NIST AI RMF

The NIST AI Risk Management Framework (AI RMF 1.0) is a voluntary framework for identifying and managing risk in AI systems. It organizes the work into four functions — Govern, Map, Measure and Manage — and defines the characteristics that make an AI system trustworthy. It is not certifiable and carries no penalties, but it produces the risk-management evidence that binding regimes such as the EU AI Act ask for.

What the framework is for

AI risk is hard to quantify. Third-party models and data carry risk an organization cannot inspect, new failure modes appear after deployment, and reliable metrics are scarce. The NIST AI RMF exists to give that problem a structure rather than a checklist.

Four points define how it is meant to be used:

• It does not set your risk tolerance. The framework insists you define one, based on context, legal obligation and sector norms, but it will not tell you what it should be.
• Not all risks rank equally. Resources follow assessed risk and impact, and residual risk is documented rather than quietly accepted.
• AI risk is enterprise risk. It belongs alongside cybersecurity and privacy risk, not in a separate register owned by a data science team.
• Trustworthiness is the goal, not compliance. The framework is explicit about human-centricity, social responsibility and accountability.

The characteristics of trustworthy AI

The framework names the properties a trustworthy system balances. They pull against each other, and the tradeoffs are decided per use case rather than centrally.

• Valid and reliable — accurate and robust, validated against test sets that represent real intended use.
• Safe — does not endanger life, health or the environment, with clear guidance on responsible use.
• Secure and resilient — protected against adversarial examples, data poisoning and model theft, and able to recover.
• Transparent and accountable — information about design, data and decisions available to each actor by role, enabling redress.
• Explainable and interpretable — users can establish why a system produced a given output.

The four core functions

Govern

Govern is foundational and cuts across the other three. It establishes governance structures, defines roles, and holds the organization to legal and ethical obligations. In practice it requires:

• An inventory of AI systems, resourced according to organizational risk priorities.
• Ongoing monitoring and periodic review of deployed systems, with named owners and a defined review frequency.
• Accountability structures that empower and hold specific people responsible.
• Safe decommissioning, so trustworthiness is not lost when a system is retired.
• Training for personnel and partners on AI risk management.
• Executive ownership of decisions about AI system risk.
• Workforce diversity and accessibility informing decisions across the lifecycle.

Map

Map establishes what you actually have and where it operates: the system lifecycle from design through deployment, documented components, and the contexts of use that determine how risk should be read. A model that is low risk in one deployment is high risk in another, and Map is where that gets established.

Measure

Measure assesses and quantifies. Risks are identified and weighed on likelihood and impact against the trustworthiness characteristics, metrics are developed, and monitoring runs continuously rather than at audit time.

Manage

Manage is the action. Risk responses are planned and implemented, their effectiveness is monitored, and practices improve on the evidence that monitoring returns.

Profiles: how the framework is specialised

The framework is applied through profiles rather than adopted wholesale.

Use-case profiles tailor the functions and categories to a specific application, given its user requirements, risk tolerance and resources. Temporal profiles describe either a current state or a target state; comparing the two produces the gap analysis and the action plan. NIST deliberately provides no profile templates, leaving implementation flexible.

Several profiles now sit on top of the core framework:

• NIST AI 600-1, the Generative AI Profile. Published 26 July 2024, it catalogs twelve risks specific to generative AI and maps mitigations back onto Govern, Map, Measure and Manage. If you work with large language models or multimodal systems, this is the document that makes the framework actionable. A March 2025 update extended it to supply chain vulnerabilities and third-party model assessment — the gap most organizations hit first when they adopt a model they did not train.
• SP 800-53 Control Overlays for Securing AI Systems. In development, including COSAiS overlays for single-agent and multi-agent deployments, aimed at federal AI use in high-risk categories.
• Trustworthy AI in Critical Infrastructure. NIST released a concept note for this profile on 7 April 2026.

The direction is consistent: the framework is being specialised by deployment context rather than rewritten. The four functions have not changed since 1.0.

NIST's wider AI program

The AI RMF is the best known piece of NIST's AI work but not the whole of it, and two adjacent efforts matter when planning against it.

NIST GenAI is an evaluation program rather than a framework. It runs challenge problems open to academia, industry and research labs, benchmarking both systems that generate content and the discriminators built to detect it — the first concentrating on telling human-written text from machine-written text. The practical significance is that content provenance is being treated as a measurement problem with published benchmarks, rather than a claim vendors get to make about themselves. Anyone whose risk register includes synthetic media or deepfakes should expect detection claims to be assessed against this kind of benchmark rather than taken at face value.

The AI Safety Institute sits alongside it, tasked with evaluating frontier model risk. Its existence is what makes the independence question in AI safety testing tractable: agreements between NIST and major developers point toward external evaluation of models before release, instead of the self-assessment the industry currently runs on.

Where it fits against binding regulation

NIST AI RMF is voluntary and cannot be certified against, which leads people to dismiss it. That misreads what it is for. It is a method, and it generates exactly the documentation that enforceable regimes demand.

A workable combination for most organizations: run the AI RMF as the risk method, use it to produce the technical documentation and risk assessments the EU AI Act requires, and wrap ISO/IEC 42001 around it for the certifiable management system an auditor can sign. For the step-by-step walkthrough, see how to use the NIST AI Risk Management Framework. The AI RMF Playbook is NIST's own companion resource for the same purpose.

Our take

We treat NIST as the reference point for security controls. We have implemented the NIST Cybersecurity Framework and NIST 800-53 across many organizations, and those frameworks have held up. The AI RMF is younger, but it rests on the same foundation that most security professionals already work in, which makes adoption far cheaper than its page count suggests.

The honest limitation is that a voluntary framework with no certificate is easy for a board to defer. The organizations that get value from it are the ones that treat Govern as the entry point — inventory, owners, review cadence — rather than starting with Measure and stalling on metrics. AISGRC provides a free scorecard to identify governance gaps before implementation.

Related frameworks

NIST AI RMF supplies the risk method, not an auditable certificate. For the certifiable management system that pairs with it, see ISO/IEC 42001. To threat model systems against real attacker behaviour, see MITRE ATLAS and the OWASP Top 10 for LLM Applications. For how all five relate, see the AI security framework comparison.