NIST AI Risk Management Framework.

Overview

The NIST AI Risk Management Framework (AI RMF 1.0, published January 26, 2023 as NIST AI 100-1) gives organizations a repeatable process for identifying, measuring, and responding to AI risks across the full development and deployment lifecycle.

NIST AI RMF carries no direct enforcement authority — no penalties attach to ignoring it. But two bodies of real legal obligation flow from it. First, Colorado SB 24-205 (§6-1-1702) cites alignment with recognized AI risk management frameworks as evidence of "reasonable care," creating an explicit safe harbor. Second, Executive Order 14110 (§4.1, October 2023) mandated NIST AI RMF adoption across all federal agencies, and OMB M-24-10 (March 2024) translated that mandate into specific minimum practices: every federal AI use must be inventoried, classified by risk, and tracked against AI RMF outcomes.

The four-function structure — Govern, Map, Measure, Manage — applies to any industry and any deployment size. A 15-person fintech running a single credit-scoring model and a health system operating 200 clinical decision-support tools both use the same framework to document AI risk ownership and track remediation progress.

---

Who It Applies To

No statutory scope rule applies — NIST AI RMF is voluntary. But adoption is functionally required in three situations:

Federal agencies and their contractors

EO 14110 (§4.1) and OMB M-24-10 require federal agencies to inventory all AI use cases, classify each by risk level, and manage identified risks against AI RMF outcomes. Agencies must designate a Chief AI Officer (CAIO) with authority over that inventory. Contractors building or operating AI systems for federal customers should treat NIST AI RMF alignment as a contract requirement, not a suggestion — procurement officers increasingly ask for it in RFPs.

Companies subject to the Colorado AI Act

SB 24-205 §6-1-1702(4) names alignment with recognized AI risk management frameworks as a factor demonstrating reasonable care. NIST AI RMF adoption is the most direct path to that defense: it generates the documented impact assessments, governance policies, and bias testing records the law requires. Organizations that complete a NIST AI RMF profile for each high-risk AI system have a documented paper trail before the January 1, 2027 enforcement date.

Financial services and healthcare firms

The OCC, FRB, FDIC, and CFPB jointly cited NIST AI RMF in their 2023 interagency guidance on AI risk. FDA's proposed framework for AI/ML-based Software as a Medical Device references the same core functions. Documented NIST AI RMF alignment gives compliance teams a pre-built answer to examiner questions about AI governance — particularly for models that affect credit decisions (subject to ECOA, FCRA) or clinical outcomes.

Organizations pursuing ISO 42001 certification also benefit: NIST maintains a published crosswalk between AI RMF subcategories and ISO 42001 clauses. The two frameworks are complementary — AI RMF provides risk management operational substance, ISO 42001 provides the management system shell.

Roles Within the Framework

The NIST AI RMF addresses distinct organizational roles:

• AI actors — all individuals and organizations involved in the AI lifecycle: designers, developers, deployers, operators, evaluators, and end users
• Governance bodies — boards, executives, and oversight committees responsible for AI risk governance
• Third parties — vendors, suppliers, and service providers in the AI supply chain

---

Core Functions

The NIST AI RMF is organized around four core functions. Each function contains categories (written as GOVERN 1, MAP 2, etc.) and subcategories (GOVERN 1.1, MAP 2.3, etc.) that describe specific outcomes organizations should achieve.

Govern

Govern establishes the organizational infrastructure that makes AI risk management repeatable rather than ad hoc. It is cross-cutting: the policies and accountability structures defined under Govern shape how Map, Measure, and Manage operate.

Six concrete outcomes define the Govern function:

• Documented policies and roles (GOVERN 1.1): Who owns AI risk decisions? Which risk levels require board-level approval? Which require legal sign-off before deployment? Write these down in a policy document before your first audit or enforcement inquiry.
• Board-level accountability (GOVERN 1.2): AI risk has explicit executive ownership, documented in board minutes or a designated officer's mandate — not just in a data science team's wiki.
• Risk tolerance statements (GOVERN 1.6): Define in writing what levels of bias error rates, failure modes, or accuracy degradation are acceptable for each system category. A credit underwriting model and a content recommendation engine warrant different tolerance thresholds.
• Interdisciplinary review: Governance bodies include legal, data science, compliance, product, and affected-community representatives — not solely the team that built the model.
• Third-party oversight (GOVERN 6.1–6.2): For every vendor AI system deployed — hiring tools, credit models, clinical decision support — document the vendor's name, the documentation obtained, and how compliance obligations are enforced contractually.
• Organizational culture: Regular AI risk training for staff who operate or oversee AI systems, with documented completion records.

Map

Map pins each AI system to its real-world operating context before broader risk work begins. Without Map, risk assessment floats free of the specific deployment and misses use-case-specific failure modes.

