Two-minute brief
NIST AI RMF explained: video brief
A two-minute brief on the structure of the NIST AI Risk Management Framework.
Key takeaways
- The AI RMF describes outcomes, not a checklist.
- Part 1 sets seven characteristics of trustworthy AI.
- Govern is cross-cutting; Map, Measure and Manage follow.
- Profiles tailor outcomes to a use case, sector or point in time.
- The Generative AI Profile applies the framework to generative AI.
Outcomes, not mandatory controls
The NIST AI RMF contains outcomes, not mandatory controls, and NIST is explicit that the actions behind them are not a checklist or necessarily an ordered set of steps. Part 1 frames AI risk and sets out seven characteristics of trustworthy AI. Part 2 holds the Core and the Profiles. This short film walks through the structure.
The Core has four functions. Govern is cross-cutting, infused throughout AI risk management and enabling the other functions. It covers a culture of risk management in organisations that design, develop, deploy, evaluate or acquire AI: policies, processes and practices that are in place, transparent and effective; accountability structures with empowered, trained people; workforce diversity, equity, inclusion and accessibility processes; a culture that considers and communicates AI risk; engagement with relevant AI actors; and policies for third-party software, data and supply chain risks.
Map, Measure, Manage and Profiles
Once the Govern outcomes are in place, NIST expects most users to start with Map, which establishes the context of an AI system and frames its risks, and to continue to Measure, which uses quantitative and qualitative methods to analyse, assess, benchmark and monitor AI risk, and Manage, which allocates resources to the mapped and measured risks and acts on them. Profiles tailor the functions' outcomes to a use case, a sector or a point in time, and the Generative AI Profile, NIST AI 600-1, applies the framework to generative AI.
AI RMF 1.0, published as NIST AI 100-1, was released on 26 January 2023, and NIST has announced that it is being revised. It applies to any organisation that develops, deploys, procures or operates AI, including those that only use AI built by others. NIST publishes it for voluntary use and does not certify against it.
The AI RMF Playbook offers suggested actions for each subcategory, but NIST says it is neither a checklist nor a set of steps to be followed in its entirety.
NIST AI RMF at a glance
- Purpose
- Managing the risks of AI to people, organisations and society through outcomes in four functions: Govern, Map, Measure and Manage
- Relevant to
- Any organisation that develops, deploys, procures or operates AI, of any size and in any sector, including those that only use AI built by others
- Edition
- AI RMF 1.0 (NIST AI 100-1), released 26 January 2023, with the Generative AI Profile (NIST AI 600-1) of July 2024; NIST has announced that 1.0 is being revised under the White House AI Action Plan
- Certification
- None. NIST publishes the framework for voluntary use and does not certify against it; no "NIST AI RMF certified" status exists. ISO/IEC 42001 is the certifiable AI management system standard
- Sterling's role
- AI inventory and Profiles with your leadership, governance and testing implemented with your teams, Effivity, training and the first review, then Sustain™
- Cost and timing
- Total investment for a NIST AI RMF programme depends on the current maturity of your processes, the scope, locations and number of employees. The process typically takes 3 to 9 months
NIST AI RMF: questions people ask
Can an organisation be certified to the NIST AI RMF?
No. NIST publishes the AI RMF for voluntary use and does not certify anyone against it, and no "NIST AI RMF certified" status exists. A badge with that name is its issuer's own document, and Sterling does not issue one. What you can show is a Target Profile, evidence that its outcomes are achieved and, if you want it, an independent assessment. When a customer needs a certificate, ISO/IEC 42001 is the standard accredited certification bodies audit.
Is the NIST AI RMF mandatory?
Generally not. NIST describes the framework as intended for voluntary use. It becomes an obligation only where someone makes it one, through a customer contract, a procurement condition or a group policy, so read the wording of any requirement you receive.
How does the NIST AI RMF relate to ISO/IEC 42001?
They do different jobs and fit together well. ISO/IEC 42001:2023 sets requirements for an AI management system that an accredited certification body can certify; the AI RMF is a voluntary set of outcomes with no certificate. NIST's crosswalk page lists an ISO/IEC 42001 crosswalk produced by Microsoft, without implying endorsement or complete coverage. In practice Map, Measure and Manage feed the AI risk assessment, treatment and impact assessment ISO/IEC 42001 requires; the management system adds internal audit, management review and the certificate.
How does the NIST AI RMF relate to the EU AI Act?
The EU AI Act, Regulation (EU) 2024/1689, is law, with obligations that depend on your role and on the risk category of each system; the AI RMF is voluntary guidance from a US agency. Applying the AI RMF does not by itself demonstrate conformity with the Act, where presumption of conformity comes from harmonised standards referenced in the Official Journal. The work still overlaps heavily: inventory, lifecycle risk management, testing, documentation, human oversight and monitoring. NIST's crosswalk to the Act predates its adoption (January 2023), so treat it as orientation only.
What is the NIST Generative AI Profile (NIST AI 600-1)?
A cross-sectoral Profile and companion resource to AI RMF 1.0, released on 26 July 2024. It names 12 risks that generative AI creates or makes worse, from confabulation and information integrity to intellectual property and data privacy, and suggests actions keyed to the AI RMF subcategories. If your people use generative AI assistants or you build on foundation models, it is the most practical place to start.
Keep exploring
Related to this video
The complete guide
Everything on NIST AI RMF
Start with the NIST AI RMF page, or go straight to the guide you need.
On the NIST AI RMF page
- What are the main NIST AI RMF functions and outcomes?
- How do you implement the NIST AI RMF?
- How much does NIST AI RMF implementation cost?
- How long does NIST AI RMF implementation take?
- Who needs NIST AI RMF implementation?
- How the NIST AI RMF makes AI safer to adopt and easier to defend
- Frequently asked questions about the NIST AI RMF
More videos: AI governance and digital trust
Talk to a consultant
Plan your NIST AI RMF implementation with confidence.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice