The National Institute of Standards and Technology released version 1.0 of its AI Risk Management Framework on 26 January 2023. It is voluntary. No law requires you to use it, no regulator will fine you for ignoring it, and it certifies nothing. Yet it has become the default reference model for how enterprises structure an AI governance program, in the United States and well beyond it. Procurement teams ask about it, boards cite it, and a growing number of AI policies are written directly against its four functions.
That gap between "voluntary" and "widely expected" is the point of this guide. The framework is deliberately non-prescriptive, which makes it flexible and, for many teams, hard to operationalize. Below is a practical read of what the NIST AI RMF actually contains, how its two parts fit together, what each of the four core functions asks you to do, how to adopt it without stalling, and how it sits alongside the EU AI Act and ISO/IEC 42001.
What It Is and Why It Matters
A voluntary, US-origin framework that has quietly become the common backbone for AI governance programs worldwide.
Congress directed NIST to build the framework in the National AI Initiative Act of 2020. NIST developed it in the open, across roughly 18 months of public workshops and comment periods, which is why it reads less like a standard and more like a consensus playbook. It is technology-neutral and sector-neutral: it applies to a fraud model in a bank, a triage tool in a hospital, and a coding assistant in a software team without changing shape.
Its reach is the interesting part. The framework carries no penalties, yet it has been absorbed into the language of AI governance. US federal agencies reference it, insurers and auditors ask about it, and enterprises use it as the scaffolding onto which they hang regulatory requirements. When a company says it has "aligned to NIST," it usually means its policies, inventory, and testing regime are organized around the four functions below.
Two documents matter most. The base framework, NIST AI 100-1, defines the trustworthy AI characteristics and the four-function Core. In July 2024, NIST added the Generative AI Profile, NIST AI 600-1, which lists suggested actions against 12 risks unique to or amplified by generative systems. The Profile is why the framework stayed relevant through the LLM and agent wave.
The Two Parts: Framing and the Core
First the framework defines what trustworthy AI means, then it gives you the functions to manage toward it.
The framework splits cleanly in two. Part 1 is the framing: how to think about AI risk, plus the characteristics of a trustworthy system. Part 2 is the Core: the four functions and their categories that turn those characteristics into repeatable work. Read Part 1 to agree on the destination. Use Part 2 to get there.
The seven trustworthy AI characteristics
NIST frames trustworthiness as a set of properties a system should hold in balance. They trade off against each other, so the framework treats them as decisions to be made and documented, not boxes to tick. A model tuned for maximum accuracy may become harder to explain; tighter privacy controls may reduce the data available for bias testing. The point is to make those trade-offs deliberate and traceable.
1. Valid and reliable
The system does what it claims, accurately and consistently, and keeps doing so under real conditions. This is the foundation; the other characteristics build on it.
2. Safe
It does not, under defined conditions, endanger human life, health, property, or the environment. Safety needs clear operating boundaries and the ability to shut down or hand off.
3. Secure and resilient
It withstands adversarial attacks such as data poisoning, model evasion, and prompt injection, and recovers gracefully from failures or misuse.
4. Accountable and transparent
Information about the system, its data, and its limits is available to the people who need it, and clear lines of responsibility exist for its behavior.
5. Explainable and interpretable
The mechanism behind an output can be represented, and its meaning understood in context, so decisions can be reviewed and contested.
6. Privacy-enhanced
The system safeguards autonomy, identity, and dignity through practices such as data minimization, anonymization, and consent by design.
7. Fair, with harmful bias managed
Harmful bias is identified and managed across its three sources: systemic, computational and statistical, and human-cognitive. Fairness is context-specific, not a single metric.
The Core, Part 2, is where these seven properties become operational. It is a set of outcomes organized under four functions, each broken into categories and subcategories. The functions are not strictly sequential. Govern runs continuously, and Map, Measure, and Manage cycle throughout a system's life rather than happening once.
The Four Core Functions in Depth
Govern is the culture that surrounds everything. Map, Measure, and Manage form the working loop applied to each AI system.
NIST organizes the Core into 19 categories and 72 subcategories across the four functions. You do not need to memorize the numbering. You do need to understand what each function is for and the concrete activities it drives.
Govern is the only function that touches all the others. It sets the accountability, policies, and culture that make the rest possible. Without it, Map, Measure, and Manage become one-off exercises that decay after launch.
- Assign named ownership for AI risk, with escalation paths to a risk committee or the board.
- Write AI policies covering acceptable use, human oversight, procurement of third-party models, and incident response.
- Stand up and maintain an inventory of AI systems and use cases, including systems bought or embedded in vendor products.
- Define how the workforce is trained, how diverse perspectives are included, and how affected people can raise concerns.
Map establishes context. Before you can measure anything, you need to know what a system is for, who it affects, and where it can go wrong. Skipping Map is the most common reason programs measure the wrong things.
