Implementation walkthrough
How to implement NIST AI RMF: video walkthrough
A walkthrough of applying the NIST AI RMF to the AI an organisation develops, deploys, procures or uses.
Key takeaways
- The NIST AI RMF is voluntary; there is no NIST AI RMF certification.
- Four functions: Govern, Map, Measure and Manage.
- Govern is cross-cutting and enables the other functions.
- Current and Target Profiles tailor outcomes to the organisation.
- ISO/IEC 42001 is the certifiable AI management system standard.
Voluntary guidance for managing AI risk
The NIST AI Risk Management Framework, AI RMF 1.0, is voluntary guidance from the US National Institute of Standards and Technology for managing the risks that AI systems pose to individuals, organisations and society. It was developed through an open, consensus-driven process to be rights-preserving, non-sector-specific and use-case agnostic. The first part explains how AI risk arises and names seven characteristics that make AI trustworthy; Part 2 holds the Core, four functions, Govern, Map, Measure and Manage, divided into categories and subcategories of outcomes, and Profiles that adapt those outcomes to a particular use case, sector or moment.
NIST does not certify against it, and no NIST AI RMF certified status exists; ISO/IEC 42001 is the certifiable AI management system standard. This short film walks through how the framework is applied.
From inventory to Profiles and practice
Scope the programme and inventory the AI: the systems the organisation develops, deploys, procures or operates, including AI built by others, and who is accountable for each. A Current Profile records the outcomes achieved today, and a Target Profile records the outcomes leadership has chosen for its risks and obligations.
Govern comes first and runs throughout: policies, processes and practices that are in place and transparent, accountability structures with empowered and trained people, and a culture that considers and communicates AI risk. With those outcomes in place, most organisations start with Map, establishing the context and risks of each AI system, and continue to Measure, assessing and tracking those risks, and Manage, prioritising and acting on them. NIST is explicit that the actions are not a checklist or necessarily an ordered set of steps. Testing and monitoring produce evidence, and the first review shows how far the Target Profile is achieved. Leadership, internal audit and, if commissioned, an independent assessor judge the result.
Sterling's expert and experienced consultants build the inventory and Profiles with your leadership and implement governance and testing with your teams under Sterling OS™. Decisions on risk tolerance and which systems go live stay with the people accountable for them.
NIST AI RMF at a glance
- Purpose
- Managing the risks of AI to people, organisations and society through outcomes in four functions: Govern, Map, Measure and Manage
- Relevant to
- Any organisation that develops, deploys, procures or operates AI, of any size and in any sector, including those that only use AI built by others
- Edition
- AI RMF 1.0 (NIST AI 100-1), released 26 January 2023, with the Generative AI Profile (NIST AI 600-1) of July 2024; NIST has announced that 1.0 is being revised under the White House AI Action Plan
- Certification
- None. NIST publishes the framework for voluntary use and does not certify against it; no "NIST AI RMF certified" status exists. ISO/IEC 42001 is the certifiable AI management system standard
- Sterling's role
- AI inventory and Profiles with your leadership, governance and testing implemented with your teams, Effivity, training and the first review, then Sustain™
- Cost and timing
- Total investment for a NIST AI RMF programme depends on the current maturity of your processes, the scope, locations and number of employees. The process typically takes 3 to 9 months
NIST AI RMF: questions people ask
Can an organisation be certified to the NIST AI RMF?
No. NIST publishes the AI RMF for voluntary use and does not certify anyone against it, and no "NIST AI RMF certified" status exists. A badge with that name is its issuer's own document, and Sterling does not issue one. What you can show is a Target Profile, evidence that its outcomes are achieved and, if you want it, an independent assessment. When a customer needs a certificate, ISO/IEC 42001 is the standard accredited certification bodies audit.
Is the NIST AI RMF mandatory?
Generally not. NIST describes the framework as intended for voluntary use. It becomes an obligation only where someone makes it one, through a customer contract, a procurement condition or a group policy, so read the wording of any requirement you receive.
How does the NIST AI RMF relate to ISO/IEC 42001?
They do different jobs and fit together well. ISO/IEC 42001:2023 sets requirements for an AI management system that an accredited certification body can certify; the AI RMF is a voluntary set of outcomes with no certificate. NIST's crosswalk page lists an ISO/IEC 42001 crosswalk produced by Microsoft, without implying endorsement or complete coverage. In practice Map, Measure and Manage feed the AI risk assessment, treatment and impact assessment ISO/IEC 42001 requires; the management system adds internal audit, management review and the certificate.
How does the NIST AI RMF relate to the EU AI Act?
The EU AI Act, Regulation (EU) 2024/1689, is law, with obligations that depend on your role and on the risk category of each system; the AI RMF is voluntary guidance from a US agency. Applying the AI RMF does not by itself demonstrate conformity with the Act, where presumption of conformity comes from harmonised standards referenced in the Official Journal. The work still overlaps heavily: inventory, lifecycle risk management, testing, documentation, human oversight and monitoring. NIST's crosswalk to the Act predates its adoption (January 2023), so treat it as orientation only.
What is the NIST Generative AI Profile (NIST AI 600-1)?
A cross-sectoral Profile and companion resource to AI RMF 1.0, released on 26 July 2024. It names 12 risks that generative AI creates or makes worse, from confabulation and information integrity to intellectual property and data privacy, and suggests actions keyed to the AI RMF subcategories. If your people use generative AI assistants or you build on foundation models, it is the most practical place to start.
Keep exploring
Related to this video
The complete guide
Everything on NIST AI RMF
Start with the NIST AI RMF page, or go straight to the guide you need.
On the NIST AI RMF page
- What are the main NIST AI RMF functions and outcomes?
- How do you implement the NIST AI RMF?
- How much does NIST AI RMF implementation cost?
- How long does NIST AI RMF implementation take?
- Who needs NIST AI RMF implementation?
- How the NIST AI RMF makes AI safer to adopt and easier to defend
- Frequently asked questions about the NIST AI RMF
More videos: AI governance and digital trust
Talk to a consultant
Plan your NIST AI RMF implementation with confidence.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice