Artificial Intelligence Risk Management Framework

The National Institute of Standards and Technology released AI RMF 1.0 on 26 January 2023. NIST describes it as a voluntary framework intended to help organizations incorporate trustworthiness considerations into the design, development, use, and evaluation of AI products, services, and systems. It was developed through an open, consensus-led process involving more than 240 organizations across industry, academia, civil society, and government.

The framework is non-sector-specific and use-case-agnostic. It can be applied to a predictive model, computer-vision system, recommender, generative AI assistant, or agentic workflow. It addresses the complete AI system and its operating context, not only the model. That includes data, software, people, third parties, business processes, decisions, and affected individuals or communities.

NIST defines risk as a combination of the probability that an event occurs and the magnitude of its consequences. Those consequences can affect individuals, groups, communities, organizations, society, and the environment. The framework addresses negative impacts while also helping organizations identify and preserve beneficial uses of AI.

AI RMF 1.0 is voluntary. NIST does not present it as a law, regulation, or certifiable management-system standard. An organization can adopt it without claiming certification, and adoption does not by itself demonstrate compliance with sector rules, contractual obligations, or AI laws.

The framework was produced by a US federal agency, but its structure is not restricted to US organizations. It is designed to align with and support other AI risk-management efforts. Organizations operating across jurisdictions can use its outcomes as a common control language while separately mapping applicable legal and regulatory duties.

As of 28 September 2026, NIST states that AI RMF 1.0 is being revised. The current published framework remains AI RMF 1.0, while the July 2024 Generative AI Profile remains a companion resource for generative AI. Organizations should record the version they use and monitor NIST's revision rather than delaying risk management until a future edition appears.

NIST's primary audience is the group of AI actors who design, develop, deploy, evaluate, acquire, operate, and use AI systems. Effective implementation therefore cannot sit entirely with a legal, risk, data-science, or engineering team. Each function requires decisions and evidence from several roles.

The operating owner should remain accountable for why the system is used and whether its benefits justify its risks. Product and engineering teams define the system and implement controls. Data, security, privacy, legal, compliance, model-risk, procurement, and assurance specialists contribute domain evidence. End users and people who may be affected provide context that internal teams may not see.

AI RMF 1.0 identifies seven characteristics of trustworthy AI. They are not seven independent boxes to tick. NIST states that the characteristics involve context-dependent tradeoffs and that trustworthiness is only as strong as its weakest characteristics. Validity and reliability form a necessary foundation; accountability and transparency support the other characteristics.

Teams must translate each relevant characteristic into requirements and evidence for the actual use case. A general statement that a system is fair, safe, or explainable is not measurable enough to support a release or risk-acceptance decision.

The AI RMF Core contains four functions, 19 categories, and 72 subcategories. Govern is cross-cutting and should inform Map, Measure, and Manage. The functions are iterative rather than a linear project plan. NIST says actions do not constitute a checklist or necessarily follow an ordered sequence.

Most organizations will establish enough governance to assign ownership and risk tolerance, then Map the use case before deciding whether to proceed. Measure and Manage continue before and after deployment as systems, data, users, suppliers, risks, and operating conditions change.

Govern creates the organizational conditions for the other functions. Its six categories cover policies and practices; accountability and training; diverse and clearly defined roles; risk-aware culture; engagement with relevant AI actors; and third-party and supply-chain risk.

Begin with an AI inventory, named business and technical owners, a proportionate classification method, documented risk tolerance, and clear decision rights. Connect AI governance to existing enterprise risk, security, privacy, procurement, product-release, incident, and audit processes. A separate committee without authority over delivery decisions will not produce the outcomes NIST describes.

Map establishes the context required to identify risk. Its five categories cover context; system categorization; capabilities, intended use, benefits, and costs; risks and benefits across system components and third parties; and impacts on individuals, groups, communities, organizations, and society.

The central implementation mistake is mapping a model rather than the operational system. Document the user, task, decision, data flow, model and tool dependencies, interface, human role, downstream action, affected parties, operating environment, and expected misuse. Compare the proposed AI workflow with a non-AI alternative and the current baseline.

