How to Implement the NIST AI Risk Management Framework
Have you heard of the NIST AI Risk Management Framework? Whether you decide to live by it or not, understanding it is a strong step towards owning your AI lifecycle.
The NIST AI Risk Management Framework (AI RMF) is a voluntary, non-certifiable framework for managing the risks of AI systems across their full lifecycle. NIST released AI RMF 1.0 on January 26, 2023 and organized it around four core functions: Govern, Map, Measure, and Manage. Implementation means inventorying AI systems, assigning governance owners, mapping context and impacts, testing against seven trustworthy AI characteristics, and managing risks through response and monitoring. Version 1.0 remains the current guidance while NIST revises the framework under the White House AI Action Plan.
A common mistake is treating the AI RMF as a certification to buy or a checklist to finish. The framework describes outcomes, and you decide how to reach them with your own systems, data, and risk tolerance. Waiting for the revision is a poor reason to stall, because teams that already know which AI they run will absorb any update with far less guesswork.
What Is the NIST AI Risk Management Framework (AI RMF)?
The NIST AI Risk Management Framework is voluntary guidance that works for organizations of any size or sector. In the official AI RMF 1.0 publication, NIST calls it “voluntary, rights-preserving, non-sector-specific, and use-case agnostic.” A restaurant chain running demand forecasts and a medtech firm validating a diagnostic model can use the same framework.
No audit body certifies against it. Nobody can sell you a “NIST AI RMF certified” badge. What you get is a shared vocabulary for trustworthy AI and a structure for showing your board that risk has an owner.
Two terms appear on nearly every page. The AI lifecycle covers each stage of a system, from planning and data collection through deployment, operation, and retirement. AI actors are the people and organizations involved at each stage, including developers, deployers, operators, and the communities a system affects.
The practical consequence for an IT leader is shared ownership. Your vendors, data engineers, and business users are all AI actors, and each one holds part of the risk at some point in the AI lifecycle. The short version fits in six points.
Key Takeaways on the NIST AI RMF for IT and Risk Leaders
The NIST AI RMF gives IT and risk leaders a voluntary, four-function structure for managing AI risk, and six points matter most:
AI-Enabled Breaches Average $6M: Why AI Risk Management Matters
AI risk management matters because AI now sits on both sides of a breach: attackers use it as a tool, and they also target AI models and applications directly.
That figure sits well above the record $4.99M global average breach cost in IBM's 2026 Cost of a Data Breach findings.
Four AI Risk Categories Backed by Recent Data
The four AI risk categories below summarize the most recent public evidence, along with the AI RMF function that does the most work against each:
| Risk category | What the evidence shows | AI RMF function most involved |
|---|---|---|
| AI-enabled attacks | 1 in 4 malicious breaches were AI-enabled, up 56% year over year, costing about $6M on average (IBM’s 2026 study on AI-enabled breaches) | Manage |
| Attacks on AI models and apps | More than 20% of organizations reported a breach targeting AI. Compromised APIs, apps, or plug-ins and cloud misconfigurations led, at 27% each (IBM’s findings on breaches targeting AI) | Measure |
| Documented AI incidents | 362 incidents in 2025, up from 233 in 2024 (Stanford AI Index 2026 incident data) | Govern |
| Generative AI risks | 12 risks new to or worsened by generative AI, including confabulation (CASRAI’s guide to the Generative AI Profile) | Map |
Reading the AI Breach Numbers Correctly
AI-enabled breaches and breaches targeting AI measure different things. The first counts attacks where criminals use AI. The second counts attacks on your models, apps, and plug-ins, and confusing the two leads to the wrong controls.
The cost baseline was already steep. The global average cost of a data breach hit a record $4.99M in IBM’s 2026 Cost of a Data Breach findings. So an AI-enabled breach at about $6M lands well above a number that was already painful.
The incident count needs a caveat. The AI Incident Database captures publicly documented incidents only, so it undercounts what happens inside companies. UNU’s summary of the 2026 Stanford AI Index put the broader problem plainly: “Responsible AI is not keeping pace with AI capability.”
Quick win: pull the past year of security incidents and tag any that involved an AI tool, model, or plug-in. That short list tells you where Map and Measure work should start. It also explains why NIST built the framework in the first place.
From AI RMF 1.0 to Revision: How NIST Built the Framework
NIST released the AI Risk Management Framework 1.0, published as NIST AI 100-1, on January 26, 2023, according to IAPP’s report on the AI RMF 1.0 launch. The framework targeted trustworthy AI without tying itself to any one sector. Since then it has gathered companion documents and political pressure in roughly equal measure.
Even after Executive Order 14110 was rescinded, the Generative AI Profile stayed on NIST's site, and version 1.0 remains current guidance.
The Generative AI Profile and Executive Order 14110
NIST released the Generative AI Profile, NIST AI 600-1, on July 26, 2024. ModelOp’s AI RMF overview notes it was written partly to fulfill Executive Order 14110 of October 30, 2023.
