NIST AI Risk Management Framework
In plain wordsA free, voluntary guide from the US government's standards agency that helps organizations spot, measure and reduce the risks of the AI systems they build or use.
A voluntary framework from the US National Institute of Standards and Technology (NIST) for managing risks from AI systemsAI system, n.: A complete piece of technology that uses AI to do something, such as screening loan applications, driving a car or chatting with customers, including the AI model and the software around it. across their life cycle. It names characteristics of trustworthy AI — valid and reliable; safe; secure and resilient; accountable and transparent; explainable and interpretable; privacy-enhanced; and fair, with harmful bias managed — and organizes risk management into four functions: Govern (the policies, culture and lines of accountability that frame the other three), Map (understanding where and how a system will be used and what could go wrong), Measure (testing and quantifying those risks over time) and Manage (deciding which risks to treat first and responding to them). Each function divides into categories and subcategories. A companion Playbook suggests concrete actions, and profiles adapt the framework to particular settings, notably the Generative AI Profile (NIST AI 600-1, July 2024).
We mapped our model-release checklist to the Measure and Manage functions of the AI RMF.
Origin
Directed by the US National Artificial Intelligence Initiative Act of 2020 and developed through public drafts and workshops from 2021; version 1.0 (NIST AI 100-1) was released on 26 January 2023. In July 2025 America's AI Action Plan called for NIST to revise it, removing references to misinformation, diversity, equity and inclusion, and climate change; as of August 2026 the revision was under way and version 1.0 remained current.
Usage note
Though American and voluntary, it is used internationally and has been cross-walked to ISO/IEC 42001ISO/IEC 42001, prop. n.: An international standard for how an organization should run its AI work responsibly — policies, risk checks, roles and records — which outside auditors can certify, much as ISO 9001 does for quality. and the EU AI ActEU AI Act, prop. n.: The European Union's law on artificial intelligence, the first broad AI law anywhere: it bans some uses, sets strict checks for risky ones and puts duties on the makers of the biggest AI models.. Some US state AI laws and bills have offered a defense to organizations that follow a recognized framework such as the AI RMF, as the 2024 Colorado AI ActColorado AI Act, prop. n.: A Colorado law, first passed in 2024, governing AI used to make important decisions about people, such as hiring, lending and housing. In 2026 it was rewritten as a narrower law that starts in 2027. did before it was rewritten in 2026. A concept note for a critical-infrastructure profile followed in April 2026.
Related
- ISO/IEC 42001ISO/IEC 42001, prop. n.: An international standard for how an organization should run its AI work responsibly — policies, risk checks, roles and records — which outside auditors can certify, much as ISO 9001 does for quality.
- AI governanceAI governance, n.: The rules, institutions and habits that shape how AI is built and used — from laws and treaties to technical standards and a company's own review processes.
- Center for AI Standards and InnovationCenter for AI Standards and Innovation, prop. n.: The US government's AI testing and standards center, part of the National Institute of Standards and Technology. It evaluates advanced AI models, American and foreign, for national-security risks and works with companies on voluntary testing.
- America's AI Action PlanAmerica's AI Action Plan, prop. n.: The Trump administration's 2025 strategy for winning a global AI race: cutting regulation, building data centers and power plants quickly, and exporting American AI technology to allies.
- trustworthy AItrustworthy AI, n.: AI that deserves people's trust because it works reliably, obeys the law, treats people fairly and can be checked, rather than AI that people merely happen to trust.
- risk-based approachrisk-based approach, n.: A way of regulating AI in which the strictness of the rules depends on how much harm a use could cause: bans for the worst uses, heavy checks for risky ones, little or nothing for the rest.
- ISO/IEC 42001ISO/IEC 42001, prop. n.: An international standard for how an organization should run its AI work responsibly — policies, risk checks, roles and records — which outside auditors can certify, much as ISO 9001 does for quality.
Sources
- National Institute of Standards and Technology (2023). Artificial Intelligence Risk Management Framework (AI RMF 1.0). NIST AI 100-1.
- National Institute of Standards and Technology (2024). Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile. NIST AI 600-1.
- National Institute of Standards and Technology. AI Risk Management Framework (program page, updated August 2026). nist.gov/itl/ai-risk-management-framework
Mentioned in
AI governanceAI governance, n.: The rules, institutions and habits that shape how AI is built and used — from laws and treaties to technical standards and a company's own review processes., AI riskAI risk, n.: The ways AI could cause harm: people misusing it on purpose, systems behaving in ways nobody intended, and slower effects on jobs, power and society that no single person causes., AI auditAI audit, n.: An independent check of an AI system, or of the company using it, against agreed standards — for example, testing whether a hiring tool treats women and men fairly., algorithmic impact assessmentalgorithmic impact assessment, n.: A structured review, done before and during the use of an automated system, of whom it could affect and how — such as unfair treatment or privacy harms — and what will be done about it., Blueprint for an AI Bill of RightsBlueprint for an AI Bill of Rights, prop. n.: A 2022 White House document listing five protections Americans should have when automated systems affect their lives — safety, fairness, privacy, explanation and a human alternative. It was guidance, not law., Center for AI Standards and InnovationCenter for AI Standards and Innovation, prop. n.: The US government's AI testing and standards center, part of the National Institute of Standards and Technology. It evaluates advanced AI models, American and foreign, for national-security risks and works with companies on voluntary testing., ISO/IEC 42001ISO/IEC 42001, prop. n.: An international standard for how an organization should run its AI work responsibly — policies, risk checks, roles and records — which outside auditors can certify, much as ISO 9001 does for quality., model risk managementmodel risk management, n.: The rules banks and other firms follow to make sure the mathematical models and AI systems they rely on are built correctly, checked independently and used only for what they are fit for., responsible AIresponsible AI, n.: An umbrella name for the practices organizations use to keep their AI systems fair, safe, private and accountable, from the first design meeting to everyday use., risk-based approachrisk-based approach, n.: A way of regulating AI in which the strictness of the rules depends on how much harm a use could cause: bans for the worst uses, heavy checks for risky ones, little or nothing for the rest., trustworthy AItrustworthy AI, n.: AI that deserves people's trust because it works reliably, obeys the law, treats people fairly and can be checked, rather than AI that people merely happen to trust., ISO/IEC 23894ISO/IEC 23894, prop. n.: An international guidance standard that explains how organizations can apply ordinary risk-management practice to the particular risks of AI systems., ISO/IEC JTC 1/SC 42ISO/IEC JTC 1/SC 42, prop. n.: The international committee that writes the main worldwide technical standards on artificial intelligence, run jointly by the standards bodies ISO and IEC.