NIST AI RMF
What it means
What is the NIST AI RMF?
The NIST AI Risk Management Framework (AI RMF) is a voluntary US framework, published in January 2023, for identifying and managing an AI system's risks across its design, development and use.
The framework sets out four functions an organisation applies to an AI system. GOVERN covers policy and accountability, while MAP covers understanding context and risk. Testing and metrics fall under MEASURE. Acting on what it found is MANAGE's job.
It is not a law, and it is not sector specific. A bank, a hospital and a ten-person startup can all use the same structure. US procurement teams, and increasingly non-US ones, ask about it. They ask because the framework gives a common vocabulary for a question that used to have no fixed answer. That question is how you know your company actually manages an AI system's risks, not just discusses them once.
In practice, adopting the framework means someone can point to a specific function, and to a specific piece of evidence behind it. That beats a general assurance that everything is under control.
Published · Updated
In practice
Why it comes up
It comes up in almost every vendor security questionnaire, and in board packs once a company runs more than one AI system.
A customer’s risk team wants a framework they recognise, not a bespoke description of your process. They want it because it lets them compare you against every other vendor they review. A board wants the same thing for a different reason: a structure to ask questions against, rather than trusting that engineering thought of everything.
What to do about it
Read the four functions once, properly, rather than skimming a summary. Map what you already do against GOVERN, MAP, MEASURE and MANAGE, and write down the gaps honestly. You do not need to implement all of it before you can talk about it. A short document lists what you have, your review step, and what you still owe against each function. That document beats a claim of full compliance with nothing behind it.
Sources and neighbours
Sources
Related terms