If you’ve read about AI governance, you’ve seen the name: NIST AI RMF. It shows up in board presentations and vendor pitches — usually invoked with great confidence and explained with very little. Having finally read it properly, I can report it’s one of the more useful documents in AI governance: voluntary, practical, and genuinely well-designed.
This guide explains the NIST AI Risk Management Framework (AI RMF): what it is, who created it and why, its four core functions (Govern, Map, Measure, Manage), how it relates to other frameworks and regulations, and how organizations actually apply it. For the broader context, see my overview of AI governance.
Table of Contents
- What the NIST AI RMF Is (and Isn’t)
- Who Made It and Why It Matters
- The Four Functions: Govern, Map, Measure, Manage
- Govern: Culture and Accountability
- Map: Understanding Context and Risks
- Measure: Assessing and Monitoring
- Manage: Treating and Responding
- The Profiles and the Playbook
- NIST AI RMF vs Other Frameworks
- How Organizations Actually Use It
- The Honest Limitations
- Frequently Asked Questions
What the NIST AI RMF Is (and Isn’t)
The NIST Artificial Intelligence Risk Management Framework is a voluntary framework for managing risks to individuals, organizations, and society from AI systems. Published in January 2023 by the US National Institute of Standards and Technology, it’s designed to be used by anyone who designs, develops, deploys, or uses AI — from startups to governments.
What it is: a structured way to think about AI risk — functions, categories, subcategories — architecturally similar to NIST’s Cybersecurity Framework. It’s descriptive, not prescriptive: it tells you what to consider, not exactly how to do it.
What it isn’t: a law, a certification, a checklist, or a guarantee. Nobody “certifies” against the AI RMF — it’s a framework for the process of managing risk, not a stamp of approval. Anyone selling “NIST AI RMF certification” is selling something NIST never created.
This voluntary, process-oriented design is both its strength and its limitation — more on that below.
Who Made It and Why It Matters
NIST is a US federal agency with a long track record of producing frameworks that become global standards — the Cybersecurity Framework being the prime example. Congress directed NIST to develop the AI RMF, and the development process was genuinely collaborative: multiple public drafts, workshops, and thousands of comments from industry, academia, civil society, and international stakeholders.
Why it matters:
The Four Functions: Govern, Map, Measure, Manage
The framework organizes everything around four functions. Think of them as the phases of a continuous loop:
GOVERN — the culture, structures, and accountability that make risk management work. Who’s responsible, what are the values, how are decisions made.
MAP — understanding the context: what the AI system does, who it affects, what could go wrong. The risk identification phase.
MEASURE — assessing the risks: how likely, how severe, how do we know. Testing, evaluation, monitoring.
MANAGE — treating the risks: what we do about them, how we respond when things go wrong, how we communicate.
GOVERN is the foundation beneath the other three, which form the operational loop: understand, assess, act, repeat. Each function breaks into categories and subcategories, but the four functions are the mental model that matters.
Govern: Culture and Accountability
GOVERN is about the organizational conditions for effective risk management. Its categories:
Culture and accountability. AI risk management is embedded in the organization’s values and decision-making. Leadership champions it. Accountability is clear — someone owns AI risk, and everyone knows who.
Risk tolerance. The organization explicitly defines what risks it’s willing to take with AI — and what it isn’t. This isn’t a vague “we take AI safety seriously” statement; it’s a concrete articulation of boundaries.
Workforce. People involved with AI have the skills, knowledge, and — critically — the authority to manage risk. Training, AI literacy, and empowerment to raise concerns without retaliation.
Communication. Risk information flows to the right people: leadership, deployers, affected communities. Transparency about capabilities, limitations, and incidents.
Map: Understanding Context and Risks
MAP is the “know what you’re dealing with” function. Its categories:
Context. What’s the AI system’s intended purpose? Who are the intended users? Who else might be affected — including people who never chose to interact with it? What are the system’s capabilities and limitations? Most AI risk failures start here: nobody clearly articulated what the system was for and whom it could harm.
Risk identification. What could go wrong? The framework pushes for systematic identification of risks to individuals, groups, organizations, and society — including risks from foreseeable misuse, not just intended use.
Impact assessment. Who benefits, who bears the risk, and is that distribution fair? This is where the framework’s attention to equity lives — asking not just “is it risky” but “risky for whom.”
Measure: Assessing and Monitoring
MEASURE is the “how bad is it, really” function:
Testing and evaluation. Systematic assessment of the AI system’s performance, including for bias, robustness, and safety. Not just “does it work on our test set” but “does it work for all affected groups, under adversarial conditions, at the edges of its operating envelope.”
Risk quantification. Where possible, measuring risks with metrics — fairness metrics, robustness scores, incident rates. The framework is honest that quantification is hard for many AI risks, and qualitative assessment counts too.
Monitoring. Continuous measurement in deployment — tracking performance, watching for drift, detecting misuse, logging incidents. MEASURE doesn’t end at launch.
Feedback. Mechanisms for affected people to report problems — and for those reports to actually reach someone who can act on them.
