only helps you meet them if you can show it is applied.

Side-by-side comparison

The table compares the two on criteria that matter when selecting a framework. It covers only what is established for each document.

• Origin and publisher: NIST AI RMF: U.S. NIST, developed after a congressional direction. ISO/IEC 23894: ISO, as an international standard.
• Status: NIST AI RMF: voluntary guidance, not a law. ISO/IEC 23894: guidance standard, not a law.
• Current version: NIST AI RMF: 1.0 from January 2023, with a revision in progress as of November 2026. ISO/IEC 23894: 2023 edition.
• Structure: NIST AI RMF: functions including Map, Measure and Manage, with a Playbook and a Generative AI Profile. ISO/IEC 23894: processes for implementing and integrating AI risk management.
• Intended users: NIST AI RMF: organizations that design, develop, deploy or use AI. ISO/IEC 23894: organizations integrating AI risk management into their practice.
• Mapping between them: A revised ISO/IEC 23894 to NIST AI RMF crosswalk from INCITS/AI dated August 14, 2025 supersedes the earlier 2023 crosswalk.

Choosing for an insurer, bank or health system

The practical question is not which framework is better. It is which one your organization can operate and defend. In our view, three criteria decide it: who will review your program, how much of your AI estate is generative, and how much your teams already work in an ISO-style process.

A U.S. health system will usually find the NIST AI RMF the easier operating structure. It is written for organizations using AI, it has a Playbook, and the Generative AI Profile covers generative use. ISO/IEC 23894 is a sensible addition where an international standard is expected or where risk management is already organized around ISO-style processes. Insurers and banks face the same choice, and the deciding factor is usually the expectations of their own supervisors and customers.

If you use both, rely on the 2025 INCITS/AI crosswalk rather than the superseded 2023 one. NIST states that listing a crosswalk does not imply endorsement, nor that either resource comprehensively covers the other. Assign someone to validate any mapping you adopt.

Because NIST has a revision of AI RMF 1.0 in progress, policies that cite it should name an owner who reviews the version they reference. Confirm the current text before basing control mappings on it.

Where guidance stops and runtime enforcement begins

Neither framework tells you how to control an individual AI interaction. The NIST Playbook describes Manage as the function in which risks, based on Map and Measure outputs, are prioritized, responded to and managed. That is a statement of outcome, and the mechanism is left to the organization.

In our analysis, some activities can be expressed as policy applied in the execution path. Examples are blocking a prompt that contains PHI bound for an unapproved model, redacting identifiers before a tool call, restricting which tools an agent may invoke, and routing a high-risk action to a human for approval. These turn a risk response into a decision made on each interaction.

Other activities stay organizational. Defining roles, responsibilities and review frequency for ongoing monitoring and periodic review is governance work. So are setting risk tolerance, deciding what counts as high risk, and reviewing framework versions. Runtime controls can carry out those decisions, but they cannot make them.

The split matters for audits. A framework adopted on paper shows intent. A framework with enforced policy and a record of each decision shows operation.

Evidence a healthcare reviewer is likely to want

For a health system, the central question is whether you can show what an AI system was allowed to do with PHI and what it did. HIPAA audit controls, including 164.312(b), are the relevant reference point for systems handling PHI. In practice, a reviewer is likely to want a record for each interaction or tool call that shows the policy in force, the decision taken (allow, redact, block or escalate), the time, and the identity of any human approver.

That record should be durable, retained under a set period, and kept where your data residency requirements allow. It should also be organized by framework function, so that monitoring and review activities can be traced to real production activity. Policy documents alone do not meet that test.

For a first step, list the framework activities you claim to perform. Mark each as enforced on interactions, supported by a record, or organizational only. The activities with no record are your audit gaps.

How Trussed fits

Trussed enforces policy in the execution path across models, agents, tools, MCP servers, AI sites and coding assistants. It can allow, redact, block, rate limit or escalate for human approval at the level of individual interactions and tool calls. Enforcement generates continuous audit-ready evidence mapped to HIPAA, NAIC, NYDFS, the EU AI Act and NIST. Trussed runs in production with healthcare and pharma organizations, and it can be self-managed in the customer cloud with configurable retention and data residency.

Trussed is runtime control, not a framework or a GRC tool. It does not replace choosing a framework or the organizational work of setting risk tolerance and review roles.