NIST AI Risk Management Framework (AI RMF 1.0)

Overview

The NIST Artificial Intelligence Risk Management Framework (AI RMF 1.0) is a voluntary framework released by the U.S. National Institute of Standards and Technology on January 26, 2023, intended to help organizations design, develop, deploy, and use AI systems in a manner that manages risks to individuals, organizations, and society.

The framework is built around four core functions:

• GOVERN — establish a culture of risk management with policies, processes, accountability structures, and oversight
• MAP — identify the context, intended uses, stakeholders, and risks of an AI system
• MEASURE — assess, analyze, and track AI risks and impacts using qualitative and quantitative methods
• MANAGE — allocate risk resources and treat identified risks based on assessed impact

NIST also released the Generative AI Profile (NIST AI 600-1) in July 2024, which provides specific guidance for the unique risks of generative AI systems, including confabulation, harmful biases, intellectual property issues, and value chain risks.

The framework PDF is paired with the NIST AI RMF Playbook, an interactive companion resource hosted on the NIST AI Resource Center (AIRC) that supplies *suggested actions*, transparency-and-documentation prompts, and references for each subcategory across all four functions. The Playbook is not distributed as a PDF — it is maintained as a living web resource and is updated independently of the framework PDF itself.

While the RMF itself is non-binding, it is widely referenced in U.S. state AI laws, federal procurement requirements, and emerging international AI policy. It is not directly certifiable — there is no "NIST AI RMF certification" issued by NIST itself. ISO/IEC 42001 provides a complementary certifiable management-system standard for organizations that need an accredited certificate.