NIST AI RMF.
Understand AI risks in their specific use, make reasoned decisions and verify the effect of safeguards.
- NIST AI 100-1 · AI RMF 1.0
- By Jonathan Bezdek
- As of: 10/22/2026
- Reading time: 7 min.
Short answer.
NIST AI RMF is a voluntary framework for AI system risk management. AI Risk Management Framework 1.0 supports development, deployment and assessment through Govern, Map, Measure and Manage. It connects technical examinations with accountability and consideration of impacts throughout the lifecycle; it creates no general certification procedure.
AI RMF 1.0, Playbook and Generative AI Profile.
NIST AI RMF 1.0 is a publication of the US National Institute of Standards and Technology dated 26 January 2023. NIST AI 100-1 describes risks to people, organisations and society, alongside characteristics of trustworthy AI. The framework focuses consideration on actual use: a model passing a test does not yet explain the consequences of its outputs in an operational workflow.
The NIST AI RMF Playbook supplements the framework with voluntary suggested actions. According to NIST's Playbook page, it is not a checklist to complete in full; suitable suggestions are selected for your own context. NIST AI 600-1 of July 2024 is a separate Generative AI Profile. It explores generative AI risks and supplements the base edition rather than replacing it with a new version.
NIST announces a revision of AI RMF 1.0 on its programme page and in the FAQ updated in August 2026. This page refers to the published base edition and named supplements. For your own work, record which version, profile and source status support an assessment.
Who the AI Risk Management Framework is intended for.
Under NIST AI 100-1, section 2, the NIST AI RMF addresses different actors in the AI lifecycle: development, procurement, deployment and assessment. The NIST FAQ names organisations of different sizes and sectors. A company purchasing external AI can also use it to address questions about use, supplier dependencies and its own responsibility.
Assessment belongs in a cross-functional team. Technical specialists can examine system behaviour, for example, while business owners explain which errors have significant consequences in a workflow. Data protection, security and affected people's perspectives complement this work. Under NIST AI 100-1, section 3, trade-offs may exist between trustworthiness characteristics; a single good metric therefore does not replace a reasoned overall decision.
Connect Govern, Map, Measure and Manage.
The four functions in NIST AI 100-1, section 5, organise AI risk work. They are not four project phases that must be completed sequentially. Govern is cross-cutting; operational and assessment findings lead back to context clarification and decisions.
Govern: responsibility and decision rules.
Under section 5.1, Govern connects technical work with responsibilities, risk tolerance and organisational rules. For a specific use, it must be understandable who owns an assessment, who may decide on residual risks and when escalation occurs. Governance remains active after approval and supports the other functions.
Map: use context and possible consequences.
Under section 5.2, Map examines an AI system's purpose, environment, participants and potential impacts. An assistant for internal text drafts has different decision points from an application whose results influence job applications. The context description reveals missing information and assumptions limiting a later assessment.
Measure: examine statements using suitable methods.
Under section 5.3, Measure uses qualitative and quantitative methods to examine risks and relevant system characteristics. Tests should fit the identified consequences and disclose their limitations. A result is only as meaningful as the data, test conditions and use examined; uncertainty therefore belongs in the assessment.
Manage: direct treatment and operations.
Under section 5.4, Manage prioritises measures and decisions according to assessed risks. This includes treatment, monitoring and handling changes or incidents. An organisation should be able to explain why it approves, restricts or ends a use and which results would later change that decision.
Apply NIST AI RMF in practice.
Define the use case.
As a practical starting point, choose a specific AI-supported process and document purpose, system boundaries, owner and framework version used.
Examine context together.
Record participants, affected people, suppliers and possible consequences, and retain conflicting assumptions as open investigation questions.
Determine risks and assessment needs.
Prioritise relevant risk scenarios and decide which technical examinations, professional assessments and additional information a robust decision requires.
Justify treatment and approval.
Connect results with safeguards, remaining uncertainties and an accountable decision, including conditions and limitations.
Track operations and changes.
Define which feedback, incidents or changes trigger reassessment and who takes on the resulting work.
Evidence through verifiable decisions.
An RMF-oriented assessment becomes traceable through its scope, methods and documented results. NIST AI 100-1, sections 4 and 6, addresses effectiveness and context-specific profiles. Meaningful evidence includes, for example, reasoned risk consideration, traceable evaluations, documented limitations and reviewed treatment decisions. A completed questionnaire alone does not show that a risk is controlled.
The voluntary framework contains no certification procedure modelled on an ISO management system standard. For external assessment, examine what was actually evaluated: which application, version, methods and point in time. A private attestation should be judged against these details and not treated as blanket NIST approval. No general certificate validity period follows from the AI RMF.
Other frameworks for other decisions.
ISO 42001 describes AI management system requirements and possible independent certification. The EU AI Act creates separate statutory duties depending on system, role and application date. NIST CSF supports cybersecurity risk work; applying these instruments does not replace context-specific AI risk consideration or establish automatic mutual compliance.
In Secani.
Secani provides an editorial work catalogue for NIST AI RMF 1.0 with German and English content. The stored AI profile includes details such as role, generative use, external models and operational status. The product catalogue identifies the pending professional review and does not fully cover the separate Generative AI Profile or future NIST revisions. It creates no automatic conformity or certification decision.
Start with a specific AI decision.
Choose a use for which your organisation must justify a robust approval or restriction. Assemble existing context information, evaluations and decisions, and name the owner. This enables examination of what information is missing for a decision and what work is needed first. This starting point is a practical recommendation; the Playbook prescribes no universal project sequence.
Sources.
- NIST: AI Risk Management Framework and revision status
- NIST AI 100-1: AI RMF 1.0, sections 1–6
- NIST: AI Risk Management Framework FAQs
- NIST: AI RMF Playbook
- NIST AIRC: Playbook and application guidance
- NIST AIRC: AI RMF Core, section 5
- NIST AI 600-1: Generative Artificial Intelligence Profile
- NIST: publication of the Generative AI Profile
Frequently asked questions.
NIST provides the AI RMF as a voluntary framework. The legal or contractual requirements applicable to a specific AI use require separate examination.
No. Governance is cross-cutting; the functions are repeatedly connected as appropriate to the context. Neither the Core nor the Playbook is a sequence to complete in full for every use.
No. NIST AI 600-1 is a supplementary profile to AI RMF 1.0 for generative AI and does not replace the base edition.
The AI RMF creates no certification procedure like an ISO management system standard. An external assessment must be judged by its method and actual scope; it does not replace separate legal conformity assessment.
Manage AI risks with a clear audit trail.
Secani supports work with the editorial AI RMF catalogue and associated AI profile.
This page provides general context on NIST publications. The named original sources and requirements applicable to the particular use take precedence.