---
title: "Glossary: NIST AI RMF"
canonical_url: "https://tokenobserve.com/glossary/nist-ai-rmf"
published: 2026-09-02
last_updated: 2026-10-21
---

# Glossary: NIST AI RMF

The NIST AI Risk Management Framework (AI RMF 1.0) is voluntary guidance published by the United States National Institute of Standards and Technology in January 2023 for identifying, measuring and managing the risks of AI systems across their life cycle. Its core organises that work into four functions (GOVERN, MAP, MEASURE and MANAGE) and, unlike a management-system standard, it carries no conformity or certification scheme, so an organisation adopts it and evidences its own adoption rather than being certified against it.

## Also called

- NIST AI Risk Management Framework
- AI RMF 1.0
- NIST AI 100-1
- GOVERN MAP MEASURE MANAGE

## In practice

The framework was directed by the National Artificial Intelligence Initiative Act of 2020, developed through open consultation with published drafts and comment periods, and released as NIST AI 100-1 on 26 January 2023. It is deliberately voluntary, sector-neutral and use-case agnostic, and it contains no requirements clauses. Its influence comes from two places instead: it is the vocabulary US federal agencies, insurers and boards already have, and it is named in legislation and procurement language as an acceptable risk-management framework — Colorado’s AI legislation is the example usually cited. That status has a consequence that vendors blur: there is no such thing as being certified to the AI RMF, and ‘NIST compliant’ is not a status any NIST document confers.

Part 1 sets out seven characteristics of trustworthy AI: valid and reliable, safe, secure and resilient, accountable and transparent, explainable and interpretable, privacy-enhanced, and fair with harmful bias managed. Validity and reliability are treated as the foundation — a system that does not work does not become trustworthy by being fair about it — and NIST is explicit that the characteristics trade off against one another, that resolving those trade-offs is a contextual human judgement rather than an optimisation, and that a system can be technically sound and still unacceptable in a particular use.

Part 2 is the Core. GOVERN is cross-cutting rather than sequential: culture, policy, accountability, workforce competence and third-party risk, running through the other three functions continuously instead of preceding them once. MAP establishes context — intended purpose, who is affected, what the system touches, which risks the context implies, and where the boundaries of the deployment sit. MEASURE analyses, benchmarks and tracks the risks MAP identified, with an explicit instruction to document what could not be measured rather than to leave it out. MANAGE allocates resources against the mapped and measured risks — treat, transfer, avoid or accept — and monitors after the action is taken. The functions are broken into categories and subcategories (19 and 72 in version 1.0), and the companion Playbook suggests actions for each. Profiles are the mechanism for applying the framework: a use-case profile describes the framework as applied to a specific application, and a current-and-target profile pair turns the framework into a gap analysis.

The companion most agent teams need is the Generative AI Profile, NIST AI 600-1, published on 26 July 2024. It names twelve risks unique to or amplified by generative AI — confabulation, information integrity, information security, data privacy, harmful bias and homogenisation, human-AI configuration, intellectual property, value chain and component integration, environmental impact and others — and maps suggested actions for each onto the four functions, which makes it far more directly usable for an agent estate than the base framework’s deliberately abstract categories.

Mapped against a runtime control, three of the four functions land squarely and one thins out, and knowing which is which prevents an overclaiming mapping table. GOVERN, MAP and MANAGE are about accountability, context and action: a registry, versioned policies with named owners, budgets, approval gates and a stop control all produce artefacts against them. MEASURE is largely about evaluating models and outcomes, and anything sitting in the request path sees traffic rather than model behaviour — spend, policy match and block rates, and shadow-mode findings are measurable there, while validity, bias and explanation are not, and come from an evaluation stack instead. The framework’s own answer to that is better than a tick: record the risk as mapped, the measurement as not currently feasible, the reason, and the person who accepted it. That instruction — document what you could not measure — is the discipline most control mappings abandon first, and it is the one that makes the rest of the mapping credible.

## Example: A MEASURE row that records what it cannot measure

A team maps its agent estate to the four functions. GOVERN, MAP and MANAGE fill in from the registry, the versioned policy set and the kill switch. Under MEASURE they can produce month-to-date spend by agent, policy match and block rates, and shadow-mode findings for every rule not yet enforcing. They cannot produce anything about whether the models’ answers were correct, because nothing in the request path evaluates them and no evaluation suite is wired up. The framework’s answer is not to leave the row blank and it is certainly not to fill it with a proxy metric that measures something easier. It is to record the risk as mapped, the measurement as not currently feasible, the reason it is not, and the named person who accepted that. A row reading ‘not measured, here is why, here is who owns it’ is a working risk register. A row with a tick in it is a document that will not survive its first audit.

## Routinely confused with

ISO/IEC 42001: The AI RMF is voluntary guidance with no audit and no certificate; ISO/IEC 42001 specifies a management system an accredited body certifies against. They crosswalk cleanly enough that many organisations use both — the RMF to structure the thinking, 42001 to produce the artefact a customer will accept — but only one of them produces something you can put on a supplier questionnaire.

NIST Cybersecurity Framework (CSF 2.0): Same institute, similar function-based shape (CSF 2.0 runs GOVERN, IDENTIFY, PROTECT, DETECT, RESPOND, RECOVER) but a different subject. An AI RMF profile is not a CSF profile, they are separate documents with a published crosswalk between them, and a CSF programme does not cover AI-specific risk because both start with GOVERN.

NIST SP 800-53: 800-53 is a control catalogue that is mandatory for US federal information systems under FISMA, with a defined assessment process. The AI RMF mandates nothing and assesses nothing. Conflating them produces the phrase ‘NIST compliant’, which describes neither document accurately.