NIST's AI risk management framework, explained in plain English

Sooner or later someone asks how you manage the risks of the AI you've put into your business. It might be a customer's security questionnaire, an insurer, or your own board. The NIST AI Risk Management Framework is the document people most often point to, and it has a reputation for being long, abstract and written for large organisations. It's more usable than that reputation suggests, once you see how it's put together.

Here's what the framework is, what it asks you to do, and how a small team can get value from it in a few days rather than a few months.

What the framework is, and what it isn't#

The AI RMF 1.0 was published by the US National Institute of Standards and Technology in January 2023. It describes itself as "intended to be voluntary, rights-preserving, non-sector-specific, and use-case agnostic." That last part matters. It doesn't care whether your AI is a fraud model, a chatbot or an invoice classifier. It gives you a way of thinking about risk that you apply to your own situation.

It isn't a law, and there's no NIST certificate to earn. You use it as a structure for your own risk work. It's also American, but nothing in it is tied to US law, so teams in Australia, the UK or anywhere else can use it as a structure and plug their own legal obligations into it.

The framework is also not frozen. As of October 2026, NIST's AI RMF page says version 1.0 "is being revised as part of the White House AI Action Plan." The July 2025 Action Plan tells NIST to "revise the NIST AI Risk Management Framework to eliminate references to misinformation", and also to remove references to diversity, equity and inclusion and to climate change. No revised version had been published when we checked, so this article describes 1.0. The core structure below is the part least likely to change.

What NIST means by trustworthy AI#

The framework defines what it's trying to protect before it tells you how. It lists seven characteristics of trustworthy AI:

• valid and reliable
• safe
• secure and resilient
• accountable and transparent
• explainable and interpretable
• privacy-enhanced
• fair with harmful bias managed

The useful idea here is that these pull against each other. The framework says that "a comprehensive approach to risk management calls for balancing tradeoffs among the trustworthy characteristics." A more interpretable model can be less accurate. Stripping personal data out of training sets can make a model worse for the people whose data was removed. You won't max out all seven, and the framework doesn't expect you to. It expects you to know which ones matter most for each system and to make the trade-off on purpose.

The four functions and what each one asks for#

The working part of the framework is four functions, each broken into categories and more specific subcategories. In plain terms:

Govern is about who's responsible and how decisions get made. NIST calls it "a cross-cutting function that is infused throughout AI risk management", meaning it isn't a step you finish. It covers policies, roles, training and culture. Two subcategories give the flavour: GOVERN 1.6 asks for "mechanisms… to inventory AI systems", and GOVERN 6.1 asks for policies that address risks from third parties, which for most businesses means the AI vendors and models they buy in.

Map is about understanding the context of a specific system. What is it for? Who uses it, who's affected by it, and what laws and expectations apply? MAP 1.1 starts with intended purposes, beneficial uses and "context-specific laws, norms and expectations". MAP 3.5 asks you to define and document how human oversight works. The framework describes Map as establishing "the context to frame risks related to an AI system", and everything else depends on getting this right.

Measure is about evidence. NIST describes it as using quantitative, qualitative or mixed methods to "analyze, assess, benchmark, and monitor AI risk and related impacts." That includes testing accuracy, but also testing whether a system fails safely when pushed outside what it knows (MEASURE 2.6). The framework is candid that lab results only go so far: measurements taken in a controlled environment "may differ from risks that emerge in operational, real-world settings."

Manage is about acting on what you found. You prioritise risks, decide how to respond, and plan for incidents. MANAGE 2.4 asks for mechanisms "to supersede, disengage, or deactivate AI systems that demonstrate performance or outcomes inconsistent with intended use". In other words, an off switch that someone is responsible for using. MANAGE 3.1 asks you to keep monitoring the risks of third-party resources, and MANAGE 4.1 asks for post-deployment monitoring plans.

The order isn't fixed. The framework says that, assuming governance is in place, "functions may be performed in any order across the AI lifecycle", and it expects you to loop back as you learn more.

Things the framework deliberately leaves to you#

Two omissions catch people out.

First, it won't tell you how much risk is acceptable. In NIST's words, "while the AI RMF can be used to prioritize risk, it does not prescribe risk tolerance." That's set by you, your sector or your regulator. Where nobody else has set it, the framework says organisations "should define reasonable risk tolerance." So a large part of the real work is writing down, for each system, what level of error or harm you'll accept and who signed off on it.

