The NIST AI Risk Management Framework (AI RMF) is guidance published by the U.S. National Institute of Standards and Technology (NIST) on January 26, 2023, to help organizations manage risks from AI systems across their lifecycle, from design and development to deployment and retirement. It is voluntary: not a law, and not a standard you certify against. That makes it usable by organizations of any size.
What the NIST AI RMF is, and who it is for
- Broader than cybersecurity: it covers risks to individuals, organizations, and society, such as wrong outputs, bias, and privacy harm, as well as system security
- For builders and users of AI: organizations that buy or use off-the-shelf AI products, such as chatbots or analytics tools, can use it to assess risk too
- Companion material: the AI RMF Playbook offers suggested practices, and the Generative AI Profile (NIST AI 600-1), released on July 26, 2024, covers risks specific to generative AI
- Still evolving: according to NIST's website as of October 2026, AI RMF 1.0 is being revised as part of the White House AI Action Plan, and a concept note exists for a profile on trustworthy AI in critical infrastructure. Check NIST for the latest version before citing it
The four core functions of the AI RMF
The AI RMF organizes risk management into four functions: Govern, Map, Measure, and Manage.
- Govern: build the culture and accountability structure, such as AI use policy, roles and risk owners, and acceptable risk levels. It applies across all the other functions
- Map: establish context by identifying what the AI is used for, with whom, on what data, and what impacts could follow
- Measure: assess and track risk with metrics and testing, such as accuracy, bias, security, and resilience
- Manage: prioritize and treat the risks found, for example by mitigating them, planning incident response, and monitoring after deployment
Characteristics of trustworthy AI in the AI RMF
NIST describes trustworthy AI as having the characteristics below, balanced appropriately for each use case.
- Valid and reliable
- Safe
- Secure and resilient
- Accountable and transparent
- Explainable and interpretable
- Privacy-enhanced
- Fair, with harmful bias managed
How the AI RMF connects to cybersecurity work
Security is only one of those characteristics, but it is the one security teams can act on right away.
- Find the AI actually in use: the first step of Map is knowing which AI tools staff use, including those outside approved channels. Read more in What Is Shadow AI?
- Defend against AI-specific threats: such as prompt injection, leakage of data entered into systems, and AI agents with excess permissions
- Use AI with guardrails in operations: an example of AI in a monitoring team is in Using AI in the SOC to Reduce MTTD and MTTR
- The Generative AI Profile: helps identify risks specific to generative AI, such as confabulation (inventing facts), data privacy, information security, and intellectual property
How the AI RMF differs from ISO/IEC 42001
- NIST AI RMF: flexible voluntary guidance with no set of requirements to meet and no certification
- ISO/IEC 42001: an AI management system standard with clear requirements that external bodies can certify against
- They can work together: an organization might use the AI RMF as the practice for assessing risk and ISO/IEC 42001 as the structure of its management system
How to start applying the AI RMF
- Build an AI inventory: record the tools, owners, the data used, and who is affected
- Set policy and ownership (Govern): which data levels never go into outside AI, and who approves new uses
- Rate each use case by risk (Map): look at the data used, the impact on people, and automated decisions
- Define metrics and test (Measure): test accuracy, bias, and attacks such as prompt injection
- Manage and monitor (Manage): apply mitigations, require human approval for important actions, keep a response plan, and review on a cycle
Cautions when using the AI RMF
- A framework, not a checklist: adapt it to the context and risk of each use case
- There is no "NIST AI RMF compliant" certificate: avoid claiming formal compliance and say "based on the NIST AI RMF" instead
- Start with high-risk use cases: such as AI that makes decisions about people or touches sensitive data
- Check the latest version: because the documents are under revision, review NIST's updates periodically
The first step you can take today: inventory your AI
Survey which AI tools the organization uses, who owns them, and what data they touch, then group them by risk. This list underpins every other function. For a wider view of your security readiness, try the free cybersecurity readiness self-assessment.
When AI agents connect to tools through the MCP protocol, the security risks behind the Map and Measure functions get very technical. See the details in What Is MCP? Architecture, Security Risks, and Technical Defenses.
For a view that goes down to protecting every layer of an AI system and setting up a governance program, read AI Security and AI Governance: Protect Every AI Component.
For an international standard that an organization can be certified against, see ISO/IEC 27001:2022 Explained for Beginners.
The general cybersecurity framework that sits beside the AI RMF is covered in NIST CSF 2.0: The Six Functions and How to Use Them.
References and further reading
- NIST AI Risk Management Framework: the framework's main page, with the latest news and documents
- NIST AI 100-1: AI RMF 1.0: the full framework document
- NIST AI 600-1: Generative AI Profile: the profile for generative AI
- NIST AI Resource Center: the Playbook and supporting resources