The NIST AI Risk Management Framework, published as NIST AI 100-1 on 26 January 2023, is organised around four functions: Govern, Map, Measure and Manage. They are usually reproduced as a four-quadrant diagram, which loses the only structurally interesting thing about them — three of them are a loop, and the fourth wraps around it.
The shape of the document
The framework is voluntary. It is not a regulation, it creates no obligation, and NIST has no enforcement role in relation to it. It is also sector-neutral by design, which is why it reads more abstractly than a sectoral rulebook and why almost every organisation using it ends up writing a profile: a selection of the subcategories that apply to them, with a target state.
Structurally, Part 1 sets out how the framework frames risk and defines the characteristics of trustworthy AI systems — valid and reliable; safe; secure and resilient; accountable and transparent; explainable and interpretable; privacy-enhanced; and fair with harmful biases managed. Part 2 is the core: four functions, each divided into numbered categories, each of those into subcategories. Govern carries six categories, Map five, Measure four and Manage four, and the subcategory is the unit you actually work with. NIST publishes a companion Playbook of suggested actions, references and documentation against each subcategory. The framework text itself is at NIST AI 100-1.
Nothing here is legal advice. The AI RMF is voluntary and adopting it does not by itself satisfy any statutory obligation; where a regulator or a contract references it, the reference’s own wording controls what is required. Take advice on your own facts.
Govern
Govern is not the first step in a sequence. It is the function that is supposed to be in place while the other three run, which is why NIST draws it as the surrounding ring rather than the first box. Its categories cover legal and regulatory requirements being understood and documented; a risk management process that is defined and communicated; risk tolerances that have actually been decided; roles and responsibilities and lines of accountability; a workforce with the competence to do the work; and processes for engaging with people outside the organisation who are affected by the system.
What Govern asks you to produce is unglamorous and specific: a written policy, a named accountable owner, a documented risk tolerance, evidence of training, a defined process for a third-party model or dataset entering your estate, and a decommissioning process. That last one is the subcategory nobody has an answer to on a first pass — how a system is retired, and what happens to its data and its downstream dependents.
Map
Map establishes context, and it is the function that most directly rewards honesty. Its categories cover the context of use; the categorisation of the AI system; the capabilities and business value being sought; the risks and benefits of all components including third-party ones; and the characterisation of impacts on individuals, groups, communities and society.
The artefact is a description of the system that a stranger could act on: what it does, who uses it, who is affected by it without using it, what data it depends on, which parts you built and which you procured, what the intended purpose is, and — the subcategory that carries the most weight — what uses are foreseeable but not intended. Mapping the third-party components is where most generative AI work sits today, because the model is somebody else’s and the risk documentation you are relying on is theirs. See what model cards and datasheets are worth as evidence.
Measure
Measure is where the framework becomes uncomfortable, and it is the function organisations quietly skip. Its four categories ask for appropriate methods and metrics to be identified and applied; for trustworthiness characteristics to be evaluated; for mechanisms to track identified risks over time; and for the measurement effectiveness itself to be assessed by feedback.
The demand underneath that is that you say, in advance, what number would tell you the system is working and what number would tell you it is not. For a classifier that is routine. For a generative system it is genuinely hard, and pretending otherwise is why so many AI RMF implementations have a rich Govern section and a Measure section consisting of the phrase “human review”. Measure also explicitly asks whether the measurement approach is valid — a benchmark that no longer correlates with your task is a measurement failure, not a passing grade.
One subcategory worth reading closely asks that measurement include things that are hard to measure, with the difficulty documented rather than the item dropped. That is the framework’s answer to the obvious gaming strategy, and it is the sentence to quote when somebody proposes to leave a risk out of the register because it has no metric.
Manage
Manage is what you do with the output of Measure: risks are prioritised and acted on based on the assessment; strategies to maximise benefit and minimise harm are planned and documented; third-party risks are managed and monitored; and risk treatments including response, recovery and communication are documented and monitored regularly.
The artefacts are a prioritised risk register with decisions recorded, including explicit decisions to accept a risk and who accepted it; an incident response path for AI-specific failures; a mechanism for people affected by the system to report a problem; and post-deployment monitoring that runs on a schedule rather than after an incident. If you are also in scope for the EU regime, this is the function that maps most directly onto the AI Act’s post-market monitoring plan and its serious incident reporting duty, though the AI Act’s versions are obligations with deadlines and the RMF’s is a suggestion.
Status, and what may change
The AI RMF was produced under a statutory direction in the National Artificial Intelligence Initiative Act of 2020 and released in January 2023. Its companion Generative AI Profile, NIST AI 600-1, arrived in July 2024 under Executive Order 14110; that order was revoked by Executive Order 14179 on 23 January 2025, which does not withdraw the published documents but does change the policy context around them.
More consequentially for anyone citing the framework in a policy document: the July 2025 federal AI Action Plan recommended revising the AI RMF to remove certain references, including to misinformation, diversity, equity and inclusion, and climate change. A recommendation is not a revision, and at the time of writing the version in circulation is still 1.0.
Treat the framework’s text as a moving target and check NIST’s own AI RMF page before quoting a subcategory identifier in a contract or a policy. A clause that points at “the NIST AI RMF” without a version points at whatever it becomes.
Top comments (0)