NIST AI Risk Management Framework Guide

The NIST AI RMF (Artificial Intelligence Risk Management Framework) is the most widely used voluntary framework for managing AI risk. It does not prescribe specific controls; it describes what trustworthy AI looks like and organises the work into four functions, Govern, Map, Measure and Manage, that any organisation building or using AI can apply. NIST's Generative AI Profile extends it to the particular risks of large language models and other generative systems.

For software companies, the AI RMF is a practical way to answer the questions customers, regulators and boards now ask about AI features: how do you know this model is good enough, fair enough and safe enough for this use, and what do you do when it is not? It also helps meet obligations in laws such as the EU AI Act and the Colorado AI Act, which names it as a recognised framework. This guide explains the framework, the functions, the Generative AI Profile, how to implement it in a product team, and how it fits with ISO/IEC 42001. NIST is revising the framework; this guide reflects version 1.0 as current at our last review.

What is the NIST AI RMF?

The AI RMF, published as NIST AI 100-1, is intended to help organisations manage risks to individuals, organisations and society associated with AI, and to promote trustworthy and responsible development and use of AI systems. It has two parts:

Part 1: foundational information, explaining how to frame AI risks, who the AI actors are across the life cycle, and the characteristics of trustworthy AI.
Part 2: the AI RMF Core, with four functions broken into categories and subcategories of outcomes.

Companion resources include the AI RMF Playbook, which suggests actions, references and documentation for each subcategory; profiles that tailor the framework to sectors, technologies or use cases; and NIST's Trustworthy and Responsible AI Resource Center.

Characteristics of trustworthy AI

Valid and reliable: the system does what it is meant to do, accurately and consistently.
Safe: it does not endanger human life, health, property or the environment under defined conditions.
Secure and resilient: it withstands attacks and unexpected changes and recovers.
Accountable and transparent: information about the system and its outputs is available to those who need it, with clear responsibility.
Explainable and interpretable: people can understand how and why it produces outputs, to the degree needed.
Privacy-enhanced: it protects individual autonomy, identity and dignity through privacy practices.
Fair, with harmful bias managed: it addresses equality and equity, managing systemic, computational and human biases.

These characteristics involve trade-offs; for example, more explainable models may be less accurate. The framework asks organisations to make those trade-offs deliberately and document them.

History and why it was introduced

The National Artificial Intelligence Initiative Act of 2020 directed NIST to develop a voluntary framework for AI risk management. NIST ran workshops, requests for information and public drafts in 2021 and 2022, and published AI RMF 1.0 on 26 January 2023. In July 2024 it released the Generative AI Profile (NIST AI 600-1), responding to an executive order on AI. In 2025, the White House AI Action Plan directed NIST to revise the framework, including removing certain references; at our last review, NIST had not published the revised version.

The purpose is to give organisations a common, flexible approach to AI risk that is not tied to any one technology, sector or law, and that can sit alongside existing enterprise risk management.

Who uses the AI RMF?

Software and SaaS companies building AI features into products.
AI model and platform providers.
Enterprises deploying AI in hiring, lending, insurance, healthcare and customer service.
Government agencies and their suppliers.
Auditors and assessors reviewing AI governance.

It is voluntary and global in use. Some laws reference it: Colorado's original 2024 AI Act (SB 24-205) treated compliance with a recognised framework such as the NIST AI RMF or ISO/IEC 42001 as relevant to reasonable care. That law was replaced in May 2026 by a narrower Colorado automated decision law effective 2027, and US federal procurement policies have also referenced the framework.

The four functions

Govern

A cross-cutting function that cultivates a culture of risk management. Outcomes include policies, processes and procedures for AI risk; accountability structures and roles; workforce diversity and training; a culture that considers and communicates risk; engagement with external stakeholders; and processes for third-party AI risks, including suppliers and the data and models you use. Govern informs and is informed by the other three functions.

Map

Establishes the context to frame risks. Outcomes include understanding the intended purposes, settings and users; categorising the AI system; understanding its capabilities, limitations and the knowledge limits of its outputs; mapping risks and benefits of all components, including third-party data and software; and characterising impacts on individuals, groups, communities, organisations and society.

