Framework
NIST AI Risk Management Framework 1.0
The U.S. National Institute of Standards and Technology framework for managing risks in the design, development, use and evaluation of AI products and services.
The NIST AI RMF 1.0 provides a structured, flexible and measurable approach to AI risk management suitable for organisations of any size and sector. It is voluntary and is not a compliance checklist: it is a framework for integrating AI risk governance into existing enterprise risk and software lifecycle practices. It was released on 26 January 2023.
Current status
- AI RMF 1.0 is being revised as part of the White House AI Action Plan. Its contents and the next version should be checked against NIST before they are cited as current.
- Generative AI Profile. NIST published NIST-AI-600-1, Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile on 26 July 2024. It identifies risks unique to generative AI and proposes actions that align with organisations’ goals and priorities. It is a companion profile, not a replacement for AI RMF 1.0.
- Critical infrastructure profile. NIST released a concept note for an AI RMF Profile on Trustworthy AI in Critical Infrastructure on 7 April 2026.
Core functions
| Function | Purpose | Key outputs |
|---|---|---|
| Govern | Establish organisational culture, policies, accountability structures and risk appetite for AI systems | Risk ownership, policies, workforce training, third-party oversight |
| Map | Understand the AI system’s context: purpose, data sources, model architecture, users, deployment environment | System inventory, data flows, boundary definitions, stakeholder identification |
| Measure | Apply quantitative and qualitative methods to assess AI risks, trustworthiness characteristics and control effectiveness | Metrics, testing results, bias audits, security assessments, red-teaming reports |
| Manage | Prioritise, respond to and monitor AI risks through controls, mitigations and continuous improvement | Risk treatment plans, control implementations, incident response, benefit-risk tradeoffs |
ATLAS connection
The four NIST functions align with the ATLAS operating model: Govern maps to ownership and accountability; Map connects to inventory and classification; Measure corresponds to evidence collection and control validation; Manage links to response, remediation and control improvement. The Shadow AI risk entry explicitly references NIST AI RMF governance requirements.
Primary source: AI RMF → · Generative AI Profile (NIST-AI-600-1) →
Official source: NIST