# What is the NIST AI RMF?

> The NIST AI Risk Management Framework (AI RMF) is a voluntary US framework for managing AI risk across a system's whole lifecycle.

Source: https://meshin.co/glossary/nist-ai-rmf
Updated: 2026-10-02

---

## Why it comes up

It comes up in almost every vendor security questionnaire, and in board packs once a company runs more than one AI system.

A customer's risk team wants a framework they recognise, not a bespoke description of your process. They want it because it lets them compare you against every other vendor they review. A board wants the same thing for a different reason: a structure to ask questions against, rather than trusting that engineering thought of everything.

## What to do about it

Read the four functions once, properly, rather than skimming a summary. Map what you already do against GOVERN, MAP, MEASURE and MANAGE, and write down the gaps honestly. You do not need to implement all of it before you can talk about it. A short document lists what you have, your review step, and what you still owe against each function. That document beats a claim of full compliance with nothing behind it.