What it covers. The NIST AI Risk Management Framework, published in 2023, is voluntary guidance for managing risks from AI systems across their lifecycle. It describes characteristics of trustworthy AI, such as validity, safety, security, accountability, transparency, explainability, privacy and fairness, and organises activity into four functions: Govern, Map, Measure and Manage. NIST has also published companion material, including a profile for generative AI.
In practice. Organisations establish governance for AI with clear roles, an inventory of AI systems and policies for acceptable use. Each system's context, intended use and potential harms are mapped, risks are measured through testing and monitoring, and treatment decisions are recorded. Evidence includes AI inventories, risk assessments, evaluation results and incident handling records.
Common gaps. Many organisations lack a complete inventory of AI use, including third party tools. Measurement is often limited to accuracy, with little testing for security, bias or misuse.