NIST AI RMF · AI Risk Management Framework

NIST AI RMF implementation consulting for AI that is governed, measured and trusted.

Govern the AI your organisation builds, procures and uses with the NIST AI Risk Management Framework: every system inventoried and owned, its impacts mapped before launch, its behaviour measured and its risks managed until it is retired. Sterling's expert and experienced consultants build the Profiles with your leadership, put the priority outcomes in place with your teams and stay until the framework shapes every AI decision, in 60+ countries. NIST offers the AI RMF for voluntary use and does not certify against it. We ensure our clients put the standard in place successfully.

Book a free discovery call Start the free readiness check

Fixed scope, one proposal: consulting, Effivity software, Sterling Academy access and internal auditor training, as applicable to your standard, in one proposal
A team of expert and experienced AI governance consultants, advising on management systems across sectors and countries since 2003
The Sterling Promise: 100% on-time completion, 100% success, 8,100+ client engagements. Sterling works with you to put the framework in place; there is no certificate to issue

NIST AI RMF at a glance

Purpose: Managing the risks of AI to people, organisations and society through outcomes in four functions: Govern, Map, Measure and Manage
Relevant to: Any organisation that develops, deploys, procures or operates AI, of any size and in any sector, including those that only use AI built by others
Edition: AI RMF 1.0 (NIST AI 100-1), released 26 January 2023, with the Generative AI Profile (NIST AI 600-1) of July 2024; NIST has announced that 1.0 is being revised under the White House AI Action Plan
Certification: None. NIST publishes the framework for voluntary use and does not certify against it; no "NIST AI RMF certified" status exists. ISO/IEC 42001 is the certifiable AI management system standard
Sterling's role: AI inventory and Profiles with your leadership, governance and testing implemented with your teams, Effivity, training and the first review, then Sustain™
Cost and timing: Total investment for a NIST AI RMF programme depends on the current maturity of your processes, the scope, locations and number of employees. The process typically takes 3 to 9 months

8,100+ client engagements in 60+ countries.

NIST AI RMF client experience

What it is

What is the NIST AI RMF and what is it used for?

The NIST AI Risk Management Framework (AI RMF 1.0, published as NIST AI 100-1) is voluntary guidance from the US National Institute of Standards and Technology for managing the risks that AI systems pose to individuals, organisations and society. NIST developed it at the direction of the National Artificial Intelligence Initiative Act of 2020, through an open, consensus-driven process, to be rights-preserving, non-sector-specific and use-case agnostic. Part 1 frames AI risk and sets out seven characteristics of trustworthy AI; Part 2 holds the Core, four functions (Govern, Map, Measure and Manage) divided into 19 categories and 72 subcategories of outcomes, and Profiles that tailor those outcomes to a use case, a sector or a point in time.

Around the Core, NIST maintains a Playbook of suggested actions for every subcategory, a Roadmap, crosswalks to other standards and the Generative AI Profile (NIST AI 600-1). None of it tells you how much risk to accept: NIST states that the framework does not prescribe risk tolerance, and that decision, with the evidence behind it, is what an implementation builds. The practical test: when a team proposes a new AI use case, or a vendor switches on an AI feature in a tool you already use, does somebody know who approves it, whom it could harm, how it will be tested and when it would be switched off?

Current version. AI RMF 1.0 was released on 26 January 2023, and the Generative AI Profile followed on 26 July 2024. NIST originally expected a formal review with input from the AI community no later than 2028; it has since announced that AI RMF 1.0 is being revised as part of the White House AI Action Plan. No revised version had been published when this page was last reviewed (September 2026), so 1.0 and the Generative AI Profile remain the texts to implement. There is no transition deadline, because the framework is voluntary; a Profile built today is mapped to the revised framework when NIST releases it. NIST AI RMF explained: the Core, trustworthy AI and Profiles

Who it is for

Who needs NIST AI RMF implementation?

