NIST AI RMF
AI RMFAlso called NIST AI Risk Management Framework, NIST AI 100-1
The NIST AI Risk Management Framework (AI RMF) is a voluntary framework from the US National Institute of Standards and Technology for managing risks from AI systems. Released in January 2023, it organises AI risk work into four functions: govern, map, measure and manage. Firms worldwide use it to structure AI governance.
How it works
Govern sets policies, roles and accountability for AI across the firm. Map establishes each system's context, purpose and potential impacts. Measure uses tests and metrics to assess risks such as bias, robustness and security. Manage prioritises and treats those risks and tracks them over time. Companion profiles, including a 2024 profile for generative AI, apply the functions to specific uses.
The framework is not law, but US regulators, auditors and counterparties often refer to it as a benchmark for sound AI governance. Banks map it to model risk management and to EU AI Act duties to avoid running parallel programmes. NIST states that version 1.0 is being updated, with a revised version in progress.
The rules
Sets out four functions, govern, map, measure and manage, and characteristics of trustworthy AI.
Voluntary for any organisation designing, deploying or using AIApplies the AI RMF to generative AI risks and lists suggested actions for each function.
Organisations using or building generative AICommon questions
Is the NIST AI RMF mandatory?
No. The AI RMF is voluntary guidance. It becomes binding only where a contract or a law adopts it. Some US state laws, such as Colorado's AI Act, give weight to compliance with a nationally or internationally recognised AI risk management framework, a category that includes the AI RMF.
What are the four functions of the NIST AI RMF?
Govern, map, measure and manage. Govern is cross-cutting and sets the culture and accountability. Map frames the context and risks of a system. Measure assesses those risks. Manage allocates resources to treat and monitor them.
How does the NIST AI RMF relate to the EU AI Act?
The EU AI Act is binding law with risk tiers and specific duties. The AI RMF is a voluntary method. Many firms use the AI RMF structure to organise the risk management work the AI Act requires for high-risk systems.
Is there a newer version of the NIST AI RMF?
Version 1.0 from January 2023 remains the published framework. NIST states that it is being updated and that a revised version is in progress. NIST has also published companion documents, including a generative AI profile in July 2024.
