Manage AI risks with the NIST AI Risk Management Framework

The NIST AI Risk Management Framework (AI RMF 1.0), published in January 2023, is a voluntary framework that helps organizations manage risks throughout the AI lifecycle. It provides guidance for incorporating trustworthiness considerations into AI system design, development, use, and evaluation. The framework is organized around four core functions: GOVERN, MAP, MEASURE, and MANAGE.

NIST AI RMF is designed for all organizations that design, develop, deploy, or use AI systems. This includes technology companies building AI products, enterprises deploying AI for business operations, healthcare and financial institutions using AI for decision-making, government agencies, and any organization seeking to establish responsible AI practices. The framework is flexible and can be tailored to organizations of any size.

NIST AI RMF is voluntary for private sector organizations. However, adoption is increasingly expected by customers, partners, and regulators. Federal agencies may be required to align with AI RMF under Executive Orders on AI governance. Organizations subject to the EU AI Act may find AI RMF helpful for demonstrating compliance with risk management requirements.

The framework organizes AI risk management into four functions: GOVERN establishes organizational culture, structures, and processes for AI governance. MAP identifies context, stakeholders, and potential risks for each AI system. MEASURE employs methods and metrics to assess risks and trustworthiness. MANAGE prioritizes risks and implements treatment strategies. Each function contains categories and subcategories of recommended practices.

NIST AI RMF defines seven key characteristics of trustworthy AI: Valid & Reliable (performs as intended), Safe (does not create unsafe conditions), Secure & Resilient (resists attacks and recovers from failures), Accountable & Transparent (decisions can be explained and attributed), Explainable & Interpretable (outputs are understandable), Privacy-Enhanced (protects individual privacy), and Fair with Managed Bias (minimizes harmful discrimination).

NIST AI RMF and ISO 42001 are complementary frameworks. ISO 42001 provides a formal AI management system standard with certification, while NIST AI RMF offers detailed risk management guidance. Organizations can use AI RMF practices to implement ISO 42001 requirements. Evidr supports both frameworks with shared controls and unified documentation.

NIST AI RMF provides risk management practices that align with EU AI Act requirements. While the EU AI Act is legally binding for AI systems in the EU market, AI RMF offers voluntary guidance applicable globally. Organizations using AI RMF will be better prepared for EU AI Act compliance, particularly for high-risk AI system requirements around risk assessment and documentation.

With Evidr, most organizations can establish initial AI RMF alignment in 8-12 weeks. Timeline depends on the number of AI systems, organizational complexity, and existing governance structures. Unlike one-time certifications, AI RMF is an ongoing practice that improves continuously as your AI portfolio evolves.