Guidance, practices and programmes
NIST AI Risk Management Framework
A voluntary framework for managing the risks of AI systems: Govern, Map, Measure and Manage.
Official source Published by US National Institute of Standards and Technology. US government work in the public domain.
What it is
The NIST AI Risk Management Framework is voluntary guidance for managing risks to people, organisations and society from AI systems throughout their lifecycle. It exists to help organisations build trustworthy AI and to give a shared vocabulary for AI risk.
Who it applies to
- Organisations that develop, buy or deploy AI systems, including generative AI
- AI governance, risk and compliance functions
- Organisations preparing for EU AI Act obligations that want a practical risk management structure
- Public sector bodies and suppliers where AI risk management is expected in procurement
- Status
- A voluntary framework. Version 1.0 (NIST AI 100-1) was published in January 2023, with a companion Playbook and a Generative AI Profile (NIST AI 600-1) published in 2024.
- Enforcement
- Voluntary, with no certification or enforcement. In Europe the binding requirements come from the EU AI Act; the AI RMF can help structure that work, and ISO/IEC 42001 provides a certifiable option.
Key points
- Govern applies across the lifecycle and sets culture, roles, policies and accountability
- Map establishes the context and identifies risks for a specific AI system
- Measure assesses and tracks those risks with qualitative and quantitative methods
- Manage prioritises and treats risks, including decisions not to deploy
- Trustworthy AI characteristics include validity and reliability, safety, security and resilience, accountability and transparency, explainability, privacy and fairness
- The Generative AI Profile lists risks specific to generative models, such as confabulation and information integrity
Where to start
- 1Inventory AI systems in use and in development, including third party tools
- 2Assign accountability for AI risk and set a policy (Govern)
- 3Run Map and Measure on the highest risk use case first
- 4Map the results to EU AI Act obligations where they apply
How it is structured
| Part 1 | Framing AI risk and the characteristics of trustworthy AI |
|---|---|
| Part 2: Core | Four functions: Govern, Map, Measure and Manage |
| Playbook | Suggested actions and references for each subcategory |
| Profiles | Use case and technology specific profiles, such as the Generative AI Profile |
A plain-language overview to help you learn, written by ThreatNoir. The official source prevails; this is not legal advice.
Items explained (1)
Ordered by how often our lessons cite them.