AI Assurance DirectoryTools for NIST AI RMF
Listed tools whose cited public page names this framework. Read the NIST AI RMF explainer first. Related reading is on the articles index.
-
AI Verify Testing Framework
Testing framework of 11 internationally recognised AI governance principles for Traditional and Generative AI. Mapped to NIST AI RMF (13 Oct 2023), NIST AI 600-1 (29 May 2025) and ISO/IEC 42001 (21 July 2025). IMDA/PDPC MVP 25 May 2022; GitHub 7 June 2023.
-
Arthur (Agent Security & Governance)
Discovers agents across endpoints, cloud and private data centers; traces tool calls; enforces policies and guardrails. Official page names fully hosted SaaS, on-prem, or hybrid. An Arthur column maps product evidence to ISO 42001, the EU AI Act and NIST AI RMF.
-
Asenion AI Control System
Asenion AI Control System turns EU AI Act, ISO/IEC 42001 and NIST AI RMF requirements into Assess, Verify and Witness controls with audit-grade evidence. Asenion is ISO/IEC 42001 certified for the Control System. A homepage quote names the former Fairly brand.
-
CDAO Test and Evaluation of Artificial Intelligence Models Framework
April 2024 public CDAO primer on what to consider in a T&E strategy for AI models in a Defense context. Four focus areas, a performance iceberg beyond correctness, and named links to the DoD Ethical AI Principles and NIST AI RMF. Explicitly not binding policy.
-
Cisco AI Defense
Cisco AI Defense: algorithmic red teaming across 200+ threat subcategories, AI Runtime Protection guardrails, and network-layer enforcement across cloud, VPC and on-premises AI POD. Datasheet maps findings to NIST AI-RMF.
-
Collibra AI Command Center
Collibra AI Command Center (evolved from AI Governance; docs dated 7 October 2026): unified registry for AI agents, models and use cases, AI Trust Score, guardian agents and agent contracts. Out-of-the-box EU AI Act, NIST AI RMF and AI UC-1 assessment templates.
-
Credo AI
Enterprise AI governance with GAIA assistant, Agent Registry, 300+ integrations and ready-to-deploy policy packs for the EU AI Act, NIST AI RMF and ISO 42001. Named sectors: insurance, financial services, federal and healthcare.
-
CycloneDX (AI/ML-BOM)
OWASP/Ecma TC54 BOM standard (CycloneDX 1.7, released 21 October 2025) published as ECMA-424 2nd edition (10 December 2025). Homepage names 260+ tools, the defense industrial base, satellite and space systems, and medical-device HBOM/SBOM. The ML-BOM guide names the EU AI Act and NIST AI RMF.
-
Giskard
LLM-agent testing (Python SDK and Hub UI), red-teaming and runtime Guards with an EU AI Act Policy Pack (OPA/Rego). On-premise Hub for public-sector and defense workloads. Named sectors: banking and insurance.
-
HiddenLayer AI Security Platform
AI security platform with government and defense pages: NIST AI RMF alignment, contractor and open-source model scanning, real-time monitoring, and air-gapped options for classified disconnected environments. The homepage also names AI Discovery, supply-chain, attack simulation and runtime security.
-
Holistic AI
Identify, Protect and Enforce platform: shadow-AI discovery, agentic red-teaming and framework assessments for the EU AI Act, NIST AI RMF and ISO 42001. Guardian Agents (Sentinel watch/detect; Operative act/enforce) via the HAI Guardian SDK. 15+ read-only integrations.
-
Hyperproof (ISO 42001)
Compliance operations platform with an out-of-the-box ISO 42001 AIMS template (Annex A) in a 160+ framework library. Guide covers Clauses 4–10, Annexes A–D and AI risk vs impact assessments. Crosswalks name NIST AI RMF. Audit Module for inviting the auditor.
-
IBM watsonx.governance
IBM AI governance product: enterprise inventory, shadow-AI detection, policy enforcement, and Compliance Accelerators that name the EU AI Act, ISO/IEC 42001 and NIST AI RMF. Sold for cloud and on-prem. Infosys 2,700+ use cases; US Open court-fairness case.
-
ModelOp
Enterprise AI Command Center (Center 3.3) that maps each use case to the EU AI Act, NIST AI RMF and ISO 42001, orchestrates reviews, generates model cards, and adds inline agent prompt-injection blocking. MADE integrates 50+ technologies.
-
Monitaur
AI governance for inventory, a 33-control library, FlightSim pre-deployment simulation (vendor: AI pen test) and Automate Record production logging mapped to NIST AI RMF, ISO 42001 and the EU AI Act.
-
NASA SWEHB Artificial Intelligence topics (7.25 and 8.25)
NASA SWEHB AI/ML topics under NPR 7150.2. Official titles: 7.25 - Artificial Intelligence And Software Engineering and 8.25 - Artificial Intelligence And Software Assurance. Topic 7.25 names OCE, OSMA, OCHMO and OCIO and keeps AI non-safety-critical without an approved AI safety case.
-
NIST AI RMF Playbook
NIST AI RMF Playbook of suggested actions aligned to Govern, Map, Measure and Manage sub-categories in AI RMF 1.0. Neither a checklist nor a set of steps. Suggestions are voluntary. Downloadable as PDF, CSV, Excel and JSON. The Playbook will be updated after AI RMF 1.0 is revised.
