The NIST AI Risk Management Framework (AI RMF) is the United States’ flagship framework for managing risks across the entire AI lifecycle. It is one of the most influential AI governance documents in the world and is widely used by governments, enterprises, and security teams to build trustworthy, safe, and responsible AI systems.
It was released by the National Institute of Standards and Technology (NIST) in January 2023, with ongoing updates and profiles (including Generative AI and Agentic AI profiles).
A voluntary, non‑regulatory framework that helps organisations:
Identify AI‑related risks
Assess and measure those risks
Implement controls and safeguards
Monitor and improve AI systems over time
It is designed to be technology‑neutral, sector‑agnostic, and usable by organisations of any size.
To help organisations build trustworthy AI by embedding principles such as:
Safety
Security
Privacy
Transparency
Accountability
Fairness
Reliability
NIST structures the framework around four operational functions:
Build the organisational foundations for AI risk management. Includes policies, roles, accountability, documentation, and oversight.
Understand the context of the AI system. Includes intended use, stakeholders, impacts, and risk scenarios.
Analyse and evaluate AI risks. Includes testing, metrics, validation, monitoring, and evaluation.
Act on the risks identified. Includes mitigation, deployment controls, continuous improvement, and incident response.
These functions are iterative, not linear — they apply throughout the AI lifecycle.
The NIST AI RMF is important because:
It provides a structured, defensible approach to AI risk
It aligns with global standards (ISO 42001, EU AI Act, MITRE ATLAS, OWASP AI Security)
It is widely used in public sector, finance, healthcare, and critical infrastructure
It helps organisations prepare for regulatory compliance
It supports both traditional ML and Generative AI / LLM systems
It is also the foundation for many AI assurance, AI governance, and AI security programmes.