NIST AI Risk Management Framework, explained

What the NIST AI RMF is

The AI Risk Management Framework was published by the U.S. National Institute of Standards and Technology (NIST) in January 2023 as AI RMF 1.0, developed pursuant to the National Artificial Intelligence Initiative Act of 2020 through an open, consensus-driven process. It is intended to help organizations that design, develop, deploy, or use AI systems manage the associated risks and promote trustworthy and responsible AI.

Three properties define its character. It is voluntary — NIST does not certify or audit against it. It is rights-preserving and non-sector-specific, meaning it is written to apply across industries and use cases rather than to one regulated domain. And it is outcome-oriented rather than prescriptive: it describes what good AI risk management looks like and leaves the specific controls to the organization. That flexibility is why it is frequently referenced as a baseline by other frameworks, procurement requirements, and emerging regulation.

The four core functions: Govern, Map, Measure, Manage

The heart of the framework is four functions. Govern is cross-cutting — it applies across the other three rather than running in sequence — while Map, Measure, and Manage form an iterative cycle that repeats over a system's life. Each function is broken into categories and subcategories that describe concrete outcomes to work toward.

The trustworthiness characteristics

The framework organizes the properties of a trustworthy AI system into seven characteristics. They are meant to be balanced against one another in context — improving one can trade off against another — and no single characteristic on its own makes a system trustworthy. NIST treats validity and reliability as foundational: a system that is not valid and reliable cannot meaningfully claim the others.

• Valid and reliable — the system performs as intended and produces accurate results under expected conditions (the foundational precondition).
• Safe — it does not, under defined conditions, lead to a state that endangers human life, health, property, or the environment.
• Secure and resilient — it withstands adversarial attack and unexpected conditions and can return to normal function.
• Accountable and transparent — information about the system and its outputs is available to those who need it, and responsibility is clear.
• Explainable and interpretable — the mechanisms behind an output, and the meaning of that output in context, can be understood.
• Privacy-enhanced — it safeguards autonomy, identity, and dignity, applying privacy-preserving practices to data.
• Fair with harmful bias managed — it addresses harmful bias and discrimination and promotes equity across systemic, computational, and human-cognitive sources.

Profiles and the Playbook

The core functions are deliberately generic, so NIST provides two ways to make them concrete. The AI RMF Playbook offers suggested actions, references, and documentation for each subcategory — an organization selects the parts relevant to its context rather than applying all of it. Profiles adapt the framework to a specific use case, sector, or technology by selecting the functions, categories, and subcategories that apply.

Profiles come in two shapes. A use-case or cross-sectoral profile tailors the framework to a setting — for example, hiring or a specific industry. A temporal profile describes a current state versus a target state, which lets an organization plan improvements as a gap between where its AI risk management is today and where it wants it to be. NIST has also published the Generative AI Profile (NIST AI 600-1, July 2024), a companion resource that identifies risks unique to or amplified by generative AI and suggested actions to manage them.

Why 'voluntary' still matters

Because the AI RMF is not a law or a certifiable standard, no regulator requires it by name and no body issues a certificate for it. That can make it easy to underestimate. In practice it has become a common reference point: buyers ask vendors to describe their AI risk management against it, and some emerging AI regulation points to recognized risk-management frameworks — the AI RMF among them — as evidence of reasonable care. Aligning to it does not by itself create legal compliance, but it can support the case that an organization managed risk responsibly.

It also pairs cleanly with certifiable regimes. A management-system standard such as ISO/IEC 42001 defines the auditable AI management system; the AI RMF supplies a detailed, outcome-oriented vocabulary for the risk work inside it. Many teams use the two together — the standard for the certificate, the framework for the substance.

How to operationalize the AI RMF

Turning the framework into practice means treating each function as ongoing work with evidence behind it, not a one-time document. The failure mode is a governance binder that describes intentions no one can show operating. Auditors, buyers, and regulators increasingly want to see the risk work happening — assessments dated to the systems they cover, measurements re-run as models change, and decisions recorded with who made them and when.

• Start with Govern: assign accountability, write the policies, and decide who signs off on high-impact AI before you inventory systems.
• Use Map to build an inventory of AI systems with their purpose, context, affected stakeholders, and known limitations — you cannot manage what you have not catalogued.
• Make Measure repeatable: define how each system is tested and tracked against the trustworthiness characteristics, and re-run it when the model or data changes.
• Close the loop with Manage: prioritize by projected impact, record the treatment decision, and keep the trail so the response can be reproduced later.
• Adopt a profile rather than the whole core — select the subcategories that fit your use case, and treat a current-versus-target profile as your improvement roadmap.

Frequently asked questions