NIST AI Risk Management Framework

The AI Risk Management Framework is a NIST publication. Standing is “Published (voluntary).”

NIST’s overview states the framework is intended for voluntary use and to improve the ability to incorporate trustworthiness considerations into design, development, use and evaluation of AI products, services and systems.

Under AI RMF 1.0, organisations structure work across four core functions: Govern (cross-cutting culture, roles and oversight), Map (context and risk identification), Measure (assessment and monitoring of identified risks), and Manage (prioritisation and response). Categories and subcategories under those functions supply the operational taxonomy.

Organisations may adopt that structure without a federal mandate from the framework text itself. Other laws, contracts or sector supervisors may still require RMF-aligned practices. That external mandate is separate from the voluntary character of the NIST publication.

• Voluntary adoption path for trustworthiness risk management.
• Core functions (AI RMF 1.0) · Govern, Map, Measure, Manage.
• Applies across design, development, use and evaluation.
• Later profiles (generative AI, critical infrastructure) specialise the core framework.

The RMF is not a licensing regime and not a substitute for California SB 53 framework-publication duties or EU AI Act legal obligations. It is a measurement and management vocabulary federal and private actors often reference.

The RMF text is voluntary; it does not create a federal licensing duty by itself. Generative-AI and critical-infrastructure profiles are separate NIST publications with specialised guidance that this briefing does not treat as part of the core 1.0 functions.

The following actors are linked to this vehicle in the graph. Their presence here records institutional role on the page, not an independent finding that each actor has completed a compliance duty.

• National Institute of Standards and Technology (standards-body): The federal standards body that develops AI risk-management, measurement and evaluation resources.

Each block below is an explicit evidence row: a claim that points to one supporting passage. Read the quote and locator before treating the paraphrase as settled.

• NIST states the AI RMF is intended for voluntary use. Voluntary status means organisations may adopt the RMF without a federal mandate from the framework itself. Operational note: It separates standards-based risk management from statutory evaluation or licensing duties.

Dated events attached to this vehicle. Each entry is a graph event with its own update page when present.

• 2023-01-26 · publication · NIST releases AI Risk Management Framework 1.0. Release established a federal voluntary reference for organisational AI risk management. Consequence recorded: Created the principal US federal voluntary AI risk-management baseline.

A vehicle is an instrument. Asks are the outcomes the instrument is treated as advancing in the AI Tribune graph.

• Use voluntary AI risk-management frameworks for organisational governance Status: adopted. Adopt voluntary frameworks such as the NIST AI RMF to manage trustworthiness risks without treating the framework text as a statute.

These documents are the originals behind the evidence rows. Prefer the document text over secondary paraphrase when the two diverge.

• NIST AI Risk Management Framework (Voluntary framework, 2023-01-26). NIST page describing the voluntary AI RMF 1.0, Generative AI Profile and later critical-infrastructure concept note.