NIST says Map should provide enough contextual knowledge to support an initial go or no-go decision. If the intended purpose, operating boundary, human oversight, or impact cannot be described, the organization is not ready to claim that it has assessed the system's risk.

Measure uses quantitative, qualitative, or mixed methods to assess, benchmark, and monitor the risks identified through Map. Its four categories cover selecting appropriate methods and metrics; evaluating trustworthiness characteristics; tracking existing, unanticipated, and emerging risks; and gathering feedback on whether measurement remains effective.

NIST calls for testing before deployment and regularly during operation. Test sets, methods, tools, uncertainty, limitations, and results should be documented. Evaluation should use conditions similar to deployment and should include independent or separate review where appropriate to reduce conflicts of interest.

Not every important risk has a reliable numeric metric. NIST explicitly says risks or trustworthiness characteristics that cannot be measured should be documented. A qualitative assessment with clear evidence and uncertainty is more credible than a convenient number that does not represent the impact.

Manage converts mapped and measured risk into action. Its four categories cover prioritizing and responding to risk; maximizing benefits while minimizing negative impacts; managing third-party risk; and operating response, recovery, communication, and continual-improvement plans.

For each material risk, choose whether to mitigate, transfer, avoid, or accept it. Record the owner, action, evidence, deadline, residual risk, and approval. NIST states that development or deployment should cease safely where negative risk is unacceptable, severe harm is occurring, or catastrophic risk is present until risk can be sufficiently managed.

The release decision should identify the system version and evidence reviewed. It should define conditions, exceptions, monitoring thresholds, incident routes, fallback, rollback, and triggers for reassessment. Third-party models and services remain part of the organization's risk even when the supplier does not disclose every technical detail.

A Profile applies selected AI RMF functions, categories, and subcategories to a specific organization, sector, technology, or use case. NIST does not prescribe a profile template. This flexibility lets an organization focus resources on outcomes that fit its context, requirements, risk tolerance, and capabilities.

A Current Profile records how risk is managed now. A Target Profile records the outcomes the organization wants. Comparing them reveals gaps that can become a prioritized implementation plan with owners, resources, and dates. This is more useful than declaring broad alignment without showing current capability or planned improvement.

NIST's Generative AI Profile, NIST AI 600-1, is a cross-sector companion to AI RMF 1.0. It does not replace the Core. Teams using generative AI should apply the Core and use the GenAI Profile to address risks and actions specific to generative systems. NIST also announced work on a Critical Infrastructure Profile in April 2026.

Do not begin by assigning all 72 subcategories to every system. Start with one material AI use case, establish a repeatable evidence path, then extend the operating model. The sequence below is Kesho's implementation recommendation, not a sequence prescribed by NIST.

AI RMF is outcome-based, so NIST does not mandate a fixed document pack. An organization still needs durable evidence if it wants teams, reviewers, customers, auditors, or regulators to understand what was decided and why. Reuse existing product, security, privacy, model-risk, and enterprise-risk artifacts where they satisfy the outcome.

These instruments are related but not interchangeable. AI RMF provides flexible risk-management outcomes. ISO/IEC 42001 specifies requirements for an AI management system and can support certification. The EU AI Act is law with obligations determined by an organization's role and the AI system's classification and use.

A practical architecture can use ISO 42001 for the management system, AI RMF for lifecycle risk outcomes and evidence, and an EU AI Act control map for applicable legal duties. One artifact may support several obligations, but teams should maintain traceability to the exact requirement rather than claiming that one framework automatically proves another.

The answers below distinguish what NIST requires from implementation choices an organization must make for its own context.

The framework creates value when it changes decisions and operating behavior. It becomes paperwork when teams collect generic policies without connecting them to one system, one context, and one accountable decision.

A credible implementation lets a reviewer trace a line from purpose and affected parties to risk, measurement, control, decision, and production outcome. Owners can explain what evidence supports release, what remains uncertain, who accepted residual risk, and what would trigger intervention.

NIST expects users to evaluate whether the framework improves policies, processes, practices, measurements, implementation plans, and outcomes. Useful indicators include inventory coverage, time to classify a use case, unresolved high risks, evaluation completion, exception age, incidents, successful fallback tests, monitoring coverage, and remediation time. Do not optimize for document volume.