EXPLAINER

NIST AI Risk Management Framework

standardfreshness: volatilekey claims checked 2026-10-09

The NIST AI RMF is a voluntary US framework for managing AI risks, organised around four functions — Govern, Map, Measure and Manage — with a companion profile for generative AI.

Short answer: AI RMF 1.0 (NIST AI 100-1, January 2023) structures risk work into Govern, Map, Measure, Manage and describes trustworthy-AI characteristics. A Generative AI Profile (NIST AI 600-1, 2024) adds generative-specific risks. It is voluntary guidance, not law.

What is it?

NIST's framework is a checklist-style guide to thinking about AI risk: set up governance, understand the context, measure the risks and act on them. Organisations use it to organise their own AI risk practices.

Also known as: NIST AI RMF, AI RMF, NIST AI 100-1, NIST AI 600-1, generative AI profile, Govern Map Measure Manage, AI risk management framework, trustworthy AI characteristics.

Technical definition

The framework defines trustworthiness characteristics (valid and reliable, safe, secure and resilient, accountable and transparent, explainable and interpretable, privacy-enhanced, fair with harmful bias managed) and four core functions with categories and subcategories. A Playbook offers suggested actions, and the Generative AI Profile (NIST AI 600-1, published 2024) maps generative-AI-specific risks (such as confabulation, information integrity, data privacy and CBRN information) to actions. AI RMF 1.0 was released on 26 January 2023 as NIST AI 100-1. As of 2026-10-09 NIST's AI RMF page states that AI RMF 1.0 is being revised as part of the White House AI Action Plan and that the Playbook will be updated after the revision; NIST also released a concept note for a critical-infrastructure profile on 7 April 2026. Check NIST's site for the current revision status.

Entity type: standard · Freshness class: volatile.

When should I use it?

Useful baseline for organisations of any size, especially US-facing.

Implementation patterns

  • Map your AI inventory to RMF functions.
  • Use the Playbook to pick actions per risk.
  • Combine with ISO 42001 for a management system.
  • Record measurement and review cycles.

Technologies and frameworks

Commonly associated: AI RMF Playbook, Generative AI Profile. Names are examples of what exists, not recommendations, and projects change quickly.

Practical guide

  1. Read the framework overview.
  2. Create an inventory.
  3. Map one system.
  4. Define measures.
  5. Review and iterate.

Common failure modes

  • Treating it as a certification.
  • Ticking boxes without measurement.
  • Ignoring the generative AI profile.

Troubleshooting

  • Do not know where to start — Start with Govern: owners, policy and inventory; then Map one system end-to-end.

Contrasted with

Questions this page answers

  • What is the NIST AI RMF?
  • What are the four functions of the AI RMF?
  • Is the NIST AI RMF mandatory?
  • What is the NIST generative AI profile?

Typical goals: adopt a recognised AI risk framework; map controls to generative AI risks.

Sources and verification

Status: key claims checked on 2026-10-09 against the primary sources listed below; everything else is not independently verified. The claims under "Checked against primary sources" were compared with the linked pages on that date. Pages change, so re-check anything time-sensitive before relying on it.

Checked against primary sources (2026-10-09):

  • AI RMF 1.0 is NIST AI 100-1, released on 26 January 2023 (NIST AI RMF page and NIST publication record).
  • NIST states AI RMF 1.0 is being revised as part of the White House AI Action Plan; the Playbook (created 8 July 2022, updated 10 June 2026) will be updated after the revision.
  • NIST released a concept note for an AI RMF Profile on Trustworthy AI in Critical Infrastructure on 7 April 2026.
  • The Generative AI Profile is a cross-sectoral companion profile to AI RMF 1.0 (NIST AI 600-1, July 2024 per the earlier audit).

Primary sources consulted:

Not independently verified:

  • The four functions, trustworthiness characteristics and GenAI risk list in the technical definition were not re-read against the PDF in this pass.
  • The scope and timing of the revision.
  • The exact publication month of AI 600-1 (taken from the earlier audit).

Freshness class: volatile — Products, versions, protocols, benchmarks, leaderboards, regulations and dates. Verify against the primary source before relying on specifics; re-review every 3 months.

Time-sensitive claims to verify before relying on them:

  • Current versions, profiles and any updates; US policy context around the framework.
  • Status of the announced revision of AI RMF 1.0 and of the Playbook update.

Further reading and canonical sources (not all checked):

  • NIST AI 100-1, Artificial Intelligence Risk Management Framework (AI RMF 1.0) (January 2023) — nist.gov/itl/ai-risk-management-framework
  • NIST AI 600-1, Generative AI Profile (July 2024) — nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf
Learning path: Governing AI (step 2 of 7)
← AI GovernanceISO/IEC 42001 (AI Management System) →