What Is the NIST AI RMF? A Practical Guide to Govern, Map, Measure, and Manage 

Artificial Intelligence (AI) is moving into organizations faster than many governance programs can adapt.  

Employees may use generative AI assistants to summarize documents, marketing teams may experiment with AI-generated content, HR may evaluate an AI-enabled recruiting tool, and developers may integrate AI into customer-facing applications. Each use case may offer legitimate business value, but each one also raises questions around privacy, security, accuracy, bias, transparency, accountability, and regulatory compliance.  

The challenge for most organizations is not whether AI should be used, it is determining how to use AI responsibly while managing the associated risks. This is where the National Institute of Standards and Technology (NIST) Artificial Intelligence Risk Management Framework (AI RMF) can help. 

What Is the NIST AI RMF? 

The NIST AI RMF 1.0 is a voluntary framework released in January 2023. It helps organizations identify, assess, and manage AI-related risks while incorporating responsible AI practices and “trustworthiness considerations” into the design, development, use, and evaluation of AI products, services, and systems.  

As AI becomes more integrated into everyday workflows and decision-making, understanding what makes an AI system trustworthy and how to mitigate its risks becomes increasingly critical.  

Important Update: While AI RMF 1.0 remains the current published version of the framework, NIST is in the process of revising it. Organizations implementing AI governance today can continue using AI RMF 1.0 while monitoring NIST for future updates, profiles, and implementation guidance.  

What Does NIST Mean by Trustworthy AI? 

According to NIST, trustworthy AI demonstrates characteristics such as: 

• Valid and reliable

• Safe

• Secure and resilient 

• Accountable and transparent 

• Explainable and interpretable 

• Privacy-enhanced

• Fair, with harmful bias managed 

These characteristics provide a practical foundation for evaluating whether an AI system is appropriate for its intended purpose. 

A Practical Starting Point: Inventory Before Frameworks 

A common mistake when adopting the AI RMF is starting with every category and subcategory before understanding how AI is actually being used across the organization.  

A more practical starting point is to develop an AI inventory by asking:  

• Are employees using public generative AI tools?  

• Are teams purchasing or developing technology with AI capabilities?  

• Are developers building AI-enabled solutions? 

• Does AI process personal, confidential, or proprietary information?  

• Are AI outputs influencing important business or individual decisions?  

The inventory should capture what each AI system does, why it is used, who owns it, what data it processes, and who or what may be affected. This allows organizations to apply the AI RMF based on actual use cases and risk instead of theoretical scenarios. 

How Does the NIST AI RMF Work? 

The AI RMF is not a mandatory law or a one-size-fits all checklist. Instead, it provides a flexible structure organizations can use to translate AI risk principles into practical governance and risk-management activities based on their business needs, risk profile, goals, and maturity. 

Organizations can use the AI RMF to:  

• Establish AI governance and accountability 

• Evaluate proposed AI use cases 

• Assess existing AI systems 

• Review third-party AI vendors  

• Implement controls aligned to risk 

• Support consistent risk-management decisions  

At the center of the framework are four core functions: Govern, Map, Measure, and Manage. Govern establishes the foundation, while Map, Measure, and Manage help organizations understand context, evaluate risks, and act on results. These functions work together to provide a structure for managing AI risk over time.  

Rather than viewing them as four one-time steps, organizations can apply and revisit them as AI systems, use cases, risks, and business requirements evolve.   

The Four Functions of NIST AI RMF 

1) Govern: Verify Who is Accountable  

Purpose: To determine the policies, processes, roles, and practices that support AI risk management across the organization. 

Govern sets accountability and enterprise oversight. Before an organization can effectively assess or manage AI risk, it needs to confirm who is responsible for AI-related decisions, what rules apply, and how different functions should work together.  

Govern considers:  

• Who owns AI risk and has decision-making authority?   

• What policies, processes, and controls apply to AI systems and use cases? 

• Which AI use cases require additional review or escalation? 

• How should legal and regulatory requirements be understood, managed, and documented?  

• What training and resources do employees need to use and manage AI reasonably?  

What this looks like in practice: An AI governance policy, defined roles and responsibilities, approval and escalation criteria, employee guidance and training, and a process for reviewing higher-risk AI use cases. 