NIST wrote the AI RMF for what it calls AI actors: organisations and individuals with an active role anywhere in the AI system lifecycle, including those that deploy or operate AI built by someone else. Organisations come to Sterling for the AI RMF from four starting points:

AI is spreading through the business faster than anyone can govern it. Staff use generative AI assistants, vendors switch on AI features, and nobody can list every system or owns the risk. The Govern function is where that changes.
A customer, investor, insurer or procurement team asks how your AI is governed. When the question is phrased in AI RMF terms, a Target Profile with evidence behind each outcome answers it once and consistently, for every questionnaire.
You build AI into products or services and have to answer for how it behaves. Accuracy, robustness, bias, privacy and explainability stop being engineering preferences once customers ask for test results; Map and Measure give product and data teams the method.
A regulation, an incident or a certificate is on the horizon. The EU AI Act reaches AI placed on or used in the EU market, a chatbot gave a customer wrong advice, or a buyer wants ISO/IEC 42001. The AI RMF supplies the evidence each of those builds on.

The intended benefit is AI that people inside and outside the organisation can rely on, with the evidence to show it, which depends on sound risk decisions, not on a policy signed once and forgotten.

Business benefits

How the NIST AI RMF makes AI safer to adopt and easier to defend

AI governance earns its place when it lets the business say yes to good use cases sooner and no to poor ones earlier. We begin with the decisions your teams actually face, such as which vendor model to trust with customer data, and shape the framework around them.

Every AI system known and ownedAn inventory of built, procured and embedded AI, each entry with an owner, a risk rating and a review date, so exposure is visible before anyone asks.
Faster, safer approval of new use casesOne intake route with criteria proportionate to impact: low-risk tools cleared quickly, high-impact systems assessed and tested first.
Test results in place of assurancesValidity, reliability, safety, security, explainability, privacy and bias measured with metrics chosen per system, before and after release.
Generative and third-party AI under controlVendor models, APIs and AI features in existing software assessed against the risks the Generative AI Profile names, with contract terms to match.
Incidents handled, not improvisedResponse, recovery and deactivation plans with named owners, so a harmful output becomes a managed event, not a crisis.
One foundation for ISO/IEC 42001 and the EU AI ActThe inventory, risk method, impact assessments and testing records serve the certification audit and the regulatory file alike.

Pick a few measures, such as the share of high-impact systems evaluated before release, and check whether AI decisions are changing. A thicker policy manual is not a business result.

Core functions, trustworthy AI and Profiles

What are the main NIST AI RMF functions and outcomes?

The AI RMF contains outcomes, not mandatory controls, and NIST is explicit that the actions behind them are not a checklist or necessarily an ordered set of steps. Govern is cross-cutting, infused throughout AI risk management and enabling the other functions; once its outcomes are in place, NIST expects most users to start with Map and continue to Measure or Manage. The table maps the framework as published in January 2023 and July 2024, with the counts of the 1.0 Core.

Part of the framework	What it describes	What it looks like in practice
GOVERN · 6 categories, 19 subcategories	A culture of risk management in organisations that design, develop, deploy, evaluate or acquire AI. Categories: policies, processes and practices in place, transparent and effective; accountability structures with empowered, trained people; workforce diversity, equity, inclusion and accessibility processes prioritised; a culture that considers and communicates AI risk; engagement with relevant AI actors; and third-party software, data and supply-chain risks	An approved AI policy and acceptable-use rules, an inventory of AI systems, trained owners, a documented risk tolerance, an intake and approval route, and third-party AI terms in contracts
MAP · 5 categories, 18 subcategories	The context that frames the risks of each AI system. Categories: context established; the system categorised; capabilities, usage, goals, benefits and costs compared with benchmarks; risks and benefits mapped for every component, including third-party software and data; and impacts on individuals, groups, communities, organisations and society characterised	For each system: intended purpose, users and people affected, deployment setting, known limitations, benefits weighed against the cost of errors, third-party components, and a proportionate impact assessment
MEASURE · 4 categories, 22 subcategories	Quantitative, qualitative or mixed methods to analyse, assess, benchmark and monitor AI risk and its impacts. Categories: methods and metrics identified and applied; systems evaluated for the trustworthy characteristics (13 subcategories); risks tracked over time; and feedback on whether the measurement works	A test plan per system, metrics for performance, robustness, bias, privacy and security, results before release and in production, independent review where impact warrants it, and user feedback captured
MANAGE · 4 categories, 13 subcategories	Risk resources allocated to mapped and measured risks, regularly and as Govern defines. Categories: risks prioritised and responded to on the strength of Map and Measure; strategies to maximise benefits and minimise negative impacts; third-party risks and benefits managed; and treatments, response, recovery and communication plans documented and monitored	A release decision per system with residual risk accepted by the named owner, treatment plans, production monitoring, incident playbooks, criteria to disengage or retire a system, and vendor reviews
Trustworthy AI · 7 characteristics	From Part 1: valid and reliable; safe; secure and resilient; accountable and transparent; explainable and interpretable; privacy-enhanced; and fair, with harmful bias managed. Valid and reliable is the base for the others, accountable and transparent relates to all, and trade-offs are usually involved	Each characteristic turned into acceptance criteria and metrics for your systems, and trade-offs, such as accuracy against interpretability, decided by the accountable owner and recorded
Profiles · use-case, temporal, cross-sectoral	Use-case Profiles for a specific setting or application; temporal Profiles describing the current or the target state (Current and Target); and cross-sectoral Profiles for models or applications used across use cases or sectors. NIST prescribes no Profile template	A Current Profile scored from evidence, a Target Profile leadership selects, the gap ranked by risk, and use-case Profiles for the few systems that carry the most impact
Generative AI Profile · NIST AI 600-1	A cross-sectoral Profile and companion resource published in July 2024. It names 12 risks unique to or made worse by generative AI: CBRN information or capabilities; confabulation; dangerous, violent or hateful content; data privacy; environmental impacts; harmful bias or homogenisation; human-AI configuration; information integrity; information security; intellectual property; obscene, degrading and/or abusive content; and value chain and component integration. Its suggested actions are keyed to AI RMF subcategories	Use cases screened against the 12 risks, acceptable-use rules for assistants, and the four primary considerations NIST's public working group identified: governance, content provenance, pre-deployment testing and incident disclosure