Manage: Treating and Responding
MANAGE is the “what are we doing about it” function:
Risk treatment. Deciding how to handle each risk — mitigate, transfer, accept, avoid — and implementing the chosen treatments. This connects directly to the practical AI risk management process I cover in detail elsewhere.
Response. When things go wrong — incidents, near-misses, newly discovered risks — having a plan and executing it. Incident response for AI has its own wrinkles (how do you “contain” a deployed model?), and the framework pushes organizations to think them through in advance.
Communication. Telling the right people about risks and incidents — leadership, users, affected communities, regulators where required. The framework treats communication as a risk management activity, not a PR activity.
The Profiles and the Playbook
Beyond the core functions, NIST provides two companion resources worth knowing:
AI RMF Profiles are how organizations adapt the framework to their context — a profile is essentially “the AI RMF as applied to us,” prioritizing the subcategories most relevant to a particular sector, use case, or risk tolerance. NIST published an initial example (a generative AI profile), and organizations are expected to develop their own. The profile is what turns a general framework into a specific plan.
The Playbook is NIST’s online companion with suggested actions for each subcategory — practical guidance. It’s the bridge between the framework’s “what” and implementation’s “how.” If the framework feels abstract, the Playbook is where it gets concrete.
Neither is mandatory; both are useful. Treat the AI RMF as a starting kit — framework plus profile plus playbook — not a document to admire from a distance.
NIST AI RMF vs Other Frameworks
How it relates to the other things you’ve heard of:
vs the EU AI Act. The Act is law; the RMF is voluntary. The Act mandates specific obligations for high-risk AI; the RMF provides a process for managing all AI risk. They’re complementary: an organization using the AI RMF well is most of the way to EU AI Act compliance for its risk management obligations. My EU AI Act guide covers the legal side.
vs ISO/IEC 42001. The ISO standard for AI management systems — certifiable, auditable, more formal. Think of ISO 42001 as the certifiable management system and the AI RMF as the risk methodology that can live inside it.
vs the OECD AI Principles. The OECD AI Principles are high-level values (inclusive growth, human-centered values, transparency, robustness, accountability). The AI RMF is the operationalization — how you actually implement those values in risk management practice.
How Organizations Actually Use It
Theory is nice; practice is what matters. Here’s how real adoption typically works:
1. Assess current state. Map existing AI risk practices against the framework’s subcategories. Find the gaps. Most organizations discover they’re strong on technical testing and weak on governance — the GOVERN function is almost always the gap.
2. Develop a profile. Prioritize subcategories based on your AI use cases, risk tolerance, and regulatory exposure. A bank’s profile emphasizes fairness and accountability; a manufacturer’s emphasizes safety and reliability.
3. Build the program. Assign owners, establish processes, create the risk register, set up monitoring. This is the unglamorous implementation work — and where most of the value lives.
4. Integrate with existing governance. Don’t build a parallel universe. Connect AI risk management to existing enterprise risk, cybersecurity, compliance, and audit functions. The AI RMF is designed for this integration.
5. Report and improve. Regular reporting to leadership, periodic reassessment, continuous improvement. The framework is a loop — treat it as one.
The Honest Limitations
I promised honesty, so here are the framework’s real weaknesses:
Voluntary means optional. The organizations that most need structured risk management — the ones moving fast and breaking things — are the least likely to adopt a voluntary framework. The AI RMF influences the conscientious; it doesn’t constrain the reckless.
Measurement is immature. The MEASURE function assumes evaluation practices that don’t fully exist yet. The framework is ahead of the science in places, which is admirable but limits its practical bite.
No enforcement, no teeth. Unlike the EU AI Act’s fines, the AI RMF has no consequences for ignoring it. Its influence works through procurement pressure, reputational incentives, and regulatory cross-reference — powerful in aggregate, weak in any single case.
US-centric origins. Despite international consultation, it’s a US framework. Global organizations navigate it alongside the EU AI Act, and the two don’t always align neatly.
For the practical process of managing AI risks day to day, see my guide to AI risk management, and for the bigger picture, my AI governance overview.
Frequently Asked Questions
The NIST AI RMF is a voluntary US framework for managing AI risks, published in January 2023. It organizes risk management around four functions — Govern, Map, Measure, Manage — and is designed for anyone who designs, develops, deploys, or uses AI systems.
Govern (culture, accountability, and risk tolerance), Map (understanding the AI system’s context and identifying risks), Measure (assessing risks through testing, evaluation, and monitoring), and Manage (treating risks and responding to incidents). Govern underpins the other three, which form a continuous loop.
No — it’s entirely voluntary. There is no certification and no enforcement. Its influence comes through procurement requirements, regulatory cross-references, and industry adoption as a common standard for AI risk management.
The EU AI Act is mandatory law with specific obligations and fines; the NIST AI RMF is a voluntary risk management process. They’re complementary — an organization managing risk well under the AI RMF is well-positioned for EU AI Act compliance.
No. NIST created no certification program for the AI RMF. Organizations seeking certification typically pursue ISO/IEC 42001 (the AI management system standard) and may use the AI RMF as their risk methodology within it.