That order was rescinded in January 2025, yet the profile still appears on NIST’s site, as an arXiv paper tracking the profile’s status confirms. The policy moved. The guidance stayed useful, so don’t scrap generative AI controls because the order behind them was rescinded.
The 2025 AI Action Plan and the Pending Revision
The White House released “Winning the Race: America’s AI Action Plan” on July 23, 2025, and it recommends revising the NIST AI RMF, per Skadden’s analysis of the AI Action Plan. The plan calls for removing references to “misinformation, Diversity, Equity, and Inclusion, and climate change.”
As of 2026, no AI RMF 2.0 has been formally released, according to IS Partners’ review of AI RMF updates. Our recommendation is to run on 1.0 now and watch for the revision. Teams that wait for 2.0 will just start late.
Whatever the revision changes, the document’s layout is the place to start.
Structure of the NIST AI RMF: Part 1, Part 2, and the Core
The NIST AI RMF is split into two parts: Part 1 frames AI risk and trustworthiness, and Part 2 contains the Core and profiles. Part 1 explains how to think about AI risk, who the audience is, and how AI risks differ from traditional software risks. It also defines the trustworthy AI characteristics.
Part 2 is where the operating work lives. Securiti’s breakdown of the AI RMF Core lays out the four functions, Govern, Map, Measure, and Manage, each broken into categories and subcategories of outcomes.
Subcategories are the useful unit for planning. Each one describes an outcome a team can own, such as documenting a system’s intended purpose. Profiles sit on top of the Core and tailor those outcomes to a specific use case, sector, or risk tolerance.
Map your existing controls at the subcategory level. Function-level mapping looks tidy on a slide and tells an auditor almost nothing. The four functions carry most of the weight, so each gets its own breakdown next.
The Four Core Functions: Govern, Map, Measure, Manage
The NIST AI RMF Core organizes AI risk work into four functions, Govern, Map, Measure, and Manage, with Govern applying across the other three. The cycle is iterative. Teams loop through Map, Measure, and Manage many times over the AI lifecycle, while Govern keeps that loop accountable.
Teams loop through Map, Measure, and Manage many times over the AI lifecycle, while Govern keeps that loop accountable.
Govern Sets Ownership, Policy, and Risk Culture
The Govern function establishes the policies, roles, accountability, and culture an organization needs to manage AI risk. It answers who approves new AI use, who owns each system, how third-party models get vetted, and how decisions get recorded.
Most organizations already have pieces of this in security, privacy, or data governance. Extend those structures instead of creating a parallel committee. A clear enterprise AI governance framework connects AI decisions to the groups your teams already trust.
Map Establishes Context Before Anything Gets Measured
The Map function establishes the context for each AI system, including its purpose, users, data, AI actors, and potential impacts on people and the business. A demand-forecasting model and a hiring screener might share a vendor, yet their impacts differ completely.
Map makes that difference explicit before anyone writes a test plan. Skip it, and Measure ends up testing the wrong things very precisely.
Measure Tests AI Systems Against Trustworthiness Criteria
The Measure function uses quantitative and qualitative methods to analyze, assess, benchmark, and monitor AI risks and trustworthiness. In practice, that means bias testing, accuracy and drift checks, red-teaming, and security testing of the APIs and plug-ins around a model.
Pick metrics you can rerun. A one-time test report ages badly the moment the model or its data changes.
Manage Prioritizes Risks and Responds to Incidents
The Manage function allocates resources to the risks identified in Map and Measure and defines how the organization responds, recovers, and communicates when something goes wrong. It also covers retiring systems that no longer fit your risk tolerance.
AI agents raise the stakes because they take actions on their own. Tools such as Microsoft Agent 365 for governing AI agents belong in Manage planning for that reason. All four functions point back to one shared definition of good.
Seven Characteristics of Trustworthy AI in the NIST AI RMF
NIST lists seven characteristics of trustworthy AI, and every AI RMF function points back to them. The seven characteristics, as named in NIST’s testimony on AI risk management foundations, are:
These characteristics trade off against each other. A more interpretable model may give up some accuracy, and tighter privacy controls can limit the data available for bias testing. The framework expects you to make those tradeoffs on purpose and write down why.
Weight them by use case. Valid and reliable plus safe will dominate a medtech diagnostic tool, while fairness and transparency may weigh more in a restaurant chain’s personalized loyalty offers.
Score each production system against all seven this quarter, even roughly. A red, yellow, and green grid gives leadership more clarity than a long policy document. It also sets up the profiles NIST built for specific technologies.
AI RMF Profiles, Playbook, Roadmap, and Crosswalks
AI RMF profiles and NIST’s companion resources turn the framework’s general outcomes into specific actions for particular technologies, sectors, and use cases.
