The NIST AI Risk Management Framework (AI RMF) is a voluntary framework from the US National Institute of Standards and Technology for managing the risks of AI systems. It was published as version 1.0 in January 2023 and is organised around four functions: Govern, Map, Measure and Manage. Although it is American, organisations worldwide, including in the UK, use it as a practical structure for AI risk management alongside regulation such as the EU AI Act and standards such as ISO/IEC 23894.
Why leaders should care
AI introduces risks traditional risk frameworks were not designed for: confident errors, bias, opaque decisions, data leakage and systems that change behaviour over time. The NIST AI RMF gives a shared language for these risks, so leaders, risk teams and technical teams can discuss them consistently.
The four functions in plain English
Govern
Set up the culture, policies, roles and accountability for AI risk. Who decides which AI uses are acceptable? Who owns each system? This function runs across all the others.
Map
Understand the context of each AI system: what it is for, who it affects, what could go wrong and where it sits in your processes.
Measure
Assess and track the risks you mapped, using appropriate methods, from testing accuracy and bias to monitoring performance over time.
Manage
Prioritise and act on the risks: put controls in place, decide what to accept, transfer or avoid, and respond when things go wrong.
Trustworthy AI characteristics
The framework describes characteristics of trustworthy AI that organisations should aim for:
- Valid and reliable
- Safe
- Secure and resilient
- Accountable and transparent
- Explainable and interpretable
- Privacy-enhanced
- Fair, with harmful bias managed
These make a useful checklist when reviewing any AI use case.
Generative AI and the NIST framework
NIST has also published a Generative AI Profile that applies the framework to risks specific to generative AI, such as confabulation (confident but false outputs), data privacy and information integrity. If your organisation mainly uses AI assistants, it is a helpful companion.
How the NIST AI RMF relates to other frameworks
| Framework | What it is | How it fits |
|---|---|---|
| NIST AI RMF | Voluntary US risk framework | Practical structure for AI risk activities |
| ISO/IEC 23894 | International guidance on AI risk management | Aligns AI risk with established risk management practice |
| ISO/IEC 42001 | International AI management system standard | Certifiable management system for AI governance |
| EU AI Act | EU regulation | Legal obligations based on risk level, relevant to UK firms operating in the EU |
They complement rather than compete. Many organisations use NIST or ISO guidance to structure the work that regulation requires.
How to start using it
- Inventory your AI uses, including informal ones.
- Assign owners for each system and an overall AI risk lead.
- Map the highest-impact uses first: customer-facing, people decisions, regulated processes.
- Assess risks against the trustworthy characteristics.
- Put proportionate controls in place and monitor them.
Our step-by-step AI risk assessment guide turns these steps into a practical exercise.
Building AI risk capability
Our AI Risk Management & Security course teaches the core practice these frameworks share: categorising AI risks, assessing them, building a risk register, setting policy and security controls, incident response and regulatory alignment including the EU AI Act. It is non-technical and suits leaders, risk and compliance professionals. For governance and data ethics, see Data Strategy, Governance & Ethics for AI Professionals.
Frequently asked questions
Is the NIST AI RMF mandatory?
No. It is voluntary guidance. Organisations adopt it because it offers a practical, widely recognised structure.
Can UK organisations use the NIST AI RMF?
Yes. It is used internationally and fits well alongside UK principles, the EU AI Act for firms operating in the EU, and ISO standards.
Do I need technical knowledge to apply it?
Not for governance and oversight. Technical teams support the measurement work, but leaders own the decisions about acceptable risk.