What does useful NIST AI RMF evidence look like?

An AI inventory with owners and risk ratings; the approved AI policy and risk tolerance; training records; and, for each system in scope, a context record, an impact assessment, test results against a plan, third-party assessments, the release decision with residual risk accepted by name, and monitoring and incident records. Add the Current and Target Profiles and an action plan tracked to closure. They live in Effivity from the first workshop, so the Profile reflects what your teams actually do.

NIST AI RMF outcomes explained, function by function

Implementation route

How do you implement the NIST AI RMF?

No certification body sits in this route. NIST offers the AI RMF for voluntary use and does not certify organisations against it, so whether your Target Profile is achieved is judged by your leadership, your internal audit and, if you commission one, an independent assessor. Sterling builds the inventory and Profiles and puts the priority outcomes in place with you; decisions on risk tolerance, targets and which systems go live stay with the people accountable for them.

01
Scope the programme and inventory the AI.List the AI you build, procure and use, including features embedded in existing software, and agree what the Profile covers.
02
Gap analysis: where your AI governance stands against the Target Profile.Each selected outcome is scored against the records, tests and decisions that exist today; leadership chooses the Target, and the difference becomes a ranked list of work.
03
Put the Govern outcomes in place first.Policy, accountability, risk tolerance, the intake and approval route and third-party rules, so every later decision about a system has an owner and a standard to meet.
04
Map, measure and manage the priority systems.Context and impact assessment, testing against agreed metrics, a documented release decision and production monitoring, starting with the highest-impact systems.
05
Review, audit and close the findings.Internal audit and a management review test whether the outcomes are achieved as the Profile states; we raise the gaps first, and each is closed with evidence.
06
Profile review and continual improvement.The Current Profile moves as actions close, the Target is revisited as models, vendors, uses and regulations change, and Sustain™ supports each cycle.

Look past the quoted price to what is actually being delivered. No "NIST AI RMF certified" status exists, so a badge or "AI RMF compliance certificate" is a document its seller designed. Ask how the Current Profile will be evidenced, who will set risk tolerance, and what will still run when the consultant leaves; if your customer needs a certificate, ask about ISO/IEC 42001 instead. How to choose a credible NIST AI RMF provider · The certification buyer's checklist

Cost

How much does NIST AI RMF implementation cost?

No single price fits every NIST AI RMF programme. A software company with two AI features and a working ISO/IEC 27001 ISMS needs a different scope from a lender running models in credit, fraud and customer service. What we can promise is a proposal with every component visible and an all-inclusive proposal, and no certification fee, because the framework has no certificate.

