NIST AI Risk Management Framework

The NIST AI Risk Management Framework (AI RMF 1.0, released January 2023) is the federal government’s voluntary framework for managing risks from artificial intelligence systems. It does not mandate specific controls — it gives organizations a common language and process for identifying, assessing, and managing AI risk.

The four functions

Govern — Build a culture of AI risk management: policies, accountability, workforce, and communication.

Map — Establish context: categorize the AI system, understand its intended use, and identify risks and benefits.

Measure — Analyze and monitor: test, evaluate, and track AI risks with appropriate metrics.

Manage — Respond: prioritize risks, allocate resources, and decide whether to deploy, limit, or discontinue.

The generative AI profile

NIST AI 600-1, the Generative AI Profile (July 2024), tailors the framework to generative AI — covering risks like confabulation, dangerous content, data privacy, and value-chain issues unique to foundation models.

Who it applies to

The AI RMF is voluntary. But it is the reference point behind federal practice: OMB memos, agency AI governance, and DoD AI efforts all trace back to its concepts. If you work with AI in or around government, this is the vocabulary everyone else is using.

Key facts

Issued by: National Institute of Standards and Technology (NIST). AI RMF 1.0: January 2023. GenAI Profile (AI 600-1): July 2024. Status: In effect, voluntary. Companion: AI RMF Playbook. Official source: nist.gov/itl/ai-risk-management-framework.