NIST AI RMF

The framework was directed by the National Artificial Intelligence Initiative Act of 2020, developed through open consultation with published drafts and comment periods, and released as NIST AI 100-1 on 26 January 2023. It is deliberately voluntary, sector-neutral and use-case agnostic, and it contains no requirements clauses. Its influence comes from two places instead: it is the vocabulary US federal agencies, insurers and boards already have, and it is named in legislation and procurement language as an acceptable risk-management framework — Colorado’s AI legislation is the example usually cited. That status has a consequence worth stating early, because vendors blur it: there is no such thing as being certified to the AI RMF, and ‘NIST compliant’ is not a status any NIST document confers.

Part 1 sets out seven characteristics of trustworthy AI: valid and reliable, safe, secure and resilient, accountable and transparent, explainable and interpretable, privacy-enhanced, and fair with harmful bias managed. Validity and reliability are treated as the foundation — a system that does not work does not become trustworthy by being fair about it — and NIST is explicit that the characteristics trade off against one another, that resolving those trade-offs is a contextual human judgement rather than an optimisation, and that a system can be technically sound and still unacceptable in a particular use.

Part 2 is the Core. GOVERN is cross-cutting rather than sequential: culture, policy, accountability, workforce competence and third-party risk, running through the other three functions continuously instead of preceding them once. MAP establishes context — intended purpose, who is affected, what the system touches, which risks the context implies, and where the boundaries of the deployment actually sit. MEASURE analyses, benchmarks and tracks the risks MAP identified, with an explicit instruction to document what could not be measured rather than to leave it out. MANAGE allocates resources against the mapped and measured risks — treat, transfer, avoid or accept — and monitors after the action is taken. The functions are broken into categories and subcategories (19 and 72 in version 1.0), and the companion Playbook suggests actions for each. Profiles are the mechanism for applying the framework: a use-case profile describes the framework as applied to a specific application, and a current-and-target profile pair turns the framework into a gap analysis.

The companion most agent teams actually need is the Generative AI Profile, NIST AI 600-1, published on 26 July 2024. It names twelve risks unique to or amplified by generative AI — confabulation, information integrity, information security, data privacy, harmful bias and homogenisation, human-AI configuration, intellectual property, value chain and component integration, environmental impact and others — and maps suggested actions for each onto the four functions, which makes it far more directly usable for an agent estate than the base framework’s deliberately abstract categories.

Mapped against a runtime control, three of the four functions land squarely and one thins out, and knowing which is which prevents an overclaiming mapping table. GOVERN, MAP and MANAGE are about accountability, context and action: a registry, versioned policies with named owners, budgets, approval gates and a stop control all produce artefacts against them. MEASURE is largely about evaluating models and outcomes, and anything sitting in the request path sees traffic rather than model behaviour — spend, policy match and block rates, and shadow-mode findings are measurable there, while validity, bias and explanation are not, and come from an evaluation stack instead. The framework’s own answer to that is better than a tick: record the risk as mapped, the measurement as not currently feasible, the reason, and the person who accepted it. That instruction — document what you could not measure — is the discipline most control mappings abandon first, and it is the one that makes the rest of the mapping credible.