AI risk cannot effectively be owned by one department. Privacy may assess personal data use, Security may evaluate resilience, Legal and Compliance may address regulatory obligations, Technology may assess technical risks, and Business Owners remain accountable for intended use. Govern promotes consistent AI risk decisions rather than evaluating each system in isolation.  

2) Map: Understand the AI Use Case and Its Context  

Purpose: Understand how the AI system will be used, who or what it may affect, and the risks, benefits, and limitations associated with its use.  

The same AI technology can present very different risks depending on its purpose, the date involved, the people affected, and how much the organization relies on its output.  

Map highlights the key factors that may influence an AI system by considering:  

• What goals and objectives does the entity expect to achieve by designing, developing, and/or deploying the AI system?  

• Who are the specific types of users and affected individuals or groups? 

• What data does the system use, including personal or sensitive information?  

• What potential benefits, risks, and impacts could result? 

• What legal, regulatory, contractual, or business requirements apply?   

What this looks like in practice: An AI inventory, use-case intake questionnaire, data and stakeholder identification, preliminary risk classification, and documentation of intended use and limitations. 

Map is often where hidden exposure becomes visible. The information gathered forms a factual basis for defining the AI system and its associated risks, giving organizations the clarity they need to determine how to measure and manage them. As an AI system’s context shifts, NIST recommends that Framework users continue applying the Map function to account for changes in capabilities, risks, benefits, and potential impacts.  

3) Measure: Evaluate What Actually Matters  

Purpose: Assess and monitor AI performance, trustworthiness, and risks using appropriate quantitative and qualitative methods.  

Measure turns the risks identified during Map into something the organization can evaluate. Rather than applying the same testing requirement to every AI system, organizations should align the level of testing with the nature and potential impact of the use case.   

Measure verifies whether AI systems meet their intended goals and expectations by considering: 

• What risks and characteristics need to be evaluated?  

• What metrics and methods best assess performance, trustworthiness, and risk? 

• What testing has been conducted to identify errors, limitations, bias, privacy, security, reliability, and other relevant risks? 

• How frequently should performance and risk be monitored?   

• How will findings be documented and applied in ongoing risk decisions? 

What this looks like in practice: Defined testing criteria, risk and performance metrics, documented test results, human oversight requirements, ongoing monitoring, and thresholds for additional review. 

The practical question is: What would failure look like, and how would we know it was happening? A low-risk productivity tool may require limited testing, while an AI system influencing employment or customer decisions may require significantly more rigorous evaluation.  

4) Manage: Turn Findings into Action  

Purpose: Prioritize identified AI risks and determine the actions needed to address, monitor, or escalate them.  

Manage turns assessment findings into decisions and controls. Identifying a risk is only useful if the organization decides how to respond, who is responsible, and how the response will be monitored.   

Manage essentially ensures risk management is continuous, adaptive, and responsive to organizational goals by considering: 

• Which risks should be prioritized, and why? 

• Should a risk be accepted, mitigated, transferred, avoided, or escalated? 

• What controls or remediation actions are required? 

• Who is responsible for implementing the response? 

• How will the organization determine whether those actions remain effective? 

What this looks like in practice: Assigned risk owners, remediation plans, approval conditions, monitoring requirements, escalation triggers, and periodic reassessments. 

Depending on the risk, an organization may require additional testing, human review, data restrictions, vendor safeguards, enhanced monitoring, or changes to how the AI system is used. In some cases, the appropriate decision may be to delay or not approve the use case.  

Conclusion 

Ultimately, the NIST AI RMF is most valuable when viewed as a business governance framework rather than a one-time assessment or compliance exercise.  

Organizations do not need to implement every category and subcategory before seeing results. A more practical approach is to identify where AI is being used, understand which use cases present greater risk, assign accountability, and create a consistent process for oversight and decision-making. The framework’s four functions of Govern, Map, Measure, and Manage provide a practical structure for accomplishing this.  

As AI adoption accelerates and regulatory expectations continue to develop, organizations that build these capabilities will now be better positioned to manage risk, demonstrate responsible AI practices, and scale AI confidently across the enterprise. 

FAQ Review