NIST AI Risk Management Framework: the four functions explained
The NIST AI RMF is the most widely cited voluntary framework for managing AI risk. This guide explains what it is, what Govern, Map, Measure and Manage each do, the characteristics of trustworthy AI it lists, and where it fits next to binding laws such as the EU AI Act. It sits in AI law, copyright and safety; for how countries compare see AI regulation by country.
By the Chelure Enterprises Editorial Team. Last reviewed . How we check our sources.
What it is
NIST released AI RMF 1.0 on January 26, 2023 as NIST AI 100-1. The framework is intended for voluntary use and aims to help organizations build trustworthiness into how AI products, services and systems are designed, developed, used and evaluated. NIST also published a companion Playbook on its AI Resource Center. It is not sector-specific and it is not a law.
The four functions
| Function | What it does (NIST) |
|---|---|
| GOVERN | Builds a risk-aware organizational culture and a structure that ties AI risk work to organizational principles and policies. NIST describes it as a cross-cutting function infused through the other three |
| MAP | Establishes the context to frame risks related to an AI system and supports the initial decision on whether to proceed |
| MEASURE | Uses quantitative, qualitative or mixed-method tools to assess, benchmark and track AI risks and their impacts |
| MANAGE | Allocates risk resources to mapped and measured risks on a regular basis, with plans for responding to and recovering from incidents |
Characteristics of trustworthy AI
The framework lists seven characteristics that risk management should weigh against each other:
| # | Characteristic |
|---|---|
| 1 | Valid and reliable |
| 2 | Safe |
| 3 | Secure and resilient |
| 4 | Accountable and transparent |
| 5 | Explainable and interpretable |
| 6 | Privacy-enhanced |
| 7 | Fair, with harmful bias managed |
Profiles and updates
- Generative AI Profile: NIST-AI-600-1, released July 26, 2024, helps organizations identify risks specific to generative AI and suggests risk management actions that fit their goals.
- Critical infrastructure: on April 7, 2026 NIST released a concept note for an AI RMF Profile on Trustworthy AI in Critical Infrastructure.
- Revision: NIST's page states that AI RMF 1.0 is being revised as part of the White House AI Action Plan; it gives no date.
Using it in practice
- Start with Govern: assign owners and policies before you assess individual systems.
- Map each system: record its purpose, users, data and who could be harmed, which is also the starting point for deciding where a system falls under laws such as the EU AI Act's risk levels.
- Measure and manage on a cycle: the functions are repeated, not one-off.
- Keep evidence: documented decisions help whichever law or customer later asks for them.
Frequently asked questions
What is the NIST AI Risk Management Framework?
It is a voluntary framework from the US National Institute of Standards and Technology, released as AI RMF 1.0 (NIST AI 100-1) on January 26, 2023, to help organizations build trustworthiness into how AI products, services and systems are designed, developed, used and evaluated.
What are the four functions?
Govern, Map, Measure and Manage. Govern is a cross-cutting function infused through the other three; Map establishes context to frame risks; Measure assesses, benchmarks and tracks risks; Manage allocates resources to mapped and measured risks and plans responses and recovery.
Is the NIST AI RMF mandatory?
No. NIST describes it as intended for voluntary use. It is not a law, unlike the EU AI Act.
Is there a version for generative AI?
Yes. NIST released NIST-AI-600-1, the Generative Artificial Intelligence Profile, on July 26, 2024, to help organizations identify risks specific to generative AI and suggest actions to manage them.
Is the framework being updated?
NIST's page says AI RMF 1.0 is being revised as part of the White House AI Action Plan, without giving a date, and that on April 7, 2026 NIST released a concept note for an AI RMF Profile on Trustworthy AI in Critical Infrastructure.
How does it relate to the EU AI Act?
They are different instruments: the NIST framework is voluntary risk-management guidance, while the AI Act is binding law with fines. Organizations often use a framework like NIST's to structure their internal risk processes, but following it does not by itself establish compliance with any law.
Sources
- NIST: AI Risk Management Framework
- NIST AI Resource Center: Core (Govern, Map, Measure, Manage)
- NIST AI Resource Center: Characteristics of trustworthy AI systems
- European Commission: AI Act
Primary sources opened on November 13, 2026. Prices come from our verified price table (see the methodology).