What is the NIST AI Risk Management Framework?

The NIST AI RMF (AI 100-1) is a voluntary, outcome-based framework published in January 2023. It provides organizations with a structured approach to managing AI risks through four core functions: Govern, Map, Measure, and Manage. It covers 19 categories and 72 subcategories of AI risk management activities.

What are the four functions of the NIST AI RMF?

The four functions are GOVERN (establishes culture, policies, and accountability), MAP (defines context, identifies risks), MEASURE (assesses and tracks risks through testing and evaluation), and MANAGE (treats, monitors, and communicates risk responses). GOVERN is cross-cutting and applies across the other three functions.

Is the NIST AI RMF mandatory?

No, the NIST AI RMF is voluntary. However, it is increasingly referenced in regulatory frameworks and procurement requirements. Federal agencies may be required to use it under the AI in Government Act and related executive orders.

How does the NIST AI RMF relate to ISO 42001?

A crosswalk maps NIST AI RMF subcategories to related ISO 42001 clauses and Annex B guidance where they align. Where subcategories map, the alignment is typically high, but coverage is partial (35 of 72), so implementing one framework covers only part of the other.

What are the 7 characteristics of trustworthy AI?

Valid and Reliable, Safe, Secure and Resilient, Accountable and Transparent, Explainable and Interpretable, Privacy-Enhanced, and Fair with Harmful Bias Managed. These characteristics guide the entire framework.

How long does NIST AI RMF implementation take?

Implementation timelines vary by organization size and maturity. A typical phased approach runs 16-24 weeks covering discovery, governance foundation, risk assessment, risk treatment, integration, and operationalization.

How does the NIST AI RMF help with EU AI Act compliance?

The NIST AI RMF's risk assessment, impact analysis, and governance structures align with EU AI Act requirements for high-risk AI systems. Organizations using the NIST framework cover part of EU AI Act obligations, but the frameworks are not equivalent and our mapped EU coverage is partial (8 of 72 subcategories).

NIST AI RMF 1.0 | January 2023 | Voluntary, Outcome-Based

NIST AI Risk Management
Framework Resource Center

Master AI risk management across all four functions. Interactive readiness tools, 72-subcategory reference, implementation tracker, GenAI profile guide, and cross-framework alignment. Everything you need to operationalize the NIST AI RMF.

Take Readiness Test → Explore 72 Subcategories Free Self-Assessment

Functions

The Framework

The NIST AI RMF organizes AI risk management into four core functions: GOVERN, MAP, MEASURE, and MANAGE. GOVERN is cross-cutting and underpins the other three. Click any function to explore its categories and subcategories.

GOVERN is unique among the four functions. It doesn't operate in sequence with the others. It wraps around MAP, MEASURE, and MANAGE, providing the organizational foundation (policies, accountability, culture) that makes the other three functions effective.

Based on NIST AI 100-1, Section 5

NIST AI RMF Functions

The four functions of the NIST AI Risk Management Framework:

GOVERN

Establishes culture, policies, and accountability structures for AI risk management. 6 categories, 19 subcategories. Cross-cutting function.

MAP

Defines context, identifies risks, maps system boundaries and affected parties. 5 categories, 18 subcategories.

MEASURE

Assesses and tracks AI risks through quantitative, qualitative, and mixed methods. 4 categories, 22 subcategories.

MANAGE

Treats, monitors, and communicates risk responses throughout AI lifecycle. 4 categories, 13 subcategories.

Subcategory Reference

All 72 subcategories with plain-English explanations and cross-framework mappings. Filter by function or search by keyword.

NIST AI RMF Subcategories

The framework contains 72 subcategories across 4 functions and 19 categories. Enable JavaScript for the interactive searchable reference.

GenAI Profile

NIST AI 600-1 (July 2024) extends the base AI RMF to address risks specific to generative AI and large language models. It adds GenAI-specific considerations to selected subcategories across all four functions.

NIST AI 600-1: Generative AI Profile

Published July 2024, the GenAI Profile identifies 12 unique risk categories for generative AI systems including CBRN information, confabulation, data privacy, environmental impact, and more.

AI RMF Readiness Test

Answer 8 questions to assess your organization's readiness for NIST AI RMF implementation. Get a personalized score and recommended next steps.

Implementation Tracker

A phased approach to NIST AI RMF implementation with checkable deliverables. Your progress is saved automatically.

0 of 0 deliverables completed (0%)

Document Builder

Track every document your NIST AI RMF implementation needs. Organized by function with priority levels.

Implementation Guide

A phased approach to implementing the NIST AI RMF. Each phase builds on the previous one, creating a sustainable AI risk management program.

Build your NIST AI RMF implementation plan

Answer four questions. You get a tailored, dependency-ordered plan across nine phases, with the real step for your maturity level, a priority status for your situation, and the actual AI-600-1 actions inline if you use generative AI.

1. How would you describe your AI governance maturity?

2. Do you use, deploy, or build on Generative AI or foundation models?

3. Do you build or fine-tune your own models, or only consume third-party and API AI?

4. Do any of your AI systems affect safety, legal rights, or access to services (high-impact)?

Framework Connections

The NIST AI RMF doesn't exist in isolation. Here's how it maps to other major AI governance frameworks. Use these connections to build a unified compliance strategy.

48.6%of NIST AI RMF subcategories map to another framework (35 of 72). Coverage is partial and shown honestly. These alignments are our reading of where the frameworks correspond, drawn from and validated against our Framework Explorer, not official NIST crosswalks.

ISO 42001: 23ISO 27001: 15EU AI Act: 8OWASP LLM Top 10: 4OWASP Agentic: 4MITRE ATLAS: 10

These mappings are drawn from and validated against our AI Governance Framework Explorer, the canonical, audited crosswalk across 7 frameworks. Explore all 7 frameworks and 207 audited mappings →

Resources

Templates, research, regulatory guidance, and related hubs for NIST AI RMF implementation.

Gallery

Contacts

NIST AI RMF Hub: Risk Management Framework 2026

NIST AI Risk Management
Framework Resource Center

The Framework

Subcategory Reference

GenAI Profile

AI RMF Readiness Test

Implementation Tracker

Document Builder

Implementation Guide

Build your NIST AI RMF implementation plan

Framework Connections

Resources

Frequently Asked Questions

Services

Learn

Company

Gallery

Contacts

NIST AI RMF Hub: Risk Management Framework 2026

NIST AI Risk ManagementFramework Resource Center

The Framework

Subcategory Reference

GenAI Profile

AI RMF Readiness Test

Implementation Tracker

Document Builder

Implementation Guide

Build your NIST AI RMF implementation plan

Framework Connections

Resources

Frequently Asked Questions

Services

Learn

Company

NIST AI Risk Management
Framework Resource Center