NIST AI Risk Management Framework (AI RMF 1.0)

What it is

The AI RMF was released in January 2023 and is intended for voluntary use. NIST describes it as voluntary, rights-preserving, non-sector specific, and use-case agnostic. The downloadable text is Artificial Intelligence Risk Management Framework (AI RMF 1.0), NIST AI 100-1.

Those four adjectives are the engineering constraint: a defense or aerospace program can use the AI RMF; NIST does not, on the pages we cite, make it a contract clause, a CMMC overlay, or an aviation means of compliance. The DoD Responsible AI Toolkit is separately built upon the NIST AI Risk Management Framework and Toolkit, among other sources — that is CDAO’s statement about the toolkit, not a NIST mandate.

The four functions

The Core is composed of four functions: Govern, Map, Measure and Manage. Each function is broken into categories and subcategories.

• Govern is a cross-cutting function infused throughout the other three.
• Map establishes the context to frame risks related to an AI system.
• Measure employs quantitative, qualitative, or mixed-method tools, techniques, and methodologies to analyze, assess, benchmark, and monitor AI risk.
• Manage entails allocating risk resources to mapped and measured risks, including plans to respond to, recover from and communicate about incidents.

NIST is explicit that the actions do not constitute a checklist, nor are they necessarily an ordered set of steps. Govern remains a cross-cutting function infused throughout the other three, so a program that only fills Map/Measure/Manage worksheets is not following the Core as NIST describes it.

ISO’s AI risk-management guidance document is ISO/IEC 23894. We have not found an official NIST crosswalk from the AI RMF to 23894. For how 23894 sits next to the SC 42 life-cycle process standard, see ISO/IEC 23894 and 5338 for engineering teams.

Profiles

NIST published the Generative AI Profile (NIST AI 600-1) on July 26, 2024. It is a cross-sectoral profile, meaning an implementation of the AI RMF functions for a specific technology. See NIST AI 600-1 for defense contractors and NIST AI 600-1 suggested actions for generative AI on a defense program.

Relationship to other frameworks

• NIST publishes crosswalks to the AI RMF, including a mapping to ISO/IEC 42001. NIST states that inclusion of a crosswalk does not imply NIST endorsement of the resource the AI RMF is mapped to. See the ISO 42001 page and ISO 42001 vs NIST AI RMF for defense contractors. ISO’s AI risk-management guidance document is ISO/IEC 23894. We have not found an official NIST crosswalk to 23894 on the pages we cite.
• The DoD Responsible AI Toolkit is built upon the NIST AI Risk Management Framework and Toolkit, among other sources. See DoD Responsible AI.
• NIST AI RMF is a risk-management framework. It does not define an aviation certification process; for that, see the FAA roadmap and EASA concept paper.

Primary sources

AI RMF 1.0 (NIST AI 100-1) is free to download from NIST.