NIST AI RMF: requirements, deadlines and compliance actions
NIST AI Risk Management Framework (AI RMF 1.0) and Generative AI Profile
What this label means
- Verified
- — a named reviewer opened the official source and confirmed the record; the date and the reviewer are shown.
- Pending review
- — linked to the official source and in the queue for a reviewer to confirm.
- Source-linked
- — linked to the official source, not yet confirmed by a reviewer.
On this page 10 sections
In brief
The NIST AI RMF is a non-binding framework of the United States, issued by the National Institute of Standards and Technology (US Department of Commerce). Its current status is voluntary standard. Voluntary and sector-agnostic; usable by any organisation designing, developing, deploying or evaluating AI systems. 4 obligations are recorded against it, each with its source reference. Penalties: None; voluntary.
- Jurisdiction
- United States
- Instrument type
- Framework
- Status
- Voluntary standard
- Legal force
- Non-binding (guidance, strategy or standard)
- Issuing body
- National Institute of Standards and Technology (US Department of Commerce)
- Adopted
- 26 January 2023
- Published
- 26 January 2023
- Obligations recorded
- 4
- Source reference
- NIST AI 100-1
- Official source
- Artificial Intelligence Risk Management Framework (AI RMF 1.0)
- Verification
- Verified against the official source 26 Sep 2026
What is the NIST AI RMF?
The NIST AI Risk Management Framework is a voluntary framework for managing risks to individuals, organisations and society from AI. It organises practices into four functions: Govern, Map, Measure and Manage, and describes characteristics of trustworthy AI such as validity, safety, security, accountability, explainability, privacy and fairness. The July 2024 Generative AI Profile (NIST AI 600-1) adds risks and suggested actions specific to generative AI. Many US procurement requirements and state laws reference the framework as a recognised approach.
Who does it apply to?
Voluntary and sector-agnostic; usable by any organisation designing, developing, deploying or evaluating AI systems. It creates no legal obligations, but Colorado SB 24-205 and federal procurement guidance treat conformity with the framework as evidence of reasonable care.
Any organisation that chooses to adopt it; referenced by regulators, state laws and customers.
- Actors
- Provider / developerDeployer / user organisationPublic authority / government bodyGeneral-purpose AI model provider
- Sectors
- Cross-sector / all sectors
- AI use cases
- AI in hiring and employmentAI in finance, credit and insuranceGenerative AI and foundation modelsSafety-critical and infrastructure
- Risk categories
- Not classified by the instrument
When do the requirements apply?
AI RMF 1.0 released 26 January 2023; Generative AI Profile (NIST AI 600-1) released 26 July 2024.
What must organisations do?
Nothing is mandatory. Organisations adopting it typically establish governance (Govern), document context and impacts (Map), test and monitor (Measure), and prioritise and respond to risks (Manage), using the Playbook.
Each duty is one line: open it for the summary, practical action and evidence, or go to its own page.
Voluntary Establish AI governance policies, roles and accountability (Govern) Provider / developer, Deployer / user organisation
Govern covers policies and procedures for AI risk, roles and responsibilities, workforce diversity and training, organisational culture, stakeholder engagement, and third-party risk management. It is the cross-cutting function that supports the other three.
Practical action: Adopt an AI policy, assign owners, and set a risk-tolerance statement approved by leadership.
Evidence examples: AI governance policy
Framework mapping (original, editorial): ISO/IEC 42001:2023 Clauses 4–5 and 7
Open the obligation page →GOVERN function Source-linked (a factual check against the official source, not a legal review)
Voluntary Map context, intended use and potential impacts (Map) Provider / developer, Deployer / user organisation
Map establishes the context: intended purposes, users, deployment settings, legal requirements, risk categorisation, benefits and costs, and impacts on individuals, groups, communities and society.
Practical action: Produce a system card or context document before development starts.
Evidence examples: AI system context and impact document
Framework mapping (original, editorial): ISO/IEC 42001:2023 Clause 6.1.4 AI system impact assessment
Open the obligation page →MAP function Source-linked (a factual check against the official source, not a legal review)
Voluntary Measure and test trustworthiness characteristics (Measure) Provider / developer
Measure covers selecting metrics and test methods, evaluating validity, safety, security, resilience, explainability, privacy, fairness and bias, and monitoring these over time, including through independent review and red-teaming for generative AI.
Practical action: Define a test plan with metrics for each trustworthiness characteristic and record results.
Evidence examples: Evaluation and red-team reports
Framework mapping (original, editorial): ISO/IEC 42001:2023 Clause 9 Performance evaluation; Annex A verification controls
Open the obligation page →MEASURE function Source-linked (a factual check against the official source, not a legal review)
Voluntary Prioritise, respond to and monitor AI risks (Manage) Provider / developer, Deployer / user organisation
Manage allocates resources to mapped and measured risks, plans responses including decommissioning, manages third-party risks, and documents post-deployment monitoring, incident response and communication.