Five outputs define a complete Map for each AI system:

• Use-context documentation (MAP 1.1): Who runs this system? What decisions does it influence? What happens downstream when it produces an error? A hiring tool screening 50,000 applications per year has different Map outputs than the same algorithm used to shortlist 20 internal transfer candidates.
• Affected stakeholder inventory (MAP 3.5): Identify not just system users but communities impacted by AI outputs. For an automated benefits-eligibility system, affected parties include applicants who never interact directly with the UI.
• Risk catalog across seven trustworthiness dimensions (MAP 5.1): Validity and reliability, safety, security and resilience, accountability and transparency, explainability and interpretability, privacy, and fairness. Each dimension gets a separate risk entry with likelihood, severity, and ownership assigned.
• Benefit-cost assessment (MAP 2.3): Document why deploying this system is worth the identified risks. This record becomes critical if a regulator or plaintiff asks why the organization deployed the system given known limitations.
• Interdependency map (MAP 5.2): What data sources feed this system? What other systems consume its output? A credit model pulling from three external data vendors whose scores feed four downstream decisions has a different risk surface than a standalone tool.

Measure

Measure provides the quantitative and qualitative evidence base for AI risk management decisions. It converts risk identification from the Map function into documented findings that can be tracked, compared, and reported.

Four outputs define the Measure function:

• Metrics and measurement approaches (MEASURE 1.1): Select metrics that fit the specific risk type. Bias measurement for a hiring model uses demographic parity or equalized odds — not generic accuracy. Document which metric applies to which risk and why.
• AI system testing (MEASURE 2.5–2.7): Test against identified risks before deployment and at defined post-deployment intervals. For high-risk systems in regulated industries, red-teaming and adversarial testing are standard practice. Colorado SB 24-205 requires bias testing records as part of the impact assessment.
• Production monitoring (MEASURE 3.1–3.3): Track model performance, data drift, and emergent risks in production. Define thresholds that trigger review — not just alert — when crossed.
• Feedback mechanisms: Collect input from AI system users and affected communities after deployment. Document what feedback was received and what changes were made in response.

Manage

Manage converts risk findings into decisions and action. It allocates resources, prioritizes response, and closes the cycle from measurement to treatment.

Five outputs define the Manage function:

• Risk prioritization (MANAGE 1.1): Rank identified risks by likelihood × severity × organizational risk tolerance. Not every identified risk warrants immediate remediation — document the prioritization rationale.
• Risk treatment (MANAGE 2.2): Choose a response for each risk: accept (with documented rationale), mitigate (with specific control), transfer (insurance, contractual), or avoid (discontinue the use case). Accept is a legitimate answer when it is documented.
• Resource allocation: Assign specific personnel, tools, and budget to each risk treatment. Underfunded risk management plans routinely fail audits.
• Incident response (MANAGE 3.1): Define what constitutes an AI system incident, who gets notified, within what timeframe, and what remediation steps follow. Colorado SB 24-205 requires AG notification within 90 days of discovering algorithmic discrimination — that process must exist before the incident occurs.
• Continuous improvement (MANAGE 4.1–4.2): Update risk assessments and treatments based on incidents, model changes, regulatory updates, and evolving best practices. Document each update cycle with dates and responsible parties.

---

AI & NIST AI RMF Intersection

The NIST AI RMF functions as the operational backbone of AI compliance in the United States. Three enforcement-backed bodies of regulation now point to it explicitly.

Colorado SB 24-205 (§6-1-1702) treats NIST AI RMF alignment as evidence of "reasonable care" — the Act's central legal standard. Executive Order 14110 (§4.1) makes NIST AI RMF adoption effectively mandatory for federal agencies and their contractors. OMB M-24-10 (March 2024) specifies the minimum AI risk management practices federal programs must implement, all derived from AI RMF functions. State attorneys general in at least three states have referenced NIST AI RMF alignment in enforcement guidance and pre-litigation settlement negotiations since 2024.

Mapping to Enforceable Requirements

Trustworthiness Characteristics

The NIST AI RMF defines seven characteristics of trustworthy AI that organizations should assess across all AI systems:

1. Valid and Reliable — the AI system performs as intended under expected and unexpected conditions
2. Safe — the AI system does not endanger human life, health, property, or the environment
3. Secure and Resilient — the AI system maintains confidentiality, integrity, and availability, and can withstand adverse events
4. Accountable and Transparent — the AI system's processes and decisions can be explained and attributed to responsible parties
5. Explainable and Interpretable — AI system outputs and processes can be understood by intended users and stakeholders
6. Privacy-Enhanced — the AI system respects data privacy norms and minimizes privacy risks
7. Fair — with Harmful Bias Managed — the AI system's outcomes do not systematically disadvantage individuals or groups

Generative AI Profile (NIST AI 600-1)

