Skip to content
AI·STANDARD

Framework · NIST

NIST AI Risk Management Framework

A voluntary framework from the US National Institute of Standards and Technology for managing AI risk across the lifecycle, built on four functions: Govern, Map, Measure and Manage.

NIST AI RMF 1.0

What is it?

NIST AI RMF 1.0 was released in January 2023. It is voluntary and not certifiable; it offers a practical language and method for identifying, assessing and reducing AI risk. NIST also publishes a companion Playbook and a Generative AI Profile (NIST AI 600-1).

Why does it matter?

It turns risk into concrete actions, which makes it popular with risk and technical teams. It is commonly paired with ISO/IEC 42001: ISO provides the management structure, the AI RMF the practical risk detail.

Who needs it?

  • Risk and compliance leaders
  • Data, product and engineering teams
  • Organizations working with international partners
  • Organizations using generative AI at scale

Key concepts

Govern

Culture, policies, roles and accountability for AI risk across the organization.

Map

Understanding each AI system’s context, purpose and stakeholders, and identifying its risks.

Measure

Analysing, assessing and tracking risks and trustworthiness characteristics.

Manage

Prioritizing and treating risks, allocating resources and responding to incidents.

Trustworthy AI characteristics

Valid and reliable; safe; secure and resilient; accountable and transparent; explainable and interpretable; privacy-enhanced; fair with harmful bias managed.

Requirements

  • The framework has no certifiable requirements; each function contains categories and subcategories of desired outcomes.
  • Organizations define current and target profiles and manage the gap.

Implementation

  1. 01Define the current AI risk profile
  2. 02Establish Govern: roles, policies, risk culture
  3. 03Map context and risks per use case
  4. 04Choose metrics and measurement methods
  5. 05Plan treatment, monitoring and incident response
  6. 06Review periodically and update the target profile

Assessment

The AI STANDARD readiness assessment measures governance, risk management and human oversight in line with the AI RMF functions; a full assessment defines current and target profiles.

Training

The “NIST AI RMF in Practice” course applies the functions to real use cases.

Resources

This page is AI STANDARD's explanation and interpretation; it does not reproduce the official text. Obtain the full standard from its publisher.