-
NIST ARIA (Assessing Risks and Impacts of AI)
NIST ITL evaluation (Assessing Risks and Impacts of AI): sector- and task-agnostic model testing, red-teaming and field testing. LLM pilot. Schedule Kickoff May 2024 through Summer 2025 Pilot Summary Report Out. That report is still listed as coming soon.
-
NIST Dioptra
NIST test platform (docs and release 1.2.1) for assessing trustworthy characteristics of AI models. The official README says it supports the Measure function of the NIST AI RMF. Docker images for nginx, MLflow, REST API and CPU workers. Public source under CC BY 4.0.
-
OneTrust AI Governance
AI governance that inventories systems, agents, models, datasets and vendors; applies EU AI Act, NIST AI RMF and ISO 42001 templates; and describes runtime guardrails plus a Python AI Guard SDK on Amazon Bedrock, Microsoft Foundry, Databricks and Gemini.
-
Optro AI Governance
Enterprise AI governance that inventories models, agents and third-party apps and automates 25+ frameworks including the EU AI Act, ISO 42001 and NIST AI RMF. Shadow AI; agents draft and recommend, the team decides. fairnow.ai currently serves this product.
-
Promptfoo
Open-source gen-AI red-teaming tool that scans 50+ vulnerability types and maps plugins to the NIST AI RMF, ISO/IEC 42001 and EU AI Act. Runs locally against HTTP APIs, browsers or models. MIT-licensed.
-
Saidot
Graph-based AI governance platform: 260+ risks, 620+ controls, 110+ policies and 170+ third-party models. Product page: meet 110+ policies including ISO/IEC 42001 and NIST AI RMF, plus the EU AI Act workflow. Homepage names Azure Marketplace; ISO 27001 is the vendor ISMS.
-
ServiceNow AI Control Tower
ServiceNow AI Control Tower inventories agents, models, copilots, MCP servers and datasets against the CMDB. Out-of-the-box content packs named for the EU AI Act and NIST AI RMF. Built on the ServiceNow AI Platform. Not an airborne runtime.
-
Trustible
AI governance platform for regulated enterprises: intake, inventory, risk triaging and continuous monitoring. Maps controls to the EU AI Act, NIST AI RMF and ISO 42001. Official 10 April 2026 Leidos story covers defense, intelligence, civil and health programs.
-
Vanta
Compliance automation covering ISO 42001, NIST AI RMF and CMMC (mapped to NIST SP 800-171/172). The ISO 42001 product page also maps evidence to the EU AI Act. Not an AI-model assurance tool.
Official documents and working-group pages
These are the primary public pages we cite for NIST AI RMF. They are not directory listings and are not endorsements.
- Artificial Intelligence Risk Management Framework (AI RMF 1.0), NIST AI 100-1 - NIST
- AI RMF Core (excerpt from AI RMF 1.0) - NIST AI Resource Center
- Crosswalks to the NIST AI RMF - NIST
- AI RMF: Generative Artificial Intelligence Profile (NIST AI 600-1) - NIST
- NIST AI RMF to ISO/IEC FDIS 42001 crosswalk - NIST AI Resource Center
- Crosswalk Documents (NIST AI Resource Center) - NIST AI Resource Center
- CDAO Releases Responsible AI (RAI) Toolkit - Department of War
Related articles
- MITRE ATLAS for AI red teaming: tactics, techniques, mitigations and case studies
- NIST AI RMF Playbook: Measure and Manage suggested actions for safety-critical AI
- NIST Cyber AI Profile (IR 8596): what the preliminary draft covers and how far to rely on it
- NIST SP 800-53 control overlays for securing AI systems (COSAiS): the five use cases and what is still draft
- OWASP Top 10 for LLM and Gen AI apps (2025): questions to put to a vendor
- CDAO RAI Toolkit versus Tradewinds AIA Toolkit
- Choosing AI red-teaming tools for safety-critical programs
- ISO/IEC 42001 and NIST AI 100-1: the two source documents behind the crosswalk
- ISO 42001 vs NIST AI RMF for defense contractors
- NIST AI 100-2 adversarial ML terms for defense T&E
- NIST SP 800-218A SSDF for generative AI in defense software
- Turning the ISO/IEC 42001 to NIST AI RMF crosswalk into supplier evidence requests
- An AI assurance glossary for aerospace and defense
- An AI audit evidence checklist for regulated programs
- AI red-teaming requirements for defense programs
- Army, Navy and Air Force AI policies that name acquisition
- CDAO test and evaluation of Artificial Intelligence models
- Data provenance and supply-chain security for ML models (SBOM/AIBOM)
- DoD RAI Toolkit vs NIST AI RMF: what each one is for
- ISO/IEC 42001 vs NIST AI RMF: a practical crosswalk
- Model cards and system cards for defense AI documentation
- NIST AI 600-1 (Generative AI Profile) for defense contractors
- NIST AI 600-1 suggested actions for generative AI on a defense program
- Which NIST SP 800-171 controls matter most when AI tools handle CUI?
Questions
Why are there so few commercial tools tagged for NIST AI RMF?
We only tag a tool when the cited public page names this framework (or, for SAE G-34, EUROCAE WG-114, ED-324 or ARP6983). We do not infer support from a related aviation standard.
Where are the official NIST AI RMF documents?
The official documents and working-group pages are listed on this page and on the NIST AI RMF explainer.