What is the NIST AI Risk Management Framework?
The NIST AI Risk Management Framework is a voluntary framework published by the US National Institute of Standards and Technology for identifying and managing risk across an AI system's life cycle. It is organized into four functions: GOVERN, MAP, MEASURE and MANAGE. It is guidance, not regulation, and there is no certification against it.
The four functions
GOVERN is the cross-cutting one. It covers policies, accountability structures, workforce capability and the decision about which risks the organization will not accept. The other three functions are difficult to sustain without it, which is why it is drawn as running alongside them, not before.
MAP establishes context: which systems exist, what they are for, who they affect, and what could go wrong. Most organizations discover here that they cannot list their AI systems, which is a finding, not a delay.
MEASURE evaluates the risks MAP identified, using methods that are recorded so that a result can be attributed to a specific configuration later.
MANAGE is what happens with the answer: prioritizing, responding, monitoring after deployment, and being able to stop a system that has started behaving differently.
Why organizations pick it
It is the lightest of the three common targets to adopt, because it asks for a risk process, not a management system. There is no required documentation set and no audit at the end.
It is widely recognized by US buyers, insurers and public-sector procurement, so pointing at it in a questionnaire tends to be understood without explanation.
It maps reasonably onto ISO/IEC 42001 for an organization that later wants certification, so it is a defensible first target, not a detour.
What it does not give you
No certificate. NIST publishes frameworks and does not certify against them, so there is no such thing as NIST AI RMF certification to hold. What can honestly be said is that an organization has aligned its practices to the framework, and that claim is only as good as the evidence behind it.
No compliance status. The framework is voluntary, so conforming to it does not by itself satisfy any legal obligation. Where a law applies, it applies on its own terms.
No checklist that passes. The framework describes outcomes and leaves the implementation open, which is a strength for adapting it and a weakness if you wanted a list to tick.
Common questions
- Is the NIST AI RMF mandatory?
- No. It is voluntary guidance. Some contracts and some public-sector procurement reference it, which can make it contractually required in a specific deal, but the framework itself imposes no legal obligation.
- Can you be certified against the NIST AI RMF?
- No. NIST publishes frameworks and does not certify against them. Any certificate offered against the AI RMF is a private attestation from whoever issued it, not a recognized certification.
- How does it relate to ISO/IEC 42001?
- They cover much of the same ground and are usually described as complementary. The practical difference is what they produce: the NIST AI RMF produces a risk process you can describe, and ISO/IEC 42001 produces a management system an accredited body can certify.
Find out where you stand
The assessment on this site asks 24 questions against the framework you pick and returns a score, a verdict and, where a control is short, the one thing to fix first. It runs in your browser and takes about ten minutes.
It is a self-assessment, not an audit, not a certification, not a conformity assessment and not legal advice.
Run the assessment