In July 2024, NIST published the Generative AI Profile — a companion document that maps generative AI-specific risks to the AI RMF's core functions. It identifies 12 unique risk categories for generative AI:

• CBRN Information — risks of generating chemical, biological, radiological, or nuclear weapon information
• Confabulation — generating false but plausible content (hallucination)
• Data Privacy — training data memorization and regurgitation of personal information
• Environmental — computational and energy costs of large model training and inference
• Information Integrity — generation of misleading or manipulated content
• Information Security — novel attack vectors including prompt injection and model extraction
• Intellectual Property — copyright and IP risks from training data and generated outputs
• Obscene, Degrading, and/or Abusive Content — generation of harmful content
• Toxicity, Bias, and Homogenization — amplification of biases and reduction of content diversity
• Human-AI Configuration — risks from over-reliance, anthropomorphization, or inappropriate trust calibration
• Value Chain and Component Integration — supply chain risks from foundation models through deployment
• Dangerous or Violent Recommendations — generating actionable harmful instructions

---

Profiles & Tiers

AI RMF Profiles

A profile is a customized implementation of the AI RMF tailored to a specific context. Profiles allow organizations to select and prioritize the subcategories most relevant to their situation.

Current NIST-published profiles:

• Generative AI Profile (AI 600-1) — maps GAI-specific risks to AI RMF subcategories
• Crosswalk profiles — NIST maintains mappings between the AI RMF and other frameworks (ISO 42001, EU AI Act requirements)

How organizations use profiles:

1. Current Profile — document which AI RMF outcomes you are currently achieving
2. Target Profile — define which outcomes you need to achieve based on your regulatory obligations, risk appetite, and stakeholder expectations
3. Gap Analysis — identify the difference between current and target profiles and create an action plan

Implementation Tiers

While the NIST AI RMF does not prescribe formal maturity tiers like the NIST Cybersecurity Framework, organizations commonly adopt a tiered approach:

• Tier 1 — Partial — AI risk management is ad hoc and reactive; limited awareness of AI-specific risks at the organizational level
• Tier 2 — Risk-Informed — AI risk management practices exist but may not be organization-wide; management is aware of AI risks but processes are inconsistent
• Tier 3 — Repeatable — organization-wide AI risk management policies are established and consistently applied; regular review and update cycles are in place
• Tier 4 — Adaptive — AI risk management is fully integrated into organizational decision-making; continuous improvement based on lessons learned, incidents, and evolving best practices

---

Use-Case Guidance

The NIST AI RMF is designed to be applied to specific AI use cases rather than adopted as a blanket organizational policy. Key considerations for common enterprise use cases:

High-Risk Use Cases

Use cases where AI system outputs directly affect individuals' rights, safety, or access to critical services:

• Hiring and employment decisions — resume screening, candidate scoring, performance evaluation (governed by NYC LL 144, Colorado AI Act, Illinois AIVIRA)
• Credit and lending decisions — underwriting models, credit scoring, loan approval systems (ECOA, Fair Lending)
• Healthcare diagnostics and treatment — clinical decision support, diagnostic imaging, treatment recommendations (FDA, HIPAA)
• Criminal justice — risk assessment tools, predictive policing, recidivism prediction (no federal law, but significant litigation and state-level scrutiny)
• Insurance underwriting — pricing models, claims assessment, fraud detection (state insurance regulation)

For high-risk use cases, organizations should implement all four core functions comprehensively and document their risk management processes in detail, as this documentation may serve as evidence of reasonable care under state AI laws.

Medium-Risk Use Cases

Use cases with meaningful but less direct impacts on individuals:

• Customer service automation — chatbots, virtual assistants, automated ticket routing
• Content moderation — AI-driven content filtering and classification
• Supply chain optimization — demand forecasting, logistics planning

For medium-risk use cases, organizations should focus on Map and Measure functions to understand and monitor risks, with proportionate Govern and Manage processes.

Lower-Risk Use Cases

Use cases with limited direct impact on individuals:

• Internal analytics — business intelligence, operational dashboards
• Code generation — developer tools, code completion
• Document summarization — internal document processing

Even for lower-risk use cases, the Govern function should be in place to ensure organizational oversight and the ability to escalate if risk characteristics change.

