EAUS vs ISO 42001 vs SOC 2 vs NIST AI RMF: which does a business your size need?
October 22, 2026
Four names come up whenever a business asks how to prove it handles AI properly, and they are routinely talked about as if they were competitors. They aren't, quite. One is guidance you follow yourself. One certifies the management system around AI. One attests to your security controls and barely mentions AI at all. And one certifies how your people actually use AI day to day. Choosing between them starts with noticing they answer four different questions — and that most businesses need at most two of them, in the right order. Our existing post compares three of these in depth — AI use certification vs ISO 42001 vs SOC 2. This hub adds the fourth, the NIST AI Risk Management Framework, and covers the thing the three-way comparison doesn't: how the four fit together.
Quick answer
NIST AI RMF — a free, voluntary playbook from the US National Institute of Standards and Technology for organising AI risk work. Nobody checks you against it. Use it as the scaffold for your internal program.
ISO/IEC 42001 — a certifiable international standard for an AI management system. Accredited auditors, months of work, five-figure cost for most small organizations. Use it when you build AI products or a contract requires it.
SOC 2 — not a certification and not about AI: a CPA firm's attestation report on your security and related controls, shared with customers under NDA. Use it when enterprise customers demand security assurance.
EAUS (Ethicality) — a certification of AI use: an independent assessment of how your people work with AI, against 15 plain-language requirements, with a public registry entry. Use it when clients ask how your firm uses AI on their work and you want the answer checked, not just stated.
The four, one by one
NIST AI RMF — the playbook
Published by NIST in January 2023, the AI Risk Management Framework organises AI governance into four functions — Govern, Map, Measure, Manage — and leaves the implementation to you. It is voluntary, free to download, and deliberately flexible: a structure for thinking, not a bar to clear. There is no NIST audit, no certificate, no registry; "we follow the NIST AI RMF" is a self-description, and its credibility rests entirely on the work behind it. That makes it the right starting point for an internal program — our minimum viable governance program is built on it — and the wrong thing to offer a customer as proof. Proof is what the other three are for.
ISO/IEC 42001 — the management system
ISO/IEC 42001:2023, published in December 2023, is the first international standard for an AI management system: the policies, roles, risk processes and improvement cycle an organization runs around AI, whether it produces, provides or uses AI systems. It follows the same Annex SL clause structure (clauses 4–10, with 38 reference controls in Annex A) as ISO 27001, so organizations with an existing management system will recognise the machinery. Certification comes from an accredited certification body after documentation and implementation audits; the certificate runs three years with annual surveillance. It is a serious, credible instrument — and a serious project. It certifies that you manage AI systematically. It does not, by itself, tell a client how your staff used AI on their matter last Tuesday.
SOC 2 — the security attestation
SOC 2 is the odd one out: it is not about AI, and it is not a certification. It's an attestation report in which a licensed CPA firm examines your controls against the AICPA's Trust Services Criteria — Security, plus any of Availability, Processing Integrity, Confidentiality and Privacy you include. A Type I report covers control design at a point in time; a Type II covers whether the controls actually operated over an observation period, typically three to twelve months — the Type II is what enterprise procurement asks for. Reports are shared with customers under NDA, never published. If your customers' core anxiety is the security of the data they hand you, SOC 2 is the recognised answer, and none of the other three substitutes for it. If their anxiety is how you use AI, SOC 2 doesn't address it: a firm can hold a clean SOC 2 and still paste client files into a consumer chatbot.
EAUS — the use certification
The Ethicality AI Use Standard (EAUS) covers the layer the others don't: the daily practice of using AI at work. It is 15 plain-language requirements built on three ideas — disclosing meaningful AI use, keeping a human responsible for important decisions, and protecting confidential information. An independent assessment checks your actual arrangements (your approved tools, your data rules, your review habits, your disclosure practice), and passing produces a badge, a numbered certificate and an entry in a public registry anyone can verify without asking you. It does not certify a management system, a product or your security controls, and it doesn't claim to. It's the answer to the question clients actually ask firms that use AI: "how do you use this stuff on my work, and who checked?"
