NIST AI Risk Management Framework

The NIST AI Risk Management Framework (AI RMF) is a voluntary framework published by the United States National Institute of Standards and Technology for managing the risks that artificial intelligence systems pose to individuals, organisations and society. Released in January 2023, it is designed to be used across the lifecycle of an AI system — design, development, deployment and evaluation — and has become one of the most widely referenced governance baselines internationally, including by organisations that are not subject to United States regulation.^[1]

History

NIST developed the framework under direction from the National AI Initiative Act of 2020, following an open process that included a public request for information, two draft releases and a series of workshops. AI RMF 1.0 was released on 26 January 2023 as publication NIST AI 100-1, alongside a companion Playbook of suggested actions and a roadmap for future work. In March 2023 NIST launched the Trustworthy and Responsible AI Resource Center to support adoption and international alignment. In July 2024 the institute published the Generative AI Profile (NIST AI 600-1), a companion document required by Executive Order 14110 that catalogues risks specific to generative AI — including confabulation, information integrity, harmful bias and over-reliance — and maps suggested actions to the core framework. NIST released a concept note for a further profile on trustworthy AI in critical infrastructure in April 2026, and has stated that AI RMF 1.0 is being revised as part of the White House AI Action Plan, the policy agenda issued in 2025. Translations have been published in Arabic and Japanese, and crosswalks map the framework to other standards including ISO/IEC 42001 and the EU AI Act.^[1][2][3][4]

Key Concepts and Technology

The framework has two parts. The first sets out how organisations should frame AI risk, including the characteristics of trustworthy AI: systems that are valid and reliable, safe, secure and resilient, accountable and transparent, explainable and interpretable, privacy-enhanced, and fair with harmful bias managed. The second defines four core functions that structure risk management work: Govern (cultivating a risk culture, roles and policies), Map (establishing context and identifying risks), Measure (analysing and assessing risks with appropriate methods) and Manage (prioritising and responding to risks, including allocation of resources). The functions are iterative rather than sequential, and the framework deliberately avoids prescribing specific technologies or compliance checklists; instead, sector- and technology-specific profiles adapt the core for contexts such as generative AI or critical infrastructure. The companion Playbook provides example actions for each subcategory, and the crosswalks let organisations reconcile the AI RMF with ISO/IEC 42001, the EU AI Act and other instruments so that one governance programme can satisfy multiple regimes.^[1][2][5]

Applications and Impact

Because the framework is voluntary, its influence comes through adoption rather than enforcement: United States federal agencies, state governments, standards bodies and multinational companies commonly cite it as a governance baseline, and it is frequently paired with ISO/IEC 42001 certification for organisations that want external assurance. The framework's vocabulary — govern, map, measure, manage, and the seven trustworthiness characteristics — has been absorbed into corporate AI policies, procurement questionnaires and audit practices well beyond the United States, making it a de facto international reference point alongside the OECD AI Principles and the EU AI Act. Its revision and the new profile work signal that AI risk guidance will continue to expand in scope through 2026 and beyond.^[1][3][4]

>See Also

• AI Regulation United States
• EU AI Act
• ISO/IEC 42001
• AI Guardrails
• Malaysia AI Governance Framework
• Responsible AI