- Document each system's purpose, intended use, deployment setting, and the assumptions built into it.
- Identify who is affected, including people who never interact with the system directly.
- Categorize risks and benefits, and flag uses that should be off-limits.
- Map dependencies on third-party data, models, and components, since risk is inherited through the supply chain.
Measure turns identified risks into evidence. It applies quantitative and qualitative methods to test how a system actually behaves against the trustworthy characteristics, and it tracks that behavior over time rather than at a single point.
- Select metrics and test methods appropriate to each risk: accuracy, robustness, fairness across groups, explainability, and security.
- Evaluate for trustworthiness with techniques such as red-teaming, adversarial testing, and bias audits.
- Build feedback mechanisms so users and affected people can report failures.
- Track validity over time to catch drift, since a model that passed at launch can degrade in production.
Manage acts on what Measure found. It sends resources to the highest risks, decides how to treat each one, and keeps systems under watch after deployment. This is where governance either changes behavior or stays on paper.
- Prioritize risks based on impact and likelihood, and decide whether to mitigate, transfer, avoid, or accept each one.
- Plan responses to residual risks, including fallback and human-override procedures.
- Manage third-party risk with contractual controls and ongoing vendor oversight.
- Monitor systems in production, run incident response when something breaks, and feed lessons back into Map and Measure.
Read Govern as the container. Map, Measure, and Manage are the loop you run on every AI system. Govern is the environment that decides whether that loop is funded, staffed, and enforced. Programs that start with a governance charter and an inventory tend to make the other three functions stick.
How to Actually Adopt It
The framework describes outcomes, not a project plan. Here is a sequence that turns it into one.
Because the RMF is non-prescriptive, teams often read it, agree with it, and then stall on how to begin. A workable order follows the functions but anchors to two artifacts: an inventory and a profile. The inventory tells you what you have. A profile records current state and target state, so progress is measurable.
-
Use GOVERN to stand up ownershipStart here, not with a pilot. Name an accountable owner, form a cross-functional review group, and approve a short AI policy. Decide risk appetite in plain terms so later prioritization has a reference point.
- Assign an executive owner and a working group spanning risk, legal, security, and the AI teams.
- Approve an acceptable-use policy and an intake process for new AI use cases.
-
MAP your use cases into an inventoryYou cannot govern what you cannot see. Discover AI systems across the organization, including embedded vendor features and unapproved tools, then record purpose, owner, data, and affected groups for each.
- Build a live inventory of models, use cases, and agents, and keep discovery running rather than one-off.
- Assign a preliminary risk tier to each entry so effort follows exposure.
-
MEASURE with tests and metricsFor higher-risk systems, define what "good" looks like and test against it. Combine automated evaluation with human review, and set the metrics you will monitor after launch.
- Run bias, robustness, and security testing proportionate to each system's tier.
- Establish baseline metrics and thresholds that trigger review.
-
MANAGE with treatment and monitoringDecide how to treat each risk, document the decision, and put continuous monitoring in place. Tie every action back to the inventory so evidence accumulates rather than scattering across tickets and spreadsheets.
- Record treatment decisions and residual-risk acceptances with an owner and a date.
- Monitor for drift and incidents, and route findings back into Map and Measure.
Two ideas hold this together. The inventory is the single source of truth for what AI exists and who owns it. A profile is your tailored subset of the Core: the categories that apply to your context, your current maturity against them, and your target. NIST expects organizations to build profiles rather than adopt all 72 subcategories at once. The Generative AI Profile is simply one that NIST wrote for everyone.
The Generative AI Profile
NIST AI 600-1, released July 2024, extends the framework to the risks that generative models and agents introduce.
The base framework predates the mainstream arrival of large language models. The Generative AI Profile, published on 26 July 2024 in response to the 2023 US Executive Order on AI, closes that gap. It does not replace the Core. It is a cross-sector profile that identifies 12 risks unique to, or made worse by, generative AI, with suggested actions organized under the same four functions. The categories matter for anyone deploying LLMs, retrieval systems, or agents; several, such as confabulation, information integrity, and value chain risk, are hard to see with pre-LLM governance.
| GenAI risk category | What it means in practice |
|---|---|
| CBRN information or capabilities | Lowered barriers to chemical, biological, radiological, or nuclear harm. |
| Confabulation | Confident, fluent output that is factually wrong (commonly called hallucination). |
| Dangerous, violent, or hateful content | Generation of content that incites or facilitates harm. |
| Data privacy | Leakage of personal or sensitive data through training data or prompts. |
| Environmental impacts | Energy and resource cost of training and running large models. |
| Harmful bias or homogenization | Amplified bias and a narrowing of outputs toward a dominant view. |
| Human-AI configuration | Overreliance, automation bias, and unclear roles between people and systems. |
| Information integrity | Scaled production of misinformation, disinformation, and deepfakes. |
| Information security | Prompt injection, data poisoning, and model extraction attacks. |
| Intellectual property | Reproduction of copyrighted or proprietary material. |
| Obscene, degrading, or abusive content | Non-consensual imagery and child sexual abuse material. |
| Value chain and component integration | Inherited risk from third-party models, data, and components. |
Agents raise the stakes. When a generative model can call tools and act, human-AI configuration and value chain risk stop being abstract. Agent governance needs identity, scoped permissions, and observability over what the agent did and why, not just an evaluation of what the model can say.