Cost component	What affects it
Consulting and implementation	Current maturity, the number of AI systems and use cases in scope, how many are high-impact, the deliverables and how much of the work your team takes on (Design™ or Drive™)
Independent assessment or certification, if you choose one	The AI RMF has no certification body. An independent assessment of your Profile, or an ISO/IEC 42001 audit by an accredited body, is priced separately by the provider you appoint
Internal resources	Leadership time for decisions, engineering and data science time for testing, legal and privacy review, and any tooling the plan needs
Software and learning	Included in a Sterling engagement: Effivity for the inventory, Profiles, risks, assessments, tests, incidents and actions, and Sterling Academy access for your people, with users, courses and access period confirmed in the proposal
Continued support	Profile reviews, monitoring support, internal audits, refresher learning and adoption of the revised AI RMF when NIST releases it, under Sustain™

What moves the price

How many AI systems and use cases are in scope, and how many affect people's rights, safety or money
Whether you develop or fine-tune models, integrate vendor models, or mainly use AI inside procured software
Whether an ISMS, a privacy programme or an AI policy exists today, and how much of it works
The deadline, and how much of the work your team can carry
Regulatory exposure such as the EU AI Act or sector rules, and the number of countries and languages

What a Sterling proposal always shows

Deliverables, responsibilities, assumptions and exclusions, in writing
No certification fee; any independent assessment or ISO/IEC 42001 audit fees shown separately
Effivity, training and Academy access listed as included, at no additional cost
Payment milestones linked to deliverables rather than dates
One all-inclusive proposal. No surprises, ever

Timeline

How long does NIST AI RMF implementation take?

The pace depends on how many AI systems are in scope, how quickly leadership decides risk tolerance and targets, and how much testing the priority systems need. Expect months, not days, typically three to nine: governance has to operate, and priority systems have to be assessed, tested and monitored long enough to leave the evidence a reviewer will ask for. Milestones are tracked in Effivity.

Phase	What determines the pace
Inventory and Current Profile	How quickly AI use can be found across teams and vendors, and access to system owners and contracts
Governance and Target Profile	Leadership decisions on policy, accountability, risk tolerance and targets, and the route for approving them
Priority systems mapped, measured and managed	The number of high-impact systems, the data and test environments available, vendor cooperation and internal capacity
Review and Profile update	Outcomes operating long enough to produce evidence, the internal audit slot and the time to close what it finds

If a questionnaire, a contract, an EU AI Act date or a board meeting sets the deadline, tell us at the start, and we will say what is achievable. "AI RMF compliance" promised in two weeks, before anyone has looked at your systems, is a sales line, not a plan.

Challenges

Common NIST AI RMF implementation challenges

AI governance programmes tend to stall in five places. Each has a practical answer.

Nobody knows how much AI the organisation actually uses.

Personal use of assistants, AI switched on inside existing software and models built by individual teams rarely appear in any register. We combine a short declaration exercise with procurement and contract data, and the intake route keeps the inventory current.

Risk tolerance was never set, so every use case is argued from scratch.

The framework deliberately leaves tolerance to you. We help leadership state it in terms teams can apply: which uses are prohibited, which need assessment and testing, and which can proceed on standard controls.

Trustworthiness is a word, not a measurement.

Fairness, explainability and robustness mean different things for a credit model and a document summariser. We agree metrics and thresholds per system with the people who build and use it, and arrange independent testing where the impact warrants it.

Third-party and generative AI sit outside every control.

Vendor models, APIs and AI features are assessed against the Generative AI Profile risks and your own criteria before adoption, and contracts cover data use, incidents and changes.

The programme is on hold until the revised AI RMF appears.

Whatever the revision changes, you will still need an inventory, owners, impact assessments, testing and monitoring. We build those on 1.0 now and use Revise™ to adopt the new version when NIST releases it.

Your engagement

What your NIST AI RMF engagement includes

The agreed scope covers everything needed for AI governance that runs in daily decisions and a leadership team ready to own it. Many providers hand over a policy pack and leave the gaps with you; a Sterling engagement covers the whole journey, under one all-inclusive proposal.

