NIST AI Risk Management Framework (AI RMF)

Technical explanation

AI RMF 1.0 describes trustworthy-AI characteristics and organises risk-management outcomes into four functions: Govern, Map, Measure, and Manage. Govern is cross-cutting; Map establishes context and risks; Measure assesses and tracks them; Manage prioritises and treats them. The framework is supported by a playbook and can be adapted by organisations of different sizes and sectors.

Business relevance

The AI RMF provides a common operating language for product, risk, legal, security, data, and leadership teams. It helps translate high-level responsible-AI commitments into documented outcomes and evidence without prescribing one technology or control set.

Implementation example

A software provider uses Govern to assign accountability, Map to document the deployment context, Measure to evaluate reliability and harmful bias, and Manage to approve controls and residual-risk decisions before launch.

Limitations and common misconceptions

The framework is voluntary and does not confer certification or legal compliance. It must be tailored to context, and completing activities mechanically does not prove that risks are acceptable or controls are effective.

Topics

Sources