NIST AI RMF

The NIST AI Risk Management Framework (AI RMF 1.0) is a voluntary US framework, published in January 2023, for identifying and managing the risks that AI systems create for people, organizations, and society.

It is organized around four functions: Govern (policies, roles, and accountability for AI), Map (understanding the context and intended use of each system), Measure (testing and tracking trustworthiness characteristics such as validity, safety, fairness, and explainability), and Manage (prioritizing and treating the risks found).

A companion Playbook suggests concrete actions, and NIST AI 600-1, the Generative AI Profile published in July 2024, adds roughly two hundred actions across twelve risk categories specific to generative models.

The framework does not certify anything and no assessor exists for it. What it asks an organization to have in writing is an AI governance policy and risk tolerance statement, an inventory of AI systems with their intended use and context, documented roles for oversight, a measurement plan and test results for each system, incident and feedback channels, and records showing that risks were reviewed and treated over time.

Many companies adopt it as the internal structure behind an ISO/IEC 42001 management system or EU AI Act readiness program.