Scope, AI inventory, gap analysis and implementation plan
The inventory built, Current and Target Profiles evidenced, and owners, dates and decision rights agreed before implementation begins.
AI governance and documentation
Policy, acceptable use, roles, risk tolerance, intake and approval, impact assessment and test templates and third-party AI terms, on Sterling's own template sets.
Effivity ISO & GRC software
Your inventory, Profiles, risks, assessments, tests, incidents, audits and actions run in Effivity from day one, included with the engagement at no additional cost.
Training for everyone
Internal auditor training for the people who will audit AI governance, as applicable to your standard, and preferential Sterling Academy access, including complimentary awareness training for your people as part of the engagement.
Priority systems mapped, measured and managed
Context, impact assessment, evaluation, release decision and monitoring for the systems that matter most, with your product, data and risk teams.
Review, internal audit and Profile update
An internal audit against the Target Profile, a management review and an updated Current Profile, with the gaps closed on evidence before handover.

NIST publishes the AI RMF for voluntary use and does not certify against it; no certificate is issued or promised, and where you pursue ISO/IEC 42001 the certification decision remains with the independent certification body.

How we deliver

How Sterling supports your NIST AI RMF implementation

Every NIST AI RMF engagement runs on Sterling OS™, our delivery operating system: five phases, each with named deliverables, decision owners and evidence. Match the level of support to the capacity of your teams; the method, the software and the accountability are the same either way.

01
Design™Guided implementation: your people build the inventory and Profiles and close the gaps using Sterling's structure, templates, workshops and coaching.
02
Drive™Fully managed consulting: Sterling consultants carry the agreed inventory, documentation and assessment work alongside your product, data, legal and risk owners.
03
Sustain™After the first cycle: Profile reviews, monitoring support, internal audits, refreshers and training for new joiners, year after year.
04
Automate™The framework running in Effivity: inventory, outcomes, risks, impact assessments, tests, incidents, actions and reporting in one workspace.
05
Revise™Adoption of the revised AI RMF and new NIST Profiles when they are released, and changes in systems, vendors, uses, regulation or risk tolerance.

Before the first workshop, the engagement team, the weekly working session, the deliverables and the decision rights are agreed in writing. Each week progress is checked against them, so a slipping outcome shows up in the working session, not in front of a customer or a regulator.

How Sterling OS™ works

Often combined with

Standards organisations pair with NIST AI RMF

Effivity · NIST AI RMF software, included in every engagement

How Effivity helps you fulfil, automate and simplify the outcomes of NIST AI RMF 1.0.

Every Sterling NIST AI RMF engagement includes Effivity, the ISO and GRC automation platform built by the Sterling group and used in 50+ countries. Your consultant configures it within the agreed scope, so the inventory, Profiles, risks, assessments, tests, incidents and audits sit in one place and reviewers see a working system. The subscription is included with the engagement, at no additional cost.

Included in every engagement See Effivity

Effivity: Context of the Organisation dashboard with issues, interested parties and scope — Effivity · Context of the Organisation dashboard

Govern

Policy, accountability, tolerance and third parties

The AI policy and acceptable-use rules with approvals, the risk tolerance leadership set, owners for every system, training records and the AI vendor register, so governance is on record, not assumed.

Map

Inventory, context and impact

Every AI system with its purpose, users, affected people, setting and components; impact assessments linked to the system and the decision they informed.

Measure

Metrics, tests and evaluation results

Evaluation plans with metrics and thresholds per system, results before release and in production, and feedback from users and affected people.

Manage

Release decisions, treatment and incidents

Release decisions with residual risk accepted by name, treatment actions tracked to closure, AI incidents logged and escalated, and disengagement or retirement recorded.

Trustworthy AI characteristics

The seven characteristics, made measurable

Acceptance criteria for each of the seven characteristics, attached to each system, with the trade-off decisions kept beside them.

Profiles

Profiles that move as the work closes

Each selected outcome with its status, evidence, target and owner, and the gap ranked by risk, so the Profile shows this week's position, not last year's workshop.

Generative AI Profile

Generative AI use cases and the 12 risks

Each generative AI use case screened against the risks NIST AI 600-1 names, with its acceptable-use rules, provenance and testing controls recorded against it.

Across the framework

Your own forms, mappings and reports

Outcomes mapped to ISO/IEC 42001, ISO/IEC 27001 or EU AI Act obligations, dashboards by function and business unit, and a management review that records its decisions.

What this means at the review

Whoever reviews your AI governance, from your board to a customer's due-diligence team, asks for the inventory, the Target Profile, impact assessments and test results, the incident record and the action plan. In Effivity each is a screen with dates, owners and evidence attached. After the first cycle Sustain™ continues in the same workspace, so every Profile review starts from current records.

