NIST AI Risk Management Framework for State Courts: A Practical Application

The National Institute of Standards and Technology (NIST) AI Risk Management Framework (AI RMF 1.0) was released in January 2023 and updated with generative AI companion profiles in 2024. This article summarizes how state court systems have applied the framework as of early 2026.

Framework structure

NIST AI RMF 1.0 organizes risk management around four functions:

1. GOVERN: Policies, processes, procedures, and practices across the organization.
2. MAP: Identify and document AI risks in context.
3. MEASURE: Analyze and track AI risks.
4. MANAGE: Allocate resources to map, measure, and manage risks.

Source: https://www.nist.gov/itl/ai-risk-management-framework

Generative AI Profile (NIST AI 600-1)

Released July 2024, the profile adds 12 risk categories specific to generative AI:

1. Confabulation (hallucination)
2. Data privacy
3. Information security
4. Information integrity
5. Harmful bias
6. Homogenization (single-source outputs)
7. Copyright violation
8. Identity exploitation
9. Interaction harms
10. Obscene / degrading content
11. Value misalignment
12. Real-world representational harm

Source: https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf

State court adoption (2024-2026)

Documented by National Center for State Courts (NCSC):

• California Judicial Branch: Issued guidance in 2025 referencing NIST AI RMF for AI vendor evaluation.
• Utah Courts: First state court system with public AI vendor assessment using NIST AI RMF.
• Texas Office of Court Administration: AI procurement guidance referencing the framework.
• New Jersey Courts: AI task force referenced NIST in 2025 recommendations.
• Kansas Judicial Branch: Internal AI policies structured around the four functions.

Source: NCSC AI Resource Center (https://www.ncsc.org/ai)

Practical application

For a state court evaluating an AI vendor:

GOVERN

• Document procurement process for AI tools.
• Require AI vendor disclosure of training data sources.
• Establish policy on prohibited use cases.

MAP

• Inventory deployment context (intended users, use cases, decision types).
• Document risks across the 12 generative AI categories.

MEASURE

• Track vendor eval metrics (citation accuracy, hallucination rate).
• Audit deployed systems periodically.

MANAGE

• Pilot deployment before broad rollout.
• Document incident response procedures.

Recommendations

1. Use NIST AI RMF as procurement framework.
2. Engage stakeholders before procurement.
3. Pilot before broad rollout.
4. Track eval metrics weekly.
5. Document AI use in plain language.

Acknowledgments

This article summarizes public sources as of early 2026.

Dillon Deutsch has built AI systems applying NIST AI RMF in state court contexts. https://courtgpt.ai