# What is NIST AI Risk Management Framework?

Also called NIST AI RMF, AI RMF 1.0.

The NIST AI Risk Management Framework is a voluntary framework published by the United States National Institute of Standards and Technology for identifying, measuring and managing risks from artificial intelligence systems. It is organized around four functions, Govern, Map, Measure and Manage, and is widely used as a common vocabulary for AI risk work rather than as a certifiable standard.

Govern establishes the organizational conditions: policies, accountability, roles, workforce competence and processes for third party risk. It is treated as cross cutting, since without it the other functions produce analysis that nobody is responsible for acting on. Much of the framework's practical value comes from forcing an explicit owner for decisions that otherwise diffuse across teams.

Map builds context. It covers the system's intended purpose, deployment setting, affected people, assumptions and limitations, and the ways it could fail or be misused. Measure then applies quantitative and qualitative methods to the risks identified, including evaluation, testing, red teaming and monitoring, while acknowledging that many AI risks lack settled measurement methods.

Manage allocates resources to the mapped and measured risks, decides what is treated, transferred, avoided or accepted, and establishes response and recovery for incidents. The framework stresses that this is continual, because deployment context changes, models are updated, and behavior drifts. A one time assessment filed at launch does not satisfy the intent.

The framework describes trustworthiness characteristics including validity and reliability, safety, security and resilience, accountability and transparency, explainability and interpretability, privacy enhancement, and fairness with harmful bias managed. Accompanying material such as the playbook and a profile addressing generative AI offers concrete suggested actions, and organizations commonly map it onto existing security and quality management systems.

## Key points

- Four functions: Govern, Map, Measure and Manage
- Voluntary framework and shared vocabulary, not a certification
- Govern is cross cutting and assigns accountability
- Risk management is continual, not a launch time document
- Companion profiles address generative AI specifically

## In practice

Before deploying an assistant that drafts customer communications, a team uses the framework as a structure. Govern names an accountable owner and an approval path. Map records the intended use, the populations affected and the failure modes, including confidently wrong statements. Measure defines evaluations for factual accuracy and refusal behavior. Manage sets the monitoring thresholds, the human review requirement and the rollback plan.

## Related terms

- [AI Governance](/en/glossary/ai-governance)
- [Model Evaluation](/en/glossary/model-evaluation)
- [Red Teaming](/en/glossary/red-teaming)
- [EU AI Act](/en/glossary/eu-ai-act)
- [AI Incident Response](/en/glossary/ai-incident-response)

[Back to the AI Glossary](/en/glossary)