Effivity for NIST AI RMF: the guide Effivity on effivity.com

In your engagement

Subscription included with the engagement, at no additional cost
Configured by your Sterling consultant within the agreed scope
Your inventory, policies, assessments and registers migrated, not retyped
Admin and user training for your team
The same platform runs your ISMS, privacy or quality system when you add certifiable standards

NIST AI RMF client experience

Client letters on file, available on request.

Client feedback wall: letters on file

Signed client letters for NIST AI RMF are available on request. The client feedback wall lists every letter by standard.

Programmes with NIST AI RMF in scope

How an integrated AI governance programme runs.

All case studies

01
Technology and SaaS: the NIST AI RMF as the risk method inside ISO/IEC 42001 and ISO/IEC 27001
The NIST AI RMF is commonly used as the risk method inside an integrated programme that also seeks ISO/IEC 42001 and ISO/IEC 27001 certification and prepares for the EU AI Act where products reach the EU market. In such a programme leadership sets risk tolerance and the Target Profile, Map and Measure feed the AI risk and impact assessments, the ISMS protects the data and platforms the models depend on, and one evidence base serves auditors, customers and the regulatory file.
How integrated programmes run

Sterling Academy · NIST AI RMF e-learning

Train every employee on the NIST AI RMF, not just the data science team.

Sterling Academy provides e-learning for the whole workforce and for the people who run AI governance: video lessons with practice checkpoints, a final exam and a numbered Certificate of Completion for each learner, verifiable online. Sterling consulting clients benefit from preferential course access and special pricing through their Sterling consultant, including complimentary awareness training for their people as part of the engagement.

NIST AI RMF awareness for every employee, so people know which AI uses are allowed, which data must never go into a prompt and how to report an output that looks wrong
Practitioner courses for system owners, the AI governance lead and the managers who own Govern outcomes
Internal auditor training, as applicable to your standard, for the people who will audit AI governance, as part of the engagement
Progress by department, and a training status report ready for leadership or an external reviewer
New joiners trained as they arrive, so competence evidence is current at every Profile review
A Sterling consultant on hand when a learner has a question

Keep exploring

Explore more about NIST AI RMF

Watch a video on how to implement NIST AI RMF here.
Watch a video on the NIST AI Risk Management Framework explained here.

NIST AI RMF resources

Services for NIST AI RMF

Why Sterling

Want a NIST AI RMF programme that holds up under scrutiny? Come to Sterling.

AI governance has to work for one product team and for a group with subsidiaries in several jurisdictions. Sterling sets one framework with local owners, reconciling differences in regulation and risk tolerance between markets.

60+ countries, since 2003

Governance, risk and management systems implemented for technology companies, BPOs, financial services firms and public bodies, with one engagement team accountable wherever you operate.

All-inclusive proposal

Consulting, Effivity, training and Academy access in one proposal; there is no certification fee, and any independent assessment or ISO/IEC 42001 audit is identified separately. No surprises, ever.

Governance that does not slow delivery

Approval routes proportionate to impact and templates written for product teams, not lawyers, so good use cases move faster.

Expert and experienced consultants

Consultants with management-system experience across sectors and countries since 2003, who connect AI risk to the governance, security and privacy disciplines your organisation already runs and get the design right first time.

Sterling vs the rest: the full comparison Explore NIST AI RMF client experience

The Sterling Promise

What our NIST AI RMF implementation success guarantee means

100%on-time completion · success · 8,100+ client engagements

We stay with you until your agreed NIST AI RMF implementation outcome is achieved: the inventory complete for the agreed scope, the Profiles approved by leadership, the priority systems mapped, measured and managed, and the first review delivered. Clear explanations, practical delivery, included software and employee learning turn the investment into lasting capability rather than a policy nobody reads.

The engagement sets out the framework, scope, outcome and responsibilities. Your organisation provides accurate information, decides risk tolerance and the Target Profile, and puts the agreed controls into use. The AI RMF carries no certification, so none is promised; where you commission an independent assessment or an ISO/IEC 42001 audit, the conclusions belong to the assessor or the certification body. Our commitment covers the agreed consulting support, not a promise that an AI system will never fail or cause harm.

