What is the NIST AI Risk Management Framework (AI RMF)?
The NIST AI Risk Management Framework (AI RMF 1.0, officially NIST AI 100-1) is a voluntary framework published in January 2023 by the U.S. National Institute of Standards and Technology. Specifically, it helps organizations manage the risks of artificial intelligence. In practice, it is non-sector-specific and use-case agnostic, so it applies equally to a bank deploying a credit scoring model, a hospital using diagnostic AI, or a startup shipping an LLM-powered product.
Moreover, the goal is simple: build AI systems that people can actually trust. As a result, the framework helps you minimize downside risks, including threats to civil liberties, safety, privacy, and human rights, while still capturing the upside of AI adoption. Since its release, the AI RMF has become a de facto international reference, cited alongside ISO/IEC 42001 and the EU AI Act.
How do the four core functions of the AI RMF work?
The AI RMF Core is organized around four functions that form a continuous risk management loop. Specifically:
- Govern: the backbone. It sets the culture, policies, roles, and accountability structures that make AI risk management real. Moreover, it is cross-cutting and always on
- Map: builds context. You identify who is affected by the AI system, what it is supposed to do, what data it uses, and what could go wrong. In fact, this is where the initial go or no-go decision happens, before code and compute are committed
- Measure: turns context into evidence. Specifically, you use quantitative and qualitative methods to assess and track risks, including test, evaluation, verification, and validation (TEVV) processes, red teaming, bias testing, and performance benchmarking
- Manage: where you act. You prioritize the risks surfaced by Map and Measure, allocate resources, apply mitigations, and build response and recovery plans for incidents
What are the seven trustworthiness characteristics in the NIST AI RMF?
A trustworthy AI system is defined through seven characteristics. However, these characteristics interact and trade off against each other, so the framework’s job is not to pretend they are independent. Instead, it gives you a structured way to make tradeoffs consciously, document them, and defend them. For example, adding differential privacy often reduces model accuracy, and pushing explainability may require simpler architectures that are less performant.
Specifically, the seven characteristics are:
- Valid and reliable: the system works as intended, consistently, across expected conditions
- Safe: it does not endanger human life, health, property, or the environment
- Secure and resilient: it withstands adversarial attacks and system failures
- Accountable and transparent: roles, decisions, and data flows are documented and traceable
- Explainable and interpretable: users can understand what the model did and why
- Privacy-enhanced: personal data is protected throughout the lifecycle
- Fair with harmful bias managed: the system does not produce systematically unjust outcomes for particular groups
How does the NIST AI RMF relate to other NIST frameworks?
The AI RMF shares the outcome-based, function-category-subcategory structure of the NIST Cybersecurity Framework (CSF), the NIST Privacy Framework, and the NIST Risk Management Framework (SP 800-37). Moreover, this is deliberate. As a result, organizations can plug AI risk management into their existing governance programs rather than build an isolated silo.
In practice, each framework handles a different layer:
- NIST CSF: handles the security of the infrastructure around the model (identity, network, endpoints, incident response)
- NIST Privacy Framework: handles personal data protection, which feeds directly into the privacy-enhanced trustworthiness characteristic
- NIST RMF (SP 800-37): handles organizational risk management for federal systems
- NIST AI RMF: handles the risks that only exist because AI is in the system, such as bias, hallucination, model drift, adversarial ML, and data poisoning
