NIST AI Risk Management Framework: Govern, Map, Measure, Manage

What it is

The AI Risk Management Framework (AI RMF) was released by NIST on 26 January 2023 after an open drafting process. It is voluntary, sector-neutral and use-case neutral. It addresses AI risks broadly: not only security, but also safety, reliability, privacy, fairness, transparency and accountability. Like the Cybersecurity Framework, it describes outcomes and activities rather than mandating specific technical controls.

Part 1 describes what makes AI trustworthy. NIST lists seven characteristics: valid and reliable; safe; secure and resilient; accountable and transparent; explainable and interpretable; privacy-enhanced; and fair with harmful bias managed. Part 2 is the Core: four functions broken into categories and subcategories.

Why it matters

AI systems fail in ways traditional software does not. They can be accurate on test data and wrong in the field, reflect bias in their training data, be manipulated through their inputs, leak training data, or behave differently after an update from the model provider. Many organisations now use AI through vendors without knowing how it was built. The AI RMF gives a shared structure so that technical teams, risk managers, legal and leadership can discuss these issues in one language. It is widely referenced in policy discussions and in organisations’ AI governance programmes, and it maps to international work such as ISO/IEC 42001 for AI management systems.

Key ideas

• Govern sets policies, roles, risk tolerance and a culture that takes AI risk seriously, including processes for third-party AI and for decommissioning systems.
• Map establishes context: the intended purpose, users, affected people, legal setting and what could go wrong. Many risks are found here, before any testing.
• Measure uses quantitative and qualitative methods to evaluate trustworthiness characteristics, including testing, red teaming and monitoring over time.
• Manage prioritises risks, decides on responses (accept, mitigate, transfer, avoid), plans incident response and monitors deployed systems.
• Profiles adapt the framework to a use case or technology, in the same way as CSF Profiles.

What changed recently

• Generative AI Profile (NIST AI 600-1), July 2024. It identifies risks that are unique to or made worse by generative AI, such as confabulation (confidently wrong output), information integrity problems, data privacy, information security, intellectual property, harmful content and value chain integration, and suggests actions under each AI RMF function.
• Cyber AI Profile draft (NIST IR 8596), December 2025. Built on CSF 2.0, it covers three focus areas: securing AI system components, using AI for cyber defence, and thwarting AI-enabled attacks. Public comments closed in January 2026 and working sessions followed.
• Revision and new profiles. NIST has stated that AI RMF 1.0 is being revised as part of the US AI Action Plan, and in April 2026 released a concept note for a profile on trustworthy AI in critical infrastructure.

How practitioners apply it

1. Inventory AI use, including AI features inside SaaS tools and models accessed through APIs.
2. Classify by impact. A spam filter and a system that screens job applicants need very different levels of scrutiny.
3. Map each significant system: purpose, data sources, users, affected groups, failure modes and legal duties.
4. Measure with test sets, bias checks, security testing (see the OWASP LLM Top 10) and monitoring for drift after deployment.
5. Manage through documented decisions, human oversight where impact is high, and AI-specific incident procedures.

Tip: Security teams can start by adding AI systems to existing processes: asset inventory, supplier assessment, access reviews and logging. The AI RMF then adds the questions those processes miss, such as bias and explainability.

For a student project or dissertation, the AI RMF offers a ready-made evaluation structure. Pick one AI-enabled system, such as a phishing email classifier, and document it function by function: the governance decisions behind it, the context map, the metrics used to measure accuracy and false positives, and the management actions taken when performance drifts. This shows examiners a recognised framework applied with evidence rather than a list of opinions.

Limitations and open questions

• High level by design. It does not specify thresholds, test methods or acceptable error rates; organisations must decide.
• Measurement science is immature. Reliable, repeatable evaluations of fairness, robustness and safety, especially for large general-purpose models, remain an active research area.
• Third-party models limit what a deploying organisation can actually measure or change.
• Policy flux. A revision is under way and regulatory approaches differ between jurisdictions, so mappings will need updating.