After implementation

What happens after NIST AI RMF implementation?

The framework has to keep pace with the AI itself. Models are retrained, vendors change their terms and new use cases arrive. The inventory is updated through the intake route, monitoring continues in production, and at planned intervals the Target Profile is revisited and internal audit checks the outcomes.

When NIST releases the revised AI RMF, the Profile is mapped to it rather than rebuilt. Under Sterling OS™ Sustain™ we facilitate Profile reviews, audit the outcomes, support testing of new systems and train new joiners, so AI governance stays current between reviews.

Placing AI systems on the EU market? Connect your Profile to the EU AI Act.

Regulation (EU) 2024/1689 has been in force since 1 August 2024. Its obligations for high-risk systems now apply from 2 December 2027 for the uses listed in Annex III and from 2 August 2028 for AI in the regulated products of Annex I, dates set by the Digital Omnibus on AI, in force since 27 July 2026. Map your inventory to the Act's risk categories, confirm your role for each system, and reuse the AI RMF evidence.

Plan the EU AI Act mapping

FAQs

Frequently asked questions about the NIST AI RMF

Can an organisation be certified to the NIST AI RMF?

No. NIST publishes the AI RMF for voluntary use and does not certify anyone against it, and no "NIST AI RMF certified" status exists. A badge with that name is its issuer's own document, and Sterling does not issue one. What you can show is a Target Profile, evidence that its outcomes are achieved and, if you want it, an independent assessment. When a customer needs a certificate, ISO/IEC 42001 is the standard accredited certification bodies audit.

Is the NIST AI RMF mandatory?

Generally not. NIST describes the framework as intended for voluntary use. It becomes an obligation only where someone makes it one, through a customer contract, a procurement condition or a group policy, so read the wording of any requirement you receive.

How does the NIST AI RMF relate to ISO/IEC 42001?

They do different jobs and fit together well. ISO/IEC 42001:2023 sets requirements for an AI management system that an accredited certification body can certify; the AI RMF is a voluntary set of outcomes with no certificate. NIST's crosswalk page lists an ISO/IEC 42001 crosswalk produced by Microsoft, without implying endorsement or complete coverage. In practice Map, Measure and Manage feed the AI risk assessment, treatment and impact assessment ISO/IEC 42001 requires; the management system adds internal audit, management review and the certificate.

How does the NIST AI RMF relate to the EU AI Act?

The EU AI Act, Regulation (EU) 2024/1689, is law, with obligations that depend on your role and on the risk category of each system; the AI RMF is voluntary guidance from a US agency. Applying the AI RMF does not by itself demonstrate conformity with the Act, where presumption of conformity comes from harmonised standards referenced in the Official Journal. The work still overlaps heavily: inventory, lifecycle risk management, testing, documentation, human oversight and monitoring. NIST's crosswalk to the Act predates its adoption (January 2023), so treat it as orientation only.

What is the NIST Generative AI Profile (NIST AI 600-1)?

A cross-sectoral Profile and companion resource to AI RMF 1.0, released on 26 July 2024. It names 12 risks that generative AI creates or makes worse, from confabulation and information integrity to intellectual property and data privacy, and suggests actions keyed to the AI RMF subcategories. If your people use generative AI assistants or you build on foundation models, it is the most practical place to start.

Do we have to follow every action in the AI RMF Playbook?

No. NIST says the Playbook is neither a checklist nor a set of steps to be followed in its entirety, and its suggestions are voluntary. It offers suggested actions aligned to each subcategory, in PDF, CSV, Excel and JSON, updated roughly twice a year, and NIST says it will be updated after the AI RMF revision. We treat it as a menu for your Target Profile.

NIST is revising the AI RMF. Should we wait for the new version?

No. NIST states that AI RMF 1.0 is being revised as part of the White House AI Action Plan, and no revised version had been released by September 2026. Waiting leaves the AI you already run ungoverned, so build on 1.0 and the Generative AI Profile now and adopt the revised framework through Revise™ when NIST releases it.

Does the AI RMF apply if we only use AI built by others?

Yes. NIST's definition of AI actors includes organisations and individuals that deploy or operate AI, not only those that develop it. Govern, Map and Manage each have a category for third-party software, data and entities. For many organisations the first Profile is mostly about procured and embedded AI.

What do you need to prepare a NIST AI RMF proposal?