Practical action: Maintain a risk-treatment plan and an incident and monitoring log per system.
Evidence examples: Risk treatment and monitoring plan
Framework mapping (original, editorial): ISO/IEC 42001:2023 Clauses 8 and 10
Open the obligation page →MANAGE function Source-linked (a factual check against the official source, not a legal review)
What are the penalties?
None; voluntary.
Key sections and articles
| Reference | Title | Summary |
|---|---|---|
| Part 1 | Foundational information | Framing AI risk, audiences, harms and trustworthiness characteristics. |
| Part 2: Core | Govern, Map, Measure, Manage | The four functions with categories and subcategories. |
| NIST AI 600-1 | Generative AI Profile | Twelve generative-AI risk areas and suggested actions. |
Official sources
-
Artificial Intelligence Risk Management Framework (AI RMF 1.0), NIST AI 100-1
National Institute of Standards and Technology · 26 Jan 2023 · Tier 1 source
-
AI RMF: Generative Artificial Intelligence Profile, NIST AI 600-1
National Institute of Standards and Technology · 26 Jul 2024 · Tier 1 source
-
AI RMF programme page and Playbook
National Institute of Standards and Technology · Tier 1 source
Cite this record
AIPolicyTracker (2026). “NIST AI RMF” [AIPT-POL-0233, record version 1, verified 26 September 2026 by Bhaskar Bhatt]. https://aipolicytracker.org/id/AIPT-POL-0233 (accessed 27 October 2026). Data licensed CC BY 4.0.
Permanent id AIPT-POL-0233: it never changes or gets reused, and its address keeps working if this page moves.
Cite the official text alongside it: Artificial Intelligence Risk Management Framework (AI RMF 1.0), National Institute of Standards and Technology, https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.100-1.pdf.
BibTeX
@misc{aipolicytracker2026_nistairmf,
author = {{AIPolicyTracker}},
title = {{NIST AI RMF}},
year = {2026},
howpublished = {\url{https://aipolicytracker.org/policies/us-nist-ai-rmf}},
url = {https://aipolicytracker.org/policies/us-nist-ai-rmf},
urldate = {2026-10-27},
note = {Data licensed CC BY 4.0. Accessed 27 October 2026}
}
Using this in a product? Commercial use is allowed under CC BY 4.0, with attribution. Ask about an SLA-backed feed or a white-label licence.
Add a status badge to your site or README
It shows the status and review state as recorded here and updates when the record does.
Markdown
[](https://aipolicytracker.org/id/AIPT-POL-0233)HTML
<a href="https://aipolicytracker.org/id/AIPT-POL-0233"><img src="https://aipolicytracker.org/badges/us-nist-ai-rmf.svg" alt="AIPolicyTracker: NIST AI Risk Management Framework (AI RMF 1.0) and Generative AI Profile, Voluntary standard · verified 26 Sep 2026" height="20"></a>Change history
Record history
No change to this record's tracked fields has been recorded since 15 October 2026, when field-level history began.
Record version 1: Initial structured record. Every earlier wording is in the GitHub repository.
Frequently asked questions
Is the NIST AI RMF mandatory?
No. It is voluntary. Some laws and procurement rules reference it, and Colorado's AI Act treats compliance with a recognised framework such as the AI RMF as relevant to the "reasonable care" defence.
How does the NIST AI RMF relate to ISO/IEC 42001?
Both are voluntary. The AI RMF is a risk-management framework with four functions; ISO/IEC 42001 is a certifiable management-system standard. Organisations often use the AI RMF as the practice catalogue inside an ISO/IEC 42001 management system.
Is the NIST AI RMF in force?
The NIST AI RMF has the status "voluntary standard"; it is not a binding law in force.
Is the NIST AI RMF legally binding?
No. The NIST AI RMF is a framework; it sets expectations rather than legal requirements, unless another instrument gives it force.
Who does the NIST AI RMF apply to?
Voluntary and sector-agnostic; usable by any organisation designing, developing, deploying or evaluating AI systems. It creates no legal obligations, but Colorado SB 24-205 and federal procurement guidance treat conformity with the framework as evidence of reasonable care.
When does the NIST AI RMF apply?
AI RMF 1.0 released 26 January 2023; Generative AI Profile (NIST AI 600-1) released 26 July 2024.
What must organisations do under the NIST AI RMF?
Nothing is mandatory. Organisations adopting it typically establish governance (Govern), document context and impacts (Map), test and monitor (Measure), and prioritise and respond to risks (Manage), using the Playbook.
What are the penalties under the NIST AI RMF?
None; voluntary.
Where is the official text of the NIST AI RMF?
The official text is published by National Institute of Standards and Technology at https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.100-1.pdf (Artificial Intelligence Risk Management Framework (AI RMF 1.0)). This record links to it and is checked against it.
Disclaimer: informational only, not legal advice. Verify every claim against the linked official sources and consult a qualified lawyer before acting.