Side by side
| NIST AI RMF | ISO/IEC 42001 | SOC 2 | EAUS | |
|---|---|---|---|---|
| Kind of instrument | Voluntary guidance framework | Certifiable management-system standard | Attestation report (AICPA) | Certification standard for AI use |
| Question it answers | "How should we organise our AI risk work?" | "Do we run AI through a managed system?" | "Are our security controls designed and working?" | "Do our people use AI transparently and responsibly?" |
| Who checks | Nobody — self-applied | Accredited certification bodies | Licensed CPA firms | Ethicality certification officers |
| Proof you can show | Your own documentation | A certificate (3-year cycle) | A report, under NDA only | Badge + numbered certificate + public registry entry |
| Typical cost, small organization | Free (your staff time) | $15,000–$35,000 under 50 employees (CertPro estimate) | ~$25,000–$45,000 first year all-in for a small company (vendor estimates) | $300–$700/yr for up to 50 people, published |
| Typical time | Self-paced | 4–6 months with managed help; 8–12 self-directed (Bastion) | Months of preparation plus a 3–12 month observation window for Type II | ~10 minutes to apply; decision within 5 business days |
| Renewal | None | Annual surveillance, re-certification at 3 years | New report roughly annually | Annual re-attestation |
Cost figures for ISO 42001 and SOC 2 are third-party vendor estimates, not price lists — our AI certification cost guide breaks down where they come from and what drives them. EAUS pricing is published on our pricing page: $300 USD a year for 1–10 people, $700 for 11–50, $1,500 for 51–200, $3,000 for 201–500, quoted above that.
How they combine
These stack more often than they substitute:
NIST AI RMF underneath anything. Whichever assurance route you take, the internal work — inventory, risk thinking, named ownership — has to exist, and the RMF is the cheapest credible structure for it. Everything else on this page audits or attests a program; the RMF helps you build one.
EAUS + SOC 2 is the common pairing for professional firms and agencies: SOC 2 answers the customer's security review, EAUS answers their AI-use questions, and the two reviews ask almost entirely different questions, so little work duplicates.
ISO 42001 subsumes much of the RMF's ground inside a certifiable system — organizations heading for 42001 often use the RMF as their working method on the way, then let the certification audit be the proof.
EAUS before ISO 42001 is a sensible order when clients are asking AI-use questions now and the management-system build is a later budget line: the practice EAUS checks (inventory, data rules, human responsibility, disclosure) is the same ground a 42001 program formalises, so the work compounds instead of being redone.
What doesn't work: treating any one of the four as a generic "AI compliance" stamp. Each proves a specific claim, and sophisticated buyers know which claim they asked for.
Which does a business your size need?
| If this is your situation | Start here |
|---|---|
| You need to get your own house in order before proving anything | NIST AI RMF, self-applied — then decide what proof you need |
| Clients ask how your firm uses AI on their work | EAUS certification |
| An enterprise customer's security review is blocking deals | SOC 2 (Type II if they're enterprise) |
| You build or sell AI products, or a contract names an AI management system | ISO/IEC 42001 |
| Clients ask both the security and the AI-use questions | SOC 2 + EAUS, in whichever order the live deal demands |
For the deeper three-way treatment of certification versus attestation — including what each one tells a client and what it pointedly doesn't — read AI use certification vs ISO 42001 vs SOC 2.
Frequently asked questions
Is SOC 2 a certification?
No. It's an attestation report: a CPA firm examines your controls and issues an opinion covering a period. There is no certificate and no logo you're licensed to display, and the report itself is shared under NDA. Vendors who advertise being "SOC 2 certified" are using shorthand their auditors wouldn't.
Can we say we're "NIST AI RMF certified"?
No — NIST doesn't certify anyone against the framework, and no third party can certify you "to NIST" either. You can say you align your program to it, and show the work. If a customer needs independently checked proof, that's what the certification routes on this page are for.
Does ISO 42001 replace the need for EAUS, or vice versa?
Neither replaces the other. ISO 42001 certifies the management system around AI — the policies, risk processes and improvement cycle. EAUS certifies the practice of AI use by your people, and publishes the result in a registry your clients can check in seconds. A firm can reasonably hold both; a firm that only uses AI tools usually finds EAUS answers the question being asked, at roughly one percent of the cost and timeline.
Why is the cost gap so large?
Because the scopes differ by an order of magnitude. A management-system certification audits a documented system across your whole organization, over months, by an accredited body. An AI-use certification assesses a defined set of practices, from evidence you mostly already have once your house is in order. Compare what each certifies before comparing what each costs — our cost guide does the line-by-line version.
We already have ISO 27001. Does that change the answer?
It shortens ISO 42001 considerably — the management-system structure is shared, and much of the machinery (document control, internal audit, management review) carries over. It doesn't answer the AI-use question by itself, for the same reason SOC 2 doesn't: information security management and transparent AI use are neighbouring claims, not the same one.
Which one do customers actually ask for by name?
In North American enterprise procurement, SOC 2 by name, constantly. ISO 42001 appears where AI is the product or the buyer is European or regulated. NIST AI RMF appears as a reference framework in questionnaires ("is your program mapped to…") rather than a deliverable. EAUS appears when the question is specifically about AI use — which is the fastest-growing question of the four, and the one the other three were not built to answer.
Prove the claim you're actually making
Pick the instrument that matches the question your customers are asking. Organise the work on the NIST framework because it's free and sound. Answer the security review with SOC 2 if you face one. Build the management system when your scale or your contracts demand it. And when the question is how your people use AI — the question behind most of the others — have that checked and put it where anyone can verify it: get certified, or read the standard first.