NIST AI Risk Management Framework (AI RMF 1.0)
The NIST AI Risk Management Framework (AI RMF 1.0), published January 2023 as NIST AI 100-1, provides a voluntary framework for managing AI risk across the lifecycle. It is the foundational U.S. standard referenced by OMB memoranda, sector regulators, and the EU AI Act's alignment efforts.
The Core: Four Functions
The AI RMF Core organises risk management activities into four functions, each with categories and subcategories:
| Function | Identifier | Purpose | Key Categories |
|---|---|---|---|
| Govern | GOVERN | Establish accountability, culture, and policies | GOVERN-1 through GOVERN-6 |
| Map | MAP | Contextualise risks: stakeholders, use cases, dependencies | MAP-1 through MAP-5 |
| Measure | MEASURE | Quantify and monitor risk with metrics and testing | MEASURE-1 through MEASURE-4 |
| Manage | MANAGE | Prioritise, respond to, and recover from risks | MANAGE-1 through MANAGE-4 |
Primary source: NIST AI 100-1, Section 3 (The AI RMF Core). NIST AI RMF Knowledge Base
Profiles
AI RMF Profiles adapt the Core to specific sectors, use cases, or risk tolerances. NIST publishes:
- Cross-sectoral Profile — Baseline for general-purpose AI systems
- Use-case Profiles — e.g., hiring, credit scoring, healthcare diagnostics (in development via the AI RMF Knowledge Base)
- Organisational Profiles — Custom profiles documenting an entity's risk appetite and control selection
Primary source: NIST AI 100-1, Section 4 (AI RMF Profiles). Profile Development Guidance
The Playbook
The AI RMF Playbook (online companion) provides actionable suggestions for each subcategory: tasks, references, and example outputs. It is not normative — organisations select relevant actions.
Primary source: AI RMF Playbook
Governance Integration
| AI RMF Function | ISO 42001 Clause | EU AI Act Alignment |
|---|---|---|
| GOVERN | Clause 5 (Leadership), Clause 6 (Planning) | Art. 9 (Risk management system), Art. 17 (QMS) |
| MAP | Clause 4 (Context), Clause 6.1 (Risk assessment) | Art. 9 (Risk assessment), Annex III classification |
| MEASURE | Clause 9 (Performance evaluation) | Art. 9 (Testing), Art. 72 (Post-market monitoring) |
| MANAGE | Clause 8 (Operation), Clause 10 (Improvement) | Art. 9 (Risk treatment), Art. 20 (Corrective actions) |
Citation
- Instrument: NIST AI 100-1 — Artificial Intelligence Risk Management Framework (AI RMF 1.0)
- Publisher: National Institute of Standards and Technology
- Date: January 2023
- URL: https://airc.nist.gov/AI_RMF_Knowledge_Base
- DOI: https://doi.org/10.6028/NIST.AI.100-1
- Status: Voluntary framework; referenced in OMB M-24-10 (Sept 2024) for federal agencies