Measure

Uses quantitative and qualitative methods to analyse, assess, benchmark and monitor AI risk. Outcomes include selecting appropriate methods and metrics, evaluating the system for trustworthiness characteristics (performance, safety, security, privacy, fairness, explainability), tracking identified risks over time, and gathering feedback on the effectiveness of measurement.

Manage

Allocates resources to mapped and measured risks. Outcomes include prioritising and responding to risks (mitigate, transfer, avoid or accept), maximising benefits and minimising negative impacts, managing third-party risks, and documenting and monitoring risk treatments, incidents and responses, including plans to deactivate or decommission systems that perform unacceptably.

The Generative AI Profile

NIST AI 600-1 identifies risks that are unique to or exacerbated by generative AI and suggests actions mapped to the AI RMF subcategories. The risks include confabulation (confidently stated false content), dangerous or violent content, data privacy (including leakage of training data), environmental impacts, harmful bias and homogenisation, human-AI configuration issues such as over-reliance, information integrity, information security (such as prompt injection and model extraction), intellectual property, obscene or abusive content, value chain and component integration, and chemical, biological, radiological or nuclear information. For product teams using large language models, it is a practical checklist of what to test and monitor.

How to implement the AI RMF in a product team, step by step

Govern first: write an AI policy, assign owners for each AI system, define risk tolerance, and set a review process for new AI features.
Inventory AI systems, including third-party models, APIs and AI features in tools you use.
Map each system: purpose, users, setting, decisions it influences, data used, affected people, and what could go wrong.
Define metrics tied to the trustworthiness characteristics that matter for that use: accuracy on representative data, error rates by group, robustness to adversarial inputs, rates of hallucination or unsafe outputs, latency and availability.
Build an evaluation pipeline that runs before every release and on a schedule in production.
Manage risks: add human review where impact is high, restrict use cases, add guardrails and content filters, improve data, or decide not to ship.
Monitor in production: logs, user feedback, drift and incident tracking, with a way to roll back or switch off.
Document: model cards, data sheets, evaluation results, decisions and changes.
Review regularly and update as models, data, uses and regulations change.

Choosing metrics that mean something

The Measure function is where many teams struggle, because "trustworthy" has to become numbers someone can track. Useful starting points for common AI features:

Feature	Example metrics
Classification or scoring (lead scoring, fraud flags, triage)	Precision and recall on a held-out set; error rates and selection rates compared across relevant groups; calibration; performance on recent data versus training data
Generative answers grounded in documents	Share of answers supported by retrieved sources; rate of unsupported claims found in review; refusal rate on out-of-scope questions; leakage tests across tenants
Content generation for users	Rate of unsafe or policy-violating outputs on a red-team set; user edit and rejection rates; complaint rates
Any feature in production	Latency and availability; drift in input data; volume of human overrides; incident counts and time to resolve

Set thresholds before release, agree who can accept a result below threshold, and record the decision. That record is exactly the evidence that the Manage function, ISO/IEC 42001 auditors and AI laws expect.

Documentation you will need

AI policy and risk tolerance statement.
AI system inventory with owners.
Context and impact assessments for each system.
Model and data documentation (model cards, data sheets, provenance).
Evaluation plans, metrics and results.
Risk register and treatment decisions.
Monitoring reports, incident records and change logs.
Third-party AI assessments and contracts.

Assessment and certification

There is no AI RMF certification. Organisations self-assess against the functions, may ask an independent party to review their programme, and often combine the AI RMF with ISO/IEC 42001, which can be certified. NIST has published crosswalks between the AI RMF and other frameworks, including ISO/IEC 42001 and the EU AI Act, to support this.

Timeline and cost considerations

The framework is free and flexible, so effort scales with the number and risk of AI systems. A small company can establish Govern basics and map its main AI feature quickly; building dependable evaluation and monitoring takes longer. Costs include staff time, evaluation datasets and tooling, logging and monitoring infrastructure, red-teaming or external evaluation for high-risk systems, and documentation.

Benefits and the risk of unmanaged AI

Using the AI RMF helps teams find problems before customers do, make defensible decisions about AI trade-offs, and show customers, regulators and investors that AI risk is managed. It also prepares the ground for legal obligations under AI laws, which require many of the same activities.