A rough list of the AI you build, integrate and use, the business units and countries in scope, approximate headcount, what exists today (an AI policy, an ISMS, a privacy programme, ISO/IEC 42001 plans), who is asking for the framework and your deadline. That is enough for a scoped, all-inclusive proposal; there is no need to complete an inventory or score a Profile first.

Before the first call

Prepare a useful NIST AI RMF readiness brief

No inventory or scored Profile is needed before the first conversation. A short account of where AI is used and who is asking about it is enough to begin. Seven questions cover it:

Who is asking about the NIST AI RMF: the board, a customer, an investor, a regulator or a parent company? Or, if nobody has asked, which AI decision or incident prompted the question?
Which AI do you develop, which do you integrate from vendors, and which arrives inside software you already use?
Which of those systems influence decisions about people, money, safety or access to services?
Do you place AI systems on the EU market or use AI outputs there, and do customers ask for ISO/IEC 42001?
What exists today: an AI policy, acceptable-use rules, an ISMS or privacy programme, model documentation, test reports, vendor assessments?
Who can decide risk tolerance and approve high-impact systems, and who can give time to assessment, testing and review?
Is there a customer deadline, a contract, a regulatory date or a board meeting to plan around?

With these answers we can scope the work and write a realistic proposal. They frame a discussion; they are not a scored assessment or a judgement on your AI.

Don’t be fooled by certification scams

If it takes ten days and ends in a certificate, it is not NIST AI RMF implementation.

NIST offers the AI Risk Management Framework for voluntary use and certifies no one against it. A market has grown up anyway: "NIST AI RMF certified" seals, "responsible AI" badges sold with a questionnaire, and Profiles scored green without a single system tested. They cost less, until a customer or regulator asks what was assessed, against what, and by whom.

How to choose a credible NIST AI RMF provider

Refuse any "NIST AI RMF certified" seal or "AI RMF compliance certificate" for your organisation. NIST does not certify against the framework; a document with that title is the seller's own product.
Ask who will set risk tolerance and approve high-impact systems. If the provider arrives with those answers already filled in, you are being sold a template, not governance.
Ask how the Current Profile will be evidenced. Interviews describe intentions; ask which inventories, test results, contracts and release decisions will be examined.
Ask whether any AI system will actually be tested, with which metrics, by whom and against which thresholds. Governance without measurement is paperwork.
Find out what training your people receive and where the records will live. Without training and a system of record, the framework leaves with the consultant.
Be wary of "AI RMF compliant in ten days" and a single invoice for framework and certificate. Outcomes have to operate before anyone can say they are achieved, and there is no NIST certificate to invoice for.

All ten warning signs of shortcut certification

What a credible NIST AI RMF implementation always involves

An inventory of the AI you build, integrate and use, with an owner for each system
Leadership setting policy, risk tolerance and accountabilities, in writing
Implementation time in months, not days, scaled to the number and impact of your systems
Impact assessments and tests with defined metrics for the systems that matter most
Release decisions, monitoring and incident handling that have operated, not only been written
Internal audit and a periodic Profile review, with the changes recorded
No certificate, because the AI RMF has none; ISO/IEC 42001 certification by an accredited body if you need one

Sterling's position. Neither Sterling nor NIST certifies organisations against the AI RMF. We build the inventory and the Profiles with your leadership, put the priority outcomes in place with your teams and prepare the evidence; your leadership, internal audit and any independent assessor you appoint judge whether the Target Profile is achieved. No certificate is for sale here, and if an offer you have received is one, we will say so. ISO/IEC 42001 certificates come from certification bodies accredited for that standard; a "NIST AI RMF certified" seal has nothing independent behind it.

Holding or been offered a "NIST AI RMF certified" seal or certificate you are unsure about? Send it to us and we will tell you, at no charge, what it does and does not show.

Keep exploring

More on NIST AI RMF and related standards

Plan your NIST AI RMF implementation with confidence.

Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.

hello@sterling-grc.com

+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page

What would you like to achieve?

Choose a starting point. The enquiry form takes about a minute.

Implement the NIST AI RMF for the first timeUnderstand cost, scope and timingGovern generative AI with the NIST AI 600-1 ProfileAlign the AI RMF with ISO/IEC 42001 or the EU AI Act

Book my free discovery call

Continue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice