NIST AI Risk Management Framework (AI RMF 1.0): The U.S. Standard for Responsible AI

A deep dive into the voluntary framework that became the de facto baseline for AI governance in the United States

What Is It?

The NIST AI Risk Management Framework (AI RMF 1.0) is a voluntary set of guidelines published by the U.S. National Institute of Standards and Technology (NIST) in January 2023. It is addressed to any individual or organization involved in the design, development, deployment, evaluation, or procurement of AI systems.

The AI RMF does not carry the force of law. It does not prescribe specific technologies or mandate compliance. Instead, it provides a flexible, structured process for identifying, assessing, and managing the risks that AI systems pose — and for building AI systems that are trustworthy.

Source: NIST AI RMF 1.0 Landing page: nist.gov/artificial-intelligence

Why Was It Created?

By the early 2020s, AI systems were being deployed across critical sectors — healthcare, finance, law enforcement, hiring — without consistent standards for evaluating their risks or ensuring their trustworthiness. The U.S. lacked a binding federal AI law (and still does, as of early 2026), leaving a significant governance gap.

NIST developed the AI RMF in close consultation with industry, academia, and civil society to address that gap. The goal was to create a practical, sector-agnostic tool that organizations of any size could use to reduce AI-related harm while enabling responsible innovation. It was also designed to be living and evolving — not a one-time publication.

The Four Core Functions

The AI RMF is organized around four interconnected functions that form an iterative governance cycle:

1. GOVERN

Establish organizational policies, culture, and accountability structures for responsible AI. This means defining who is responsible for what, setting acceptable risk thresholds, and ensuring executive visibility into AI risk management.

“Governance is the backbone of the NIST AI RMF.”

Strong AI governance requires written policies defining where AI may be used, cross-functional oversight teams with traceable decision-making, and visible executive sponsorship — particularly for risk prioritization, third-party oversight, and assurance tooling.

2. MAP

Identify and analyze risk sources and their potential impacts. This involves understanding the context in which an AI system operates, who is affected, and what harms could reasonably occur — both technical failures and broader societal impacts.

3. MEASURE

Evaluate and quantify the identified risks. This includes bias detection, adversarial robustness testing, red-teaming, performance benchmarking, and other methods for putting actual numbers and evidence behind risk assessments rather than relying on intuition.

4. MANAGE

Respond to, monitor, and improve risk management over time. This is where risk treatment decisions are made — whether to accept, mitigate, transfer, or avoid specific risks — and where ongoing monitoring ensures that risks don’t re-emerge as systems evolve.

These four functions are iterative, not sequential. Organizations cycle through them continuously across the AI lifecycle.

Key Updates Since 2023

Generative AI Profile (NIST-AI-600-1, July 2024)

In July 2024, NIST released a dedicated Generative AI Profile as a companion to the AI RMF. This profile addresses unique risks posed by large language models and other generative systems — including hallucination, synthetic content at scale, and the difficulty of auditing training data provenance.

Domain-Specific Profiles

NIST has been developing sector-specific AI RMF Profiles for industries like healthcare, finance, and critical infrastructure. These profiles translate high-level risk management principles into practical, scenario-specific guidance that organizations can directly implement.

Influence and Adoption

Despite being voluntary, the AI RMF has achieved significant real-world influence:

• It serves as the de facto baseline for AI governance in U.S. federal agencies and regulated industries
• It has become a procurement standard — many federal contracts and vendor relationships now reference AI RMF alignment as a requirement
• Colorado’s AI Act references AI RMF compliance as a valid component of a reasonable risk management program for high-risk AI deployers
• It has been referenced in crosswalks and alignments with the EU AI Act, ISO/IEC 42001, and the OECD AI Principles

How It Compares to Other Frameworks

Who Should Use It?

The AI RMF is explicitly designed to apply to any organization, regardless of size or sector. That said, it is particularly well-suited for:

• U.S. federal agencies and contractors
• Organizations building or deploying AI in regulated industries (healthcare, finance, defense)
• Companies seeking a governance baseline before layering more specific frameworks on top
• Organizations preparing for EU AI Act compliance or ISO/IEC 42001 certification

Honest Limitations

• The AI RMF is not certifiable — there is no formal third-party audit process to demonstrate compliance, unlike ISO/IEC 42001
• Being voluntary, it has no enforcement mechanism for organizations that ignore it
• The framework is not prescriptive — it tells you that you should manage risks, less often exactly how, which can leave implementation gaps for less mature organizations
• Sector-specific profiles are still being developed and not all industries have tailored guidance yet

Key Sources

• NIST AI RMF 1.0 — https://www.nist.gov/system/files/documents/2023/01/26/AI%20RMF%201.0.pdf
• NIST-AI-600-1 Generative AI Profile — https://airc.nist.gov/Docs/1
• Nemko Digital, “NIST AI Risk Management Framework 2025” — https://digital.nemko.com/regulations/nist-rmf
• Sombra, “2026 Guide to AI Regulations” — https://sombrainc.com/blog/ai-regulations-2026-eu-ai-act
• Bradley Law, “Global AI Governance: Five Key Frameworks Explained” — https://www.bradley.com/insights/publications/2025/08/global-ai-governance-five-key-frameworks-explained

Previous: MIT AI Risk Repository | Next: EU AI Act