The Generative AI Profile (NIST AI 600-1)
The Generative AI Profile identifies 12 risks that are new to, or made worse by, generative AI, according to CASRAI’s summary of NIST AI 600-1. They include confabulation, CBRN information or capabilities, information integrity, and value chain and component integration.
Confabulation is the formal term for a model confidently inventing facts. For any team putting a chatbot in front of customers or field technicians, that one risk justifies reading the profile.
The profile includes more than 200 suggested actions, each mapped to a Govern, Map, Measure, or Manage subcategory, per WitnessAI’s overview of the Generative AI Profile. It adds to AI RMF 1.0 and does not replace it.
The AI RMF Playbook, Roadmap, and Crosswalks
The AI RMF Playbook is a NIST companion resource with suggested actions for implementing the framework, published on NIST’s AI Resource Center Playbook page. Treat it as a menu. Nobody expects you to complete every action, and teams that try usually stall.
NIST also maintains an AI RMF Roadmap of priority work and crosswalks that align the framework with other standards. If your security program already runs on NIST CSF or ISO 27001, the crosswalks cut down duplicate mapping work.
Profiles Still in Development
NIST released a concept note on April 7, 2026, for an “AI RMF Profile on Trustworthy AI in Critical Infrastructure.” NIST’s critical infrastructure concept note is a starting point and community of interest, not a finished profile. Energy operators should follow it closely.
Separately, NIST IR 8596, the Cyber AI Profile, is an Initial Preliminary Draft that sits under the Cybersecurity Framework (CSF 2.0). The NIST IR 8596 draft notes the AI RMF “is currently in revision and will be included in a future version.” Security teams on CSF 2.0 should track both documents together.
Resources only help once someone owns the work. That’s where implementation starts.
How to Implement the NIST AI Risk Management Framework in Six Steps
Implementing the NIST AI Risk Management Framework follows six steps: inventory AI systems, set governance, map context, measure risk, manage and respond, and monitor continuously. The steps, in order, are:
Use the AI RMF Playbook as a task library for steps two through five, and loop back to Map when a system's context shifts.
Use the AI RMF Playbook as your task library for steps two through five. Teams that already run enterprise risk programs can fold AI into them, an approach covered in our article on enterprise risk management powered by AI.
Build with purpose, not patchwork. A framework bolted onto scattered spreadsheets and one-off reviews won’t survive the first serious incident.
After 90 days, measurable progress looks like this: every production AI system has a named owner, a mapped context, and at least one repeatable test. That’s also when the framework’s limits start to show.
Limitations of the NIST AI RMF: No Enforcement, Moving Targets
The NIST AI RMF has real limitations: no enforcement, no certification, an active revision of version 1.0, and no direct tie to state AI laws.
Voluntary Guidance in the Middle of a Revision
Voluntary cuts both ways. The flexibility is useful, but nothing forces a business unit to follow your AI policy unless leadership makes it stick.
Revision adds planning risk. NIST states on its AI RMF program page that version 1.0 “is being revised as part of the White House AI Action Plan,” so some terms and references may change.
Shifting State Laws and Thin Resources
On May 14, 2026, Colorado’s governor signed SB 26-189, which repealed and replaced the Colorado AI Act before it took effect. Davis Wright Tremaine’s analysis of the repeal notes the new law covers “automated decision-making technology” and takes effect January 1, 2027.
Any team that built a compliance plan around the original statute now has rework. Anchor your program to the four AI RMF functions, then map each new law onto them.
Resources are the quieter constraint. Many mid-market companies lack a dedicated AI risk team. Apply the full framework to high-impact systems and a lighter profile to low-risk internal tools.
Quick Answers About the NIST AI RMF
The NIST AI RMF raises a handful of recurring questions, and these short answers reflect its status as of October 2026.
What are the four core functions of the NIST AI RMF?
The four core functions of the NIST AI RMF are Govern, Map, Measure, and Manage. Govern sets policy and accountability, Map establishes context, Measure tests and tracks risk, and Manage prioritizes and responds.
Is the NIST AI RMF mandatory, or can you get certified?
The NIST AI RMF is voluntary guidance, and there is no certification. Organizations adopt it to structure their AI risk programs around a common, recognized vocabulary.
Has NIST released an AI RMF 2.0?
NIST has not formally released an AI RMF 2.0 as of 2026, according to IS Partners’ summary of AI RMF changes. Version 1.0 remains current while NIST revises it.
Does the Generative AI Profile replace AI RMF 1.0?
The Generative AI Profile, NIST AI 600-1, adds to AI RMF 1.0 and does not replace it. Use it alongside the Core whenever a system generates text, images, code, or other content.
Next Steps: Put the NIST AI RMF to Work This Week
The NIST AI RMF rewards teams that start small and keep going, and the first week sets the pace. These five steps get you moving:
None of this requires waiting on Washington. It requires knowing what AI you run and who answers for it. Talk to a Smartbridge expert about responsible AI governance and turn these five steps into a program your auditors and engineers can both work with.
