NIST AI RMF

The NIST Artificial Intelligence Risk Management Framework (AI RMF 1.0) is a voluntary framework to help organizations manage risks to people and organizations from AI systems across the AI lifecycle, organized around Govern, Map, Measure, and Manage functions.

• Voluntary guidance for trustworthy AI characteristics (e.g., validity, safety, security, accountability, transparency, fairness, privacy)
• Playbook and profiles published by NIST to support implementation
• Not a certification scheme by itself

Enterprises and U.S. public-sector suppliers frequently reference NIST AI RMF as a governance baseline for AI risk assessments, documentation, and measurement practices alongside legal requirements.

• Voluntary; adopting AI RMF does not equal regulatory compliance
• Organizations must tailor profiles to their use cases

It is a widely referenced voluntary framework for structuring AI risk programs in the United States and beyond.

• AI risk program design
• Gap assessments
• Vendor questionnaire alignment

• Practical taxonomy of risk activities
• Compatible with existing GRC programs

• Voluntary—does not itself create legal compliance
• Requires tailoring to context

• Using NIST AI RMF language is not the same as completing the work

Is NIST AI RMF mandatory?

It is voluntary guidance, though some contracts or agencies may reference it.

• NIST — AI Risk Management Framework
• NIST AI RMF 1.0 (PDF)