---

Compliance Timeline

---

Regulatory References

Although the NIST AI RMF is voluntary, it is referenced by or aligned with numerous enforceable requirements:

Direct References

• Colorado AI Act (SB 24-205) — deployers who align with recognized AI risk management frameworks (including NIST AI RMF) can demonstrate reasonable care
• Executive Order 14110 — directs federal agencies to adopt AI governance consistent with the NIST AI RMF
• OMB M-24-10 — requires minimum AI risk management practices for federal agencies based on NIST AI RMF principles

Alignment and Crosswalks

• EU AI Act — NIST has published crosswalk documents mapping AI RMF subcategories to EU AI Act requirements; organizations subject to both US state laws and the EU AI Act can use the AI RMF as a unifying governance layer
• ISO/IEC 42001 — the AI RMF's four functions (Govern, Map, Measure, Manage) map to ISO 42001's management system structure, enabling organizations pursuing certification to build on their AI RMF implementation
• NIST Cybersecurity Framework (CSF) — the AI RMF is designed to complement the CSF; organizations already using CSF can extend their governance processes to cover AI-specific risks

---

Implementation Steps

Use this roadmap to implement the NIST AI RMF in your organization:

1. Establish AI governance (Govern). Designate an AI risk management owner — whether a Chief AI Officer, risk committee, or existing governance body. Document AI policies, roles, and accountability structures. Define your organization's AI risk appetite and tolerance levels.

2. Inventory your AI systems. Create a comprehensive inventory of all AI systems in development, deployment, and production. Include vendor-provided AI systems and AI components embedded in third-party software.

3. Categorize by risk level. For each AI system, assess the potential impact on individuals, communities, and the organization. Use the Map function to document intended purposes, stakeholders, and identified risks. Prioritize high-risk systems for immediate attention.

4. Build your profiles. Create a Current Profile documenting your existing AI risk management practices. Define a Target Profile based on your regulatory obligations (Colorado AI Act, EU AI Act, sector-specific requirements) and risk appetite. Identify gaps.

5. Implement measurement and testing (Measure). Establish metrics for each AI system's trustworthiness characteristics. Implement bias testing, performance monitoring, adversarial testing, and drift detection. For generative AI systems, apply the AI 600-1 profile's risk categories.

6. Establish risk treatments (Manage). For each identified and measured risk, select a treatment: mitigate, accept, transfer, or avoid. Allocate resources and assign owners. Build incident response procedures for AI system failures.

7. Document and communicate. Maintain comprehensive documentation of your AI risk management process — this documentation is your evidence of reasonable care under state AI laws. Communicate your AI governance practices to stakeholders, regulators, and the public as appropriate.

8. Monitor and iterate. AI risk management is continuous, not one-time. Schedule regular reviews of AI system performance, risk assessments, and governance processes. Update profiles as regulations evolve, new risks emerge, and organizational context changes.

9. Align with regulatory requirements. Map your NIST AI RMF implementation to specific regulatory obligations: Colorado AI Act impact assessments, NYC LL 144 bias audits, EU AI Act conformity assessments. Use the AI RMF as the single governance backbone that feeds compliance documentation for multiple regulations.

10. Engage with the NIST AI RMF community. NIST actively solicits feedback and publishes updated resources. Monitor NIST's AI RMF website for new profiles, crosswalk documents, and playbook updates. Participate in sector-specific profile development where relevant.

---

Frequently Asked Questions

Is the NIST AI RMF legally binding? No — the NIST AI RMF is a voluntary framework. However, it has quasi-regulatory force through multiple channels: Executive Order 14110 directs federal agencies to adopt it, OMB M-24-10 requires agency compliance, and the Colorado AI Act treats alignment as evidence of reasonable care. Its influence on the US AI regulatory landscape is significant and growing.

What are the four core functions of the NIST AI RMF? Govern (organizational AI risk governance), Map (context and risk identification), Measure (risk assessment and monitoring), and Manage (risk treatment and response). Govern is cross-cutting and informs the other three functions.

How does the NIST AI RMF relate to the EU AI Act? NIST has published crosswalk documents mapping AI RMF subcategories to EU AI Act requirements. Organizations subject to both frameworks can use the AI RMF as a unifying governance layer. The AI RMF's risk management approach is broadly compatible with the EU AI Act's risk-based classification, though the EU AI Act adds prescriptive legal requirements (conformity assessments, CE marking, registration) that go beyond the AI RMF.

Does the NIST AI RMF cover generative AI? Yes. The Generative AI Profile (NIST AI 600-1), published July 2024, extends the AI RMF to address 12 generative AI-specific risk categories including confabulation, data privacy, information integrity, and CBRN information risks.

How much does NIST AI RMF implementation cost? The framework itself is free. Implementation costs vary based on organizational size and AI system portfolio. Unlike ISO 42001, there is no certification fee — the NIST AI RMF is self-assessed. Organizations typically invest in governance process development, technical tooling for bias testing and monitoring, and training for AI development and deployment teams.

Can NIST AI RMF compliance protect against enforcement actions? Under the Colorado AI Act, demonstrating alignment with recognized AI risk management frameworks (including NIST AI RMF) serves as evidence of reasonable care. While this is not an absolute defense, it provides meaningful protection. Other state laws and regulators are likely to adopt similar provisions as the US AI regulatory landscape matures.

---

Official Sources

• NIST AI Risk Management Framework (AI 100-1)
• NIST AI RMF Playbook
• Generative AI Profile (AI 600-1)