What is the NIST AI RMF?
The NIST AI Risk Management Framework (AI RMF 1.0) is a voluntary US framework, published in January 2023, for managing the risks of AI systems. It organizes the work into four functions, Govern, Map, Measure and Manage, and defines seven characteristics of trustworthy AI. NIST is revising it as part of the White House AI Action Plan.
TL;DR
- Voluntary, with no certification scheme.
- Four functions: Govern, Map, Measure and Manage.
- The Generative AI Profile is NIST AI 600-1.
Reviewed by the ComplyEasyAI compliance teamLast reviewed
How does the NIST AI RMF work in practice?
The NIST AI Risk Management Framework (AI RMF) was published by NIST in January 2023 (AI RMF 1.0) and is now being revised. It promotes trustworthy and responsible AI, and it is voluntary and adaptable across sectors and use cases.
The framework is organized around four core functions: GOVERN, which establishes a culture of risk management; MAP, which contextualizes risks; MEASURE, which analyzes and tracks them; and MANAGE, which prioritizes and acts on them. Together they form a continuous loop rather than a one-time assessment.
The AI RMF complements binding regulation such as the EU AI Act by providing concrete, characteristics-based guidance — for example around validity, reliability, safety, security, accountability, transparency, fairness, and privacy — that organizations can operationalize as controls.
What else do people ask about the NIST AI RMF?
Can you be certified to the NIST AI RMF?
No. It is a voluntary framework without a certification scheme; organizations use it to structure their AI risk program.
What is NIST AI 600-1?
The Generative AI Profile, released on 26 July 2024, which applies the AI RMF to risks specific to generative AI.
Which terms are related to the NIST AI RMF?
- AI ComplianceAI compliance is the practice of making sure AI systems meet the laws, standards and ethical policies that apply to them across their lifecycle. It covers an inventory of AI systems, risk classification, data governance, documentation, bias testing, human oversight and monitoring, under rules such as the EU AI Act, NIST AI RMF and ISO/IEC 42001.
- EU AI ActThe EU AI Act (Regulation (EU) 2024/1689) is the European Union’s law on artificial intelligence. It bans some practices outright, sets strict duties for high-risk systems, and requires transparency for chatbots and synthetic content. As amended in 2026, high-risk duties apply from 2 December 2027, or 2 August 2028 for AI in regulated products.
- Risk RegisterA risk register is the central record of an organization’s identified risks. Each entry describes the risk, its likelihood and impact, the resulting rating, the owner, and the treatment decision: mitigate, transfer, accept or avoid. ISO 27001, the NIST AI RMF and most other frameworks expect one, kept current and linked to controls.
- GRCGRC stands for governance, risk and compliance: the combined practice of setting direction and accountability, managing risks to objectives, and proving adherence to laws, standards and internal policies. Running the three together, with one control library, risk register and evidence base, avoids the duplicated work of separate security, legal and audit processes.