# NIST AI Risk Management Framework (AI RMF 1.0) and Generative AI Profile

- **Record type**: Policy instrument
- **Jurisdiction**: United States
- **Instrument type**: Framework
- **Status**: Voluntary standard
- **Binding**: No — guidance, strategy or standard
- **Issuing body**: National Institute of Standards and Technology (US Department of Commerce)
- **Adopted**: 2023-01-26
- **Published**: 2023-01-26

## In brief

The NIST AI RMF is a non-binding framework of the United States, issued by the National Institute of Standards and Technology (US Department of Commerce). Its current status is voluntary standard. Voluntary and sector-agnostic; usable by any organisation designing, developing, deploying or evaluating AI systems. 4 obligations are recorded against it, each with its source reference. Penalties: None; voluntary.

## Summary

The NIST AI Risk Management Framework is a voluntary framework for managing risks to individuals, organisations and society from AI. It organises practices into four functions: Govern, Map, Measure and Manage, and describes characteristics of trustworthy AI such as validity, safety, security, accountability, explainability, privacy and fairness. The July 2024 Generative AI Profile (NIST AI 600-1) adds risks and suggested actions specific to generative AI. Many US procurement requirements and state laws reference the framework as a recognised approach.

## Scope

Voluntary and sector-agnostic; usable by any organisation designing, developing, deploying or evaluating AI systems. It creates no legal obligations, but Colorado SB 24-205 and federal procurement guidance treat conformity with the framework as evidence of reasonable care.

## Who it applies to

Any organisation that chooses to adopt it; referenced by regulators, state laws and customers.

## What organisations must do

Nothing is mandatory. Organisations adopting it typically establish governance (Govern), document context and impacts (Map), test and monitor (Measure), and prioritise and respond to risks (Manage), using the Playbook.

## Key dates

AI RMF 1.0 released 26 January 2023; Generative AI Profile (NIST AI 600-1) released 26 July 2024.

## Penalties

None; voluntary.

## Obligations recorded against this instrument (4)

- **Establish AI governance policies, roles and accountability (Govern)** (GOVERN function) — Govern covers policies and procedures for AI risk, roles and responsibilities, workforce diversity and training, organisational culture, stakeholder engagement, and third-party risk management. It is the cross-cutting function that supports the other three.
  - Binding: no
  - Record: https://aipolicytracker.org/obligations/us-nist-ai-rmf-govern
- **Map context, intended use and potential impacts (Map)** (MAP function) — Map establishes the context: intended purposes, users, deployment settings, legal requirements, risk categorisation, benefits and costs, and impacts on individuals, groups, communities and society.
  - Binding: no
  - Record: https://aipolicytracker.org/obligations/us-nist-ai-rmf-map
- **Measure and test trustworthiness characteristics (Measure)** (MEASURE function) — Measure covers selecting metrics and test methods, evaluating validity, safety, security, resilience, explainability, privacy, fairness and bias, and monitoring these over time, including through independent review and red-teaming for generative AI.
  - Binding: no
  - Record: https://aipolicytracker.org/obligations/us-nist-ai-rmf-measure
- **Prioritise, respond to and monitor AI risks (Manage)** (MANAGE function) — Manage allocates resources to mapped and measured risks, plans responses including decommissioning, manages third-party risks, and documents post-deployment monitoring, incident response and communication.
  - Binding: no
  - Record: https://aipolicytracker.org/obligations/us-nist-ai-rmf-manage

## Provenance

- **Permanent id**: AIPT-POL-0233 (https://aipolicytracker.org/id/AIPT-POL-0233; never changes or gets reused)
- **Record page**: https://aipolicytracker.org/policies/us-nist-ai-rmf
- **Official source**: https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.100-1.pdf
- **Source document**: Artificial Intelligence Risk Management Framework (AI RMF 1.0)
- **Published by**: National Institute of Standards and Technology
- **Provision**: NIST AI 100-1
- **Review status**: verified
- **Confidence**: high
- **Facts last confirmed**: 2026-09-26
- **Confirmed by**: Bhaskar Bhatt (see https://aipolicytracker.org/reviewers)
- **Retrieved**: 2026-10-27
- **Licence**: https://creativecommons.org/licenses/by/4.0/
- **Cite as**: AIPolicyTracker (2026). "NIST AI Risk Management Framework (AI RMF 1.0) and Generative AI Profile" [AIPT-POL-0233, record version 1, verified 26 September 2026 by Bhaskar Bhatt]. https://aipolicytracker.org/id/AIPT-POL-0233 (accessed 27 October 2026).

> This record is a structured summary with a link to the official text. It is not legal advice. Open the official source before relying on any date or duty. How current each record type must be is published at https://aipolicytracker.org/verification; what a record must carry at all is published at https://aipolicytracker.org/coverage.