NIST AI RMF

Think of it as a structured set of questions rather than a rulebook. A bank adding an AI assistant to its loan desk would use Govern to decide who owns the system and how much risk it will accept, Map to write down the context (who is affected, what the model is for, what could go wrong), Measure to test for problems such as errors, bias and security weaknesses, and Manage to act on what it found, including deciding not to deploy.

NIST released AI RMF 1.0 on January 26, 2023, and describes it as intended for voluntary use. On July 26, 2024 it added a Generative AI Profile (NIST AI 600-1), which applies the same functions to risks that are specific to or made worse by generative models, such as confabulation (confident, false output; see AI hallucination). The framework also lists the characteristics of trustworthy AI: valid and reliable, safe, secure and resilient, accountable and transparent, explainable and interpretable, privacy-enhanced, and fair with harmful bias managed.

The framework is not a law, and it does not sort systems into legal risk tiers the way the EU AI Act does. Its value is a shared vocabulary: procurement questionnaires, internal policies and auditors often point to it, so it gives AI governance and responsible AI programs a common structure. Organizations that want an auditable management system often pair it with ISO/IEC 42001.