There is no penalty for not using the framework. Unmanaged AI risk shows up as inaccurate outputs, biased decisions, privacy leaks, security incidents such as prompt injection, and reputational damage, and it can lead to liability under consumer protection, anti-discrimination and privacy laws.

Common mistakes and challenges for IT companies

Treating it as a document exercise rather than building evaluation and monitoring into the product.
Measuring only accuracy and ignoring fairness, robustness and security.
No inventory of third-party AI, such as embedded features in SaaS tools.
Prompt and model changes without re-evaluation.
Human review that is not meaningful, because reviewers lack information or time.
Ignoring the Generative AI Profile when using large language models.

Best practices, tools and technologies

Maintain evaluation suites with representative and adversarial test cases, versioned with the model and prompts.
Log inputs, outputs and model versions with privacy controls, and sample for review.
Use guardrails for generative features: input and output filtering, retrieval grounding, citation of sources, and refusal handling.
Red-team high-impact features, including prompt injection and data exfiltration tests.
Track AI incidents and near misses like security incidents.
Use the Playbook to choose actions for each subcategory.

We build AI features with evaluation, logging and human review in our custom software and SaaS projects.

How the AI RMF relates to other frameworks

Framework	Relationship
ISO/IEC 42001	Certifiable AI management system; NIST provides a crosswalk.
EU AI Act	Binding law; AI RMF activities support its risk management and documentation duties.
ISO/IEC 23894	International guidance on AI risk management with a similar approach.
Colorado AI Act	The original 2024 law named the NIST AI RMF as a recognised framework; its 2026 replacement focuses on notices and explanations.
NIST CSF	Cybersecurity counterpart; AI security risks connect to CSF outcomes.

Real-world implementation examples

NIST publishes use cases and profiles from organisations applying the framework, and has released concept notes for further profiles such as AI in critical infrastructure. Many large technology companies describe their responsible AI programmes using the Govern, Map, Measure and Manage structure.

An illustrative case for a customer support SaaS adding an AI reply assistant: Govern assigns an owner and sets the rule that AI drafts are always reviewed by an agent. Map identifies risks of wrong answers, leaking other customers' data and tone problems. Measure builds an evaluation set from past tickets and tracks factual accuracy, data leakage tests and agent acceptance rates. Manage adds retrieval limited to the tenant's knowledge base, an output filter for personal data, and a kill switch. Monitoring flags a drop in acceptance rate after a model update, which is rolled back.

Next steps

Write a short AI policy and assign owners.
Inventory AI systems and map the highest-impact ones.
Build evaluation and monitoring for those systems.
Use the Generative AI Profile for any LLM features.
Consider ISO/IEC 42001 if customers need certification, and watch for NIST's revised framework.

Frequently asked questions

Is the NIST AI RMF mandatory?

No. It is voluntary, though some laws and contracts reference it as a recognised framework.

What are the four functions of the AI RMF?

Govern, Map, Measure and Manage. Govern is cross-cutting and informs the other three.

Can we be certified to the NIST AI RMF?

No. NIST does not certify against it. ISO/IEC 42001 is the certifiable AI management system standard.

What is the Generative AI Profile?

NIST AI 600-1, published in July 2024, which describes risks specific to generative AI and suggests actions mapped to the AI RMF.

Is the AI RMF being updated?

NIST is revising it following the 2025 AI Action Plan. At our last review the revised version had not been published, and version 1.0 remained current.

How does the AI RMF relate to the EU AI Act?

The AI RMF is voluntary guidance; the EU AI Act is binding law. Activities under the AI RMF support many AI Act obligations but do not replace them.

What are the characteristics of trustworthy AI?

Valid and reliable; safe; secure and resilient; accountable and transparent; explainable and interpretable; privacy-enhanced; and fair with harmful bias managed.

Is the AI RMF only for AI developers?

No. It applies to all AI actors, including organisations that buy and deploy AI systems.

Where should a small company start?

With Govern basics and mapping of its most important AI feature, then evaluation and monitoring for that feature.

Does the Colorado AI Act require the NIST AI RMF?

No. The original 2024 law named it as a recognised framework relevant to reasonable care, but that law was replaced in 2026 by a narrower notice-based law effective 1 January 2027. The framework remains useful evidence of good practice.