NIST AI RMF

The NIST AI Risk Management Framework (AI RMF 1.0) is a framework published by the US National Institute of Standards and Technology as NIST AI 100-1 in January 2023. NIST describes it as voluntary, non-sector-specific and use-case agnostic, so organizations of any size can adopt it.

What are the four functions of the NIST AI RMF?

The framework's Core has four functions. GOVERN applies across the whole organization and covers policies, accountability and culture. MAP establishes the context to frame the risks of an AI system. MEASURE uses quantitative, qualitative or mixed-method tools to analyze, assess, benchmark and monitor AI risk. MANAGE allocates risk resources to the mapped and measured risks and covers plans to respond to and recover from incidents. Each function is broken into categories and subcategories.

Is the NIST AI RMF mandatory?

No. NIST states that the framework is intended for voluntary use. Regulators and customers may still ask how your program lines up with it, so many US enterprises use it as a common vocabulary for AI risk.

How does the NIST AI RMF apply to AI agents?

The framework is not written for agents specifically, so applying it to them is an interpretation. In practice, teams use GOVERN for ownership and policy over agents, MAP to document what each agent can reach, MEASURE for testing and monitoring, and MANAGE for incident response and change control. See AI agent governance and the post on how to govern AI agents. The SOC 2 and AI agents guide shows how the same work maps to audit evidence.

Frequently asked questions

What does NIST AI 100-1 stand for?

It is the publication number of the AI Risk Management Framework 1.0, released by NIST in January 2023.

Is the NIST AI RMF a certification?

No. It is a voluntary framework, and NIST does not certify organizations against it.

How is the NIST AI RMF different from model risk management?

Model risk management is a banking discipline focused on model validation. The AI RMF is a broader, cross-sector framework for AI risk.

Where does AI red teaming fit?

AI red teaming is a testing method that can support the MEASURE and MANAGE functions.