AI governance

What is the NIST AI Risk Management Framework?

The NIST AI Risk Management Framework (AI RMF 1.0) is a voluntary US framework for managing the risks of AI. Released in 2023, it is organized around four functions, Govern, Map, Measure, and Manage, to help organizations build trustworthy and responsible AI.

Definition

The NIST AI Risk Management Framework (AI RMF 1.0) is a voluntary framework published by the US National Institute of Standards and Technology to help organizations identify, assess, and manage risks across the AI lifecycle.

Background

Released in 2023, the AI RMF is voluntary and technology-neutral. Its core is organized into four functions: Govern (a culture of risk management that cuts across the others), Map (establish context and identify risks), Measure (analyze and track risks), and Manage (prioritize and act on them). These functions break down into categories, and NIST provides a companion Playbook and profiles, including one for generative AI, to help teams apply the framework.

Why it matters

The AI RMF gives organizations a common, flexible vocabulary and process for AI risk, which is useful whether or not a specific law applies. It pairs well with a management standard like ISO 42001 and with regulatory work such as EU AI Act readiness, because it focuses on identifying and reducing AI risk in practice.

Step by step

1. Govern: set AI risk-management policies, roles, and accountability.
2. Map: establish the context and identify the risks of each AI system.
3. Measure: analyze, assess, and track those risks with appropriate methods.
4. Manage: prioritize risks and act to reduce them across the lifecycle.
5. Iterate as systems and their context change.

Examples

• A team uses the Map and Measure functions to document and assess risks in a new model before release.
• An organization adopts the AI RMF as its internal method and layers ISO 42001 on top for a certifiable management system.

Common mistakes

• Treating the AI RMF as mandatory; it is voluntary, though many organizations adopt it as good practice.
• Using it only once instead of continuously across the AI lifecycle.
• Assuming it certifies you; the AI RMF is a framework, not a certification like ISO 42001.

FAQ