The NIST AI Risk Management Framework (AI RMF 1.0), published in January 2023 by the US National Institute of Standards and Technology, is a voluntary framework designed to help organizations manage risks associated with AI systems. Unlike the EU AI Act, it is not legally binding, but it has become the de facto standard for AI risk management in the United States and is referenced by federal agencies, industry standards bodies, and international organizations.

Structure

The AI RMF is organized into two parts. Part 1 describes how organizations can frame risks related to AI and outlines the characteristics of trustworthy AI: valid and reliable, safe, secure and resilient, accountable and transparent, explainable and interpretable, privacy-enhanced, and fair with harmful bias managed.

Part 2 provides the AI RMF Core, structured around four functions: Govern establishes organizational AI risk management policies, roles, and culture. Map identifies and contextualizes AI risks based on the system’s use case and deployment context. Measure employs quantitative and qualitative methods to analyze and monitor AI risks. Manage implements risk treatments including mitigation, transfer, avoidance, or acceptance.

AI RMF Playbook

NIST also published a companion Playbook that provides suggested actions and references for each subcategory in the framework. It offers practical guidance for implementing the framework’s recommendations, though organizations must adapt it to their specific context.

Relationship to Other Standards

The AI RMF aligns with ISO/IEC 42001 (AI Management System), the OECD AI Principles, and the EU AI Act’s risk-based approach. Organizations operating globally can use the AI RMF alongside these frameworks. Many of the AI RMF’s categories map directly to EU AI Act requirements, making it useful as a starting point for organizations that need to comply with both US and EU expectations.

Adoption

While voluntary, the AI RMF has been widely adopted. Federal agencies reference it in procurement requirements. The framework was cited in Executive Order 14110 on AI safety (October 2023); that order was rescinded in January 2025 and replaced by Executive Order 14179, so it no longer drives federal adoption. Industry consortia use the framework as a baseline for sector-specific AI risk guidance.

Profiles and Revision

NIST extends the framework through profiles. The Generative AI Profile (NIST AI 600-1), released on 26 July 2024, identifies risks specific to generative AI and suggests actions for managing them. On 7 April 2026 NIST released a concept note for an AI RMF Profile on Trustworthy AI in Critical Infrastructure. As of September 2026, NIST states that AI RMF 1.0 is being revised as part of the White House AI Action Plan.

Sources

  • National Institute of Standards and Technology. (2023). Artificial Intelligence Risk Management Framework (AI RMF 1.0). NIST AI 100-1. (The framework itself; all GOVERN/MAP/MEASURE/MANAGE functions and trustworthy AI characteristics are defined here.)
  • National Institute of Standards and Technology. (2023). AI RMF Playbook. NIST. (Companion document providing suggested actions for each AI RMF subcategory.)
  • Executive Office of the President. (2023). Executive Order 14110 on the Safe, Secure, and Trustworthy Development and Use of Artificial Intelligence. The White House. (US federal AI policy that cited AI RMF 1.0; rescinded in January 2025 and replaced by Executive Order 14179.)
  • National Institute of Standards and Technology. (2024). Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile. NIST AI 600-1. https://doi.org/10.6028/NIST.AI.600-1
  • National Institute of Standards and Technology. AI Risk Management Framework (accessed 25 September 2026). https://www.nist.gov/itl/ai-risk-management-framework (Source for the AI Action Plan revision and the April 2026 critical-infrastructure profile concept note.)