NIST AI Risk Management Framework
In short
The NIST AI Risk Management Framework is a free, voluntary guide from the US standards body NIST that helps organisations find and manage the risks of AI systems. It is built around four functions: govern, map, measure and manage.
- Also called
- AI RMF, NIST AI RMF, NIST AI 100-1, AI RMF 1.0
- Topic
- Law, policy and the UK
- Level
- Some background helps
- First described
- Published by NIST as NIST AI 100-1 in January 2023, under the National Artificial Intelligence Initiative Act of 20201.
NIST, the US National Institute of Standards and Technology, released AI RMF 1.0 on 26 January 20232. It was written as directed by the National Artificial Intelligence Initiative Act of 2020, and is meant to be voluntary, rights-preserving, not tied to any one sector, and usable for any kind of AI1. It is guidance, not law.
Part 1 sets out what trustworthy AI looks like: valid and reliable, safe, secure and resilient, accountable and transparent, explainable and interpretable, privacy-enhanced, and fair with harmful biases managed1.
Part 2, the Core, has four functions. Govern is the cross-cutting one that runs through everything. Map, measure and manage are then applied at points in an AI system's life1. Each function breaks down into categories and subcategories, but NIST stresses these are not a checklist or a fixed order of steps1. A companion Playbook suggests practical actions1.
NIST also publishes profiles that apply the framework to a particular setting. The best known is the Generative AI Profile, NIST AI 600-1, from July 20242. It lists risks that are new to or made worse by generative AI, such as confabulation, data privacy and intellectual property3.
The framework is being rewritten. NIST says a revised version is in progress, after the White House's July 2025 AI Action Plan told it to remove references to misinformation, diversity, equity and inclusion, and climate change4. As of October 2026, AI RMF 1.0 is still the current published version2.
Example
A bank adopting an AI tool to flag fraud could use the map function to record who the tool affects and where it could fail, then measure how often it wrongly flags genuine payments, and manage those risks with a plan for human review1.
Why it matters
It gives organisations a shared, free vocabulary for AI risk that any company can adopt. Because it is voluntary, it shapes practice rather than setting legal duties.
Questions people ask
Is the NIST AI RMF mandatory?
No. NIST describes it as intended to be voluntary and usable by organisations of any size in any sector1. It is a free guide, not a law or a certification scheme.
What are the four functions of the NIST AI RMF?
Govern, map, measure and manage. Govern is a cross-cutting function that informs the other three, which are applied across an AI system's life cycle1.
Is there a NIST framework for generative AI?
Yes. NIST AI 600-1, the Generative AI Profile, was released in July 2024 as a companion to the AI RMF2. It covers risks new to or worsened by generative AI, such as confabulation3.
Is the NIST AI RMF being updated?
Yes. NIST says a revised version is in progress, following the July 2025 White House AI Action Plan4.
Related terms
Sources
- NIST AI 100-1 (January 2023), Artificial Intelligence Risk Management Framework (AI RMF 1.0)
- NIST, AI Risk Management Framework (programme page)
- NIST AI 600-1 (July 2024), AI Risk Management Framework: Generative AI Profile
- NIST Trustworthy and Responsible AI Resource Center, AI RMF 1.0 page (revision note)