Second, it isn't a checklist. The framework says its actions "do not constitute a checklist, nor are they necessarily an ordered set of steps." The AI RMF Playbook, which suggests concrete actions for each subcategory, says the same about itself and encourages organisations to borrow "as many – or as few – suggestions as apply." If someone hands you a spreadsheet of every subcategory and asks you to tick them all, they've misread the document.

Profiles, and the one for generative AI#

The framework introduces profiles, which are its functions applied to a particular setting. A Current Profile describes how you manage AI risk today and a Target Profile describes where you want to be. The gap between them is your to-do list. NIST doesn't prescribe a template, so a two-column table is a perfectly good start.

NIST has published one profile that matters to almost anyone using LLMs: the Generative AI Profile (NIST AI 600-1), released in July 2024. It names 12 risks that are unique to or made worse by generative AI. They include confabulation (what most people call hallucination, defined as "confidently stated but erroneous or false content"), data privacy, information security, intellectual property, human-AI configuration, and value chain and component integration. The information security section explicitly covers attacks on the AI system itself, such as prompt injection and data poisoning.

The profile's suggested actions are keyed to the main framework's subcategories, with IDs like GV-1.1-001 for the first action under GOVERN 1.1. That makes it easy to use the two documents together. Read the 12 risks, pick the ones that apply to your systems, then look up the actions listed against them.

A lightweight way for a small team to start#

You don't need a governance department to get value from this. Here's a version that fits a business with a handful of AI tools and no compliance team.

1. Make an inventory (GOVERN 1.6). List every AI system you build or buy, including the chatbot plugin someone added to the website and the AI features in your accounting software. Note the owner, what data it touches and what decisions it influences.
2. Map the two or three that matter most. For each one, write half a page: purpose, users, people affected, data used, applicable laws, and what a bad outcome looks like. In Australia, that would include your obligations under the Privacy Act if personal information is involved.
3. Write down your risk tolerance. For example: "the invoice classifier can mis-code up to N in 100 low-value invoices, but anything over $X goes to a person." The specific numbers are yours. What matters is that they exist and someone owns them.
4. Measure against that tolerance. Build a small test set from real cases, run it before launch and after every model or prompt change, and keep the results.
5. Name the off switch (MANAGE 2.4). Who can turn the system off, how, and what's the manual fallback?
6. Check your vendors (GOVERN 6.1 and MANAGE 3.1). Know which model provider sits behind each tool, what they do with your data, and how you'd hear about a change.
7. Use the Generative AI Profile's list of 12 risks as a prompt for anything LLM-based, and record which risks you've decided don't apply and why.

That's a Current Profile in all but name. Repeat the exercise every six months or whenever you add a significant system, and you have the start of a Target Profile too. It's also roughly how we start AI governance work at TheAILAB: inventory first, then written tolerances, because both are cheap and everything else builds on them.

Where it fits with other obligations#

Because the framework is voluntary and not tied to any jurisdiction, it works best as a frame you hang other requirements on. Privacy law tells you what you must do with personal information. Your contracts tell you what you've promised customers. Sector rules, if you have them, add more. The AI RMF gives you a consistent way to record how each AI system meets all of that, and its vocabulary (Govern, Map, Measure, Manage) is widely recognised, so it reads well in a security questionnaire or a board paper.

Keep an eye on NIST's page for the revised version. When it lands, the Playbook page says the Playbook "will be updated after the AI RMF is revised." If you've built your inventory, context notes and tolerances around the four functions, adapting to a new version should mean editing a few documents rather than starting again.

Sources

1. Artificial Intelligence Risk Management Framework (AI RMF 1.0), NIST AI 100-1 — National Institute of Standards and Technology (January 2023) (checked 2026-10-13)
2. AI Risk Management Framework — National Institute of Standards and Technology (checked 2026-10-13)
3. Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile, NIST AI 600-1 — National Institute of Standards and Technology (July 2024) (checked 2026-10-13)
4. NIST AI RMF Playbook — NIST Trustworthy and Responsible AI Resource Center (checked 2026-10-13)
5. Winning the Race: America's AI Action Plan — The White House (July 2025) (checked 2026-10-13)