NIST AI Risk Management Framework 1.0 (NIST AI 100-1)

Record: data-ai-ml-std-003 — NIST Artificial Intelligence Risk Management Framework 1.0 (AI 100-1)
Issuing body: U.S. National Institute of Standards and Technology (NIST), under the National AI Initiative Act of 2020
Jurisdiction: U.S. federal (voluntary framework with government-wide influence); international uptake
Record type / importance: standard / flagship
Last verified: 2026-09-30

What it is

A voluntary, risk-based framework for managing risks to individuals, organizations, and society associated with AI systems — the closest thing the U.S. has to a national AI governance standard. Unlike the EU AI Act (law) or ISO 42001 (certifiable management system), the AI RMF is a flexible playbook: functions, categories, and subcategories an organization maps onto its own governance. It is widely used as the de facto U.S. enterprise AI-governance baseline and is referenced in federal procurement and agency guidance.

Scope: who/what it applies to, triggers, thresholds

Voluntary for private industry; increasingly expected in federal-adjacent contexts (contractors, agencies implementing AI under OMB memoranda M-24-10 on federal AI use, which requires agencies to adopt AI governance practices consistent with the RMF).
Applies to the full AI lifecycle — design, development, deployment, evaluation, use — for any organization building or operating AI.
No thresholds: organizations profile the framework to their risk level rather than meeting a fixed bar.

Key requirements and compliance obligations

The framework is organized around four functions:

GOVERN: cultivate a culture of risk management — policies, accountability structures, workforce diversity, stakeholder consultation. This is the foundation; NIST is explicit that governance failures underpin most AI incidents.
MAP: establish context — categorize the AI system, its capabilities, intended use, and foreseeable misuses; characterize risks and benefits; map legal/regulatory obligations (this is where EU AI Act classification and GDPR DPIAs plug in).
MEASURE: analyze and monitor risk — test, evaluation, verification, and validation (TEVV) across the lifecycle; bias and fairness evaluation; security and resilience assessment; tracking of deployed-system performance.
MANAGE: allocate risk-response resources — decide to deploy, conditionally deploy with mitigations, or not deploy; establish incident-response and decommissioning plans; monitor third-party AI risk.

Supporting artifacts: AI RMF Playbook (suggested actions per subcategory), crosswalks to ISO/IEC 42001 and the EU AI Act, and risk-management profiles — including the Generative AI Profile (NIST AI 600-1), which tailors the RMF to generative-AI-specific risks (confabulation, data privacy, IP, information integrity, environmental impact).

Penalties and consequences

None directly — voluntary framework. Indirect consequences: federal procurement disadvantage, audit findings against agency AI-use requirements, and in litigation the RMF is increasingly cited as the standard of care for "reasonable" AI governance.

Version/edition status and LIVE changes (verified 2026-09-30)

AI RMF 1.0 (January 2023) remains current. NIST has released supporting profiles and updates (Generative AI Profile AI 600-1, July 2024) but no 2.0 as of Sept 2026.
Live context: the second Trump administration's AI posture (2025–2026) shifted federal emphasis toward AI acceleration and deregulation, but the RMF itself has not been withdrawn and remains the referenced governance baseline in federal AI documents. Practitioners should watch whether OMB's federal AI-use guidance is revised — that, not the framework text, is the moving part.
The RMF ↔ EU AI Act crosswalk is the practical bridge document for U.S. companies serving EU markets: MAP covers AI Act classification, MEASURE/ MANAGE cover Arts. 9/14/15 substance.

The cloud ML/data certs (data-ai-ml-cert-001/006/009/012) test responsible-AI and model-lifecycle content aligned with RMF concepts; CISSP (software-cert-010) covers risk-management frameworks generally. No catalogue certification is RMF-specific.

Honest flags

Federal-policy references (OMB M-24-10) reflect the 2024 posture; the 2025–2026 administration's revisions to federal AI guidance were not fully verified at time of writing — flag any procurement claim tied to current OMB memos for re-verification.

Original ETS reference writing, verified against public sources on 2026-09-30. Thin sourcing is flagged inline. Not legal advice — confirm current editions with the issuing body.

NIST AI Risk Management Framework 1.0 (NIST AI 100-1)