How It Relates to the EU AI Act and ISO 42001
One is a voluntary method, one is binding law, one is a certifiable management system. They fit together rather than compete.
These three are the pillars of most enterprise AI governance programs, and they do different jobs. The NIST AI RMF is a voluntary method for managing AI risk. The EU AI Act is binding law with penalties. ISO/IEC 42001 is a certifiable management system standard. Confusing them leads to duplicated work; using them together is efficient.
| Attribute | NIST AI RMF | EU AI Act | ISO/IEC 42001 |
|---|---|---|---|
| Type | Voluntary framework | Binding regulation | Certifiable standard |
| Origin | NIST (US), 2023 | European Union, 2024 | ISO/IEC, 2023 |
| Force | No penalties | Up to €35M or 7% of global turnover (Art. 99) | No penalties; audited certification |
| Approach | Risk functions: Govern, Map, Measure, Manage | Risk tiers: unacceptable, high, limited, minimal | Management system (Plan-Do-Check-Act) |
| Scope | Any AI, any sector | AI placed on or used in the EU market | Any organization's AI management system |
| Best used for | Structuring how you assess and manage risk | Meeting a legal obligation | Proving governance to third parties |
They map onto each other well. The RMF's Govern function aligns with the leadership and policy clauses of ISO 42001 and the risk-management-system requirements of the EU AI Act's Article 9. The RMF's Map and Measure functions supply much of the risk identification and testing evidence a high-risk EU AI Act conformity assessment demands. Many teams run the RMF as their operating method, use ISO 42001 as the certifiable wrapper, and treat the EU AI Act as one of several legal profiles the method must satisfy. NIST has published a crosswalk mapping the RMF to ISO/IEC 42001 and other standards, a useful starting point.
From policy to practice. Spreadsheets and ticket queues rarely keep up with how fast AI spreads across an enterprise, or with the job of proving one control set satisfies several frameworks at once. Dedicated AI governance platforms give governance teams one place to discover, assess, monitor, and evidence every model and agent against frameworks like the EU AI Act, NIST AI RMF, and ISO 42001.
Key Takeaways
- The NIST AI RMF is voluntary and carries no penalties, but adoption has made it the common structure enterprises use to organize AI governance, including outside the US.
- It has two parts: the framing (seven trustworthy AI characteristics) and the Core (four functions across 19 categories and 72 subcategories).
- Govern cuts across everything; Map, Measure, and Manage form the working loop you run on each AI system.
- Adoption works best when anchored to a live inventory and to profiles that record current versus target state, rather than adopting all subcategories at once.
- The Generative AI Profile (NIST AI 600-1, July 2024) adds 12 GenAI risk categories, which is what keeps the framework useful for LLMs and agents.
- The RMF, the EU AI Act, and ISO/IEC 42001 are complementary: a method, a law, and a certifiable standard. Map one control set to all three to avoid duplicated effort.
Frequently Asked Questions
No. It is voluntary and creates no legal obligation, and there are no penalties for not using it. Its weight comes from adoption: US federal guidance references it, auditors and insurers ask about it, and enterprises use it as the backbone their regulatory requirements attach to.
Govern, Map, Measure, and Manage. Govern establishes the culture, policies, and accountability that surround everything. Map sets context and identifies risk. Measure tests and tracks behavior with metrics. Manage prioritizes, treats, and monitors risk. Govern runs continuously while the other three cycle through a system's life.
It is NIST AI 600-1, published in July 2024, a companion to the base framework. It identifies 12 risks that are unique to or amplified by generative AI, such as confabulation, information integrity, and value chain risk, and lists suggested actions organized under the same four functions.
They are different instruments that fit together. The RMF is a voluntary method for managing AI risk; the EU AI Act is binding law with penalties up to €35M or 7% of global turnover under Article 99. The RMF's Map and Measure activities generate much of the risk assessment and testing evidence a high-risk EU AI Act conformity assessment requires.
No. The RMF is not a certifiable standard, so there is no formal certification or badge. If you need third-party certification, ISO/IEC 42001 is the AI management system standard designed for that. Many organizations run the RMF as their method and use ISO 42001 as the certifiable wrapper around it.
Start with Govern: name an accountable owner, approve a short AI policy, and stand up a live inventory of your AI systems and use cases. Then apply Map, Measure, and Manage to your highest-risk systems first, recording current versus target state in a profile so progress is measurable.
