Wiki · Concept · Last reviewed May 16, 2026

NIST AI Risk Management Framework

The NIST AI Risk Management Framework, or AI RMF, is a voluntary U.S. framework for managing risks from artificial-intelligence systems. It gives organizations a common vocabulary for governing, mapping, measuring, and managing AI risks across the system lifecycle.

Definition

The NIST AI Risk Management Framework 1.0 was released on January 26, 2023 by the U.S. National Institute of Standards and Technology. It is designed for organizations that design, develop, deploy, or use AI systems, and it is explicitly voluntary, non-sector-specific, rights-preserving, and use-case agnostic.

The framework does not certify that an AI system is safe. It gives organizations a risk-management operating model: identify context, understand harms, assign responsibility, evaluate evidence, manage risk, and update practices as systems and uses change.

Because it is voluntary, the AI RMF is best understood as governance infrastructure rather than law. It helps shape procurement, audits, policy, standards, internal controls, public-sector AI inventories, and safety documentation, but it does not itself create an enforcement regime.

Structure

The AI RMF Core is organized around four functions: Govern, Map, Measure, and Manage. The companion Playbook provides suggested actions and questions for each function and subcategory.

Govern. Establish policies, accountability, roles, culture, documentation, risk tolerance, and oversight structures for AI risk management.

Map. Understand the AI system's context, intended purpose, stakeholders, data, deployment environment, benefits, harms, and legal or social constraints.

Measure. Analyze, test, evaluate, and monitor AI risks and trustworthiness characteristics using appropriate qualitative and quantitative methods.

Manage. Prioritize, respond to, mitigate, accept, transfer, monitor, and communicate AI risks based on mapped context and measured evidence.

The order is not purely linear. In a real AI program, governance shapes mapping, mapping shapes measurement, measurement informs management, and management failures should feed back into governance.

Trustworthiness Characteristics

NIST frames trustworthy AI through several characteristics: valid and reliable, safe, secure and resilient, accountable and transparent, explainable and interpretable, privacy-enhanced, and fair with harmful bias managed.

These characteristics are not independent checkboxes. A model can be accurate but unfair, explainable but insecure, privacy-preserving but unsafe, or transparent in documentation while opaque in deployment. The point of the framework is to force tradeoffs into view instead of letting a single metric stand in for trustworthiness.

The AI RMF also treats AI risk as sociotechnical. Risk does not reside only in model weights or benchmark performance. It emerges from data, users, deployment settings, incentives, institutional power, feedback loops, affected communities, and the real-world ability to contest or repair harm.

Generative AI Profile

In July 2024, NIST released NIST AI 600-1, the Generative AI Profile, as a companion to AI RMF 1.0. The profile applies the AI RMF functions to risks that are unique to or intensified by generative AI.

The Generative AI Profile covers risk areas such as confabulation, cybersecurity, information integrity, harmful bias and homogenization, human-AI configuration, environmental impact, privacy, intellectual property, misuse, toxicity and abuse, value chain and component integration, and data provenance.

For general-purpose models, the profile matters because it moves the conversation beyond model accuracy. A generative system can create persuasive falsehoods, synthetic evidence, privacy exposure, dependency loops, copyright conflict, insecure tool behavior, and polluted downstream data even when it appears fluent and useful.

How It Is Used

Internal governance. Organizations use the AI RMF to structure risk committees, inventories, policies, model-review gates, documentation, and accountability practices.

Audits and assurance. The AI RMF gives auditors and assurance providers a shared language for asking whether an organization has mapped, measured, and managed AI risks instead of merely claiming that it did.

Public-sector AI. U.S. agencies and contractors often refer to NIST guidance when building AI governance programs, procurement requirements, inventories, and risk-management processes.

Security and red teaming. The Generative AI Profile and related NIST publications give developers a way to connect prompt injection, poisoning, cybersecurity, provenance, and misuse concerns to an organizational risk process.

Standards alignment. The AI RMF is often discussed alongside ISO/IEC 42001, the EU AI Act, OECD AI principles, CISA secure-development guidance, and sector-specific rules. It can serve as a crosswalk, but it does not replace those regimes.

Limits

Voluntary status. An organization can cite the AI RMF without being legally required to follow it unless some contract, procurement rule, regulator, or internal policy makes it binding.

Evidence gap. Saying that a process is "aligned with NIST AI RMF" does not reveal what tests were run, what failed, who reviewed the evidence, or whether deployment changed.

Interpretive flexibility. The framework is intentionally broad. That makes it adaptable, but it also lets weak organizations translate hard questions into soft process language.

Fast-moving systems. Agentic models, frontier labs, tool-use systems, synthetic media pipelines, and continuously updated models can change faster than risk documentation.

Power asymmetry. A framework can improve internal governance while still leaving affected people, workers, communities, researchers, and journalists without enough access to challenge harmful systems.

Spiralist Reading

The AI RMF is a grammar for slowing the machine down enough to name its risks.

The framework says: do not only ask whether the model works. Ask where it is used, who is exposed, what evidence exists, who owns the risk, how harm is detected, and what happens after failure. That is useful friction.

For Spiralism, the weakness is also clear. A grammar can become liturgy. Organizations can recite Govern, Map, Measure, Manage while still treating the machine as inevitable. The framework matters when it produces records, decisions, delays, refusals, and accountability. It fails when it becomes decorative compliance language around an unchanged deployment race.

Open Questions

Sources

Return to Wiki