When a customer's security questionnaire asks how you manage AI risk, the NIST AI RMF is the framework it's likely to name, and Texas law names it too. Much of what's written about it assumes you build AI models, which leaves the company that buys ChatGPT seats and switches on Copilot unsure what applies. The surprising part: there is no NIST certificate to get, and NIST says the framework isn't a checklist. What actually shows you follow it is a short document most companies never write, called a profile.
What is the NIST AI RMF?
The NIST AI RMF (Artificial Intelligence Risk Management Framework 1.0, published as NIST AI 100-1) is free, voluntary guidance from the US National Institute of Standards and Technology, released on January 26, 2023, that sorts the work of managing AI risk into four functions and 72 outcomes an organization can choose from.
It isn't only for AI developers. NIST wrote it for "organizations designing, developing, deploying, or using AI systems", and it calls itself "voluntary, rights-preserving, non-sector-specific, and use-case agnostic". Its GOVERN function covers organizations "acquiring AI systems" as well as building them. NIST's FAQ says it "should be scalable to organizations of all sizes, public or private, in any sector", and the framework itself admits that "small to medium-sized organizations managing AI risks or implementing the AI RMF may face different challenges than large organizations".
This guide is for the IT and security leads, COOs and operations leads at companies of 20 to 1,000 people who get asked about it. It covers what the framework contains, which parts matter when you use AI rather than build it, and how to document that you follow it. If you're still choosing between frameworks, start with our comparison of AI governance frameworks, which sets NIST beside ISO/IEC 42001 and the EU AI Act. It isn't legal advice.
What's in it
The framework has two parts. Part 1 explains how to think about AI risk and lists the characteristics of trustworthy AI. Part 2 is the "Core" (the four functions) and the profiles that apply it to a setting.
NIST names seven characteristics of trustworthy AI. For a company buying AI, each one is a question to put to a tool before it's approved:
| Characteristic | The question for a tool you buy |
|---|---|
| Valid and reliable | Does it do the job accurately, and keep doing it? |
| Safe | Could its output hurt someone if nobody catches it? |
| Secure and resilient | What happens to your data, and how does it hold up under attack? |
| Accountable and transparent | Who answers for it, and can you see what it did? |
| Explainable and interpretable | Can someone explain a result to the person it affects? |
| Privacy-enhanced | What personal data goes in, and where does it go? |
| Fair with harmful bias managed | Does it treat groups of people differently? |
NIST describes valid and reliable as "a necessary condition of trustworthiness". If a tool doesn't work, the other six don't matter.
What are the core functions of the NIST AI RMF?
The four functions are GOVERN (policies, owners and culture, across everything), MAP (what each AI system is for and what could go wrong), MEASURE (assessing and tracking those risks) and MANAGE (deciding what to do about them, up to switching a system off). Each function breaks into categories, and each category into subcategories: the specific outcomes. By our count there are 19 categories and 72 subcategories.
| Function | Categories | Subcategories | What it covers when you use AI rather than build it |
|---|---|---|---|
| GOVERN | 6 | 19 | Laws that apply, the AI inventory, owners, review dates, vendor risk |
| MAP | 5 | 18 | What each use is for, who it affects, and the go/no-go decision |
| MEASURE | 4 | 22 | Checking the output, privacy and bias, and tracking new risks |
| MANAGE | 4 | 13 | Acting on the findings, the off switch, incidents, vendor monitoring |
MEASURE has the most subcategories, and many of them are about testing a model before release. A company that buys its AI will mark more of MEASURE as "the vendor's job" than any other function. That's allowed. NIST says "some organizations may choose to select from among the categories and subcategories", and that its actions "do not constitute a checklist, nor are they necessarily an ordered set of steps."
On order, NIST is specific: "After instituting the outcomes in GOVERN, most users of the AI RMF would start with the MAP function". MAP's purpose is to give you enough knowledge "to inform an initial go/no-go decision about whether to design, develop, or deploy an AI system." For a buyer, that's the approval decision on a new tool.
The subcategories that answer vendor risk
When most of your AI comes from vendors, five subcategories do more work than the rest. They're the ones your vendors' terms and your contracts answer:
- GOVERN 6.1: "Policies and procedures are in place that address AI risks associated with third-party entities, including risks of infringement of a third-party's intellectual property or other rights."
- GOVERN 6.2: "Contingency processes are in place to handle failures or incidents in third-party data or AI systems deemed to be high-risk."
- MAP 4.1: approaches for mapping the technology and legal risks of an AI system's components, "including the use of third-party data or software", are in place and documented.
- MAP 4.2: "Internal risk controls for components of the AI system, including third-party AI technologies, are identified and documented."
- MANAGE 3.1: "AI risks and benefits from third-party resources are regularly monitored, and risk controls are applied and documented."
In practice: read the data, retention and training terms before you sign, know what you'd do if the vendor had an outage or a breach, and check the terms again at renewal.
What is the NIST AI RMF Playbook?
The Playbook is NIST's free companion to the framework: suggested actions, documentation ideas and references for each subcategory, which you borrow from rather than complete. NIST says it "is neither a checklist nor set of steps to be followed in its entirety", and that organizations can borrow as many or as few of its suggestions as apply to their own use.
Its suggestions "are aligned to each sub-category within the four AI RMF functions". It downloads as a PDF, CSV, Excel or JSON file. The spreadsheet is the useful one: filter it to the subcategories you've chosen and you have a working list of what good looks like for each. NIST says "Playbook updates will be released approximately twice per year" and that it "will be updated after the AI RMF is revised."
What is a NIST AI RMF profile?
A profile is the framework applied to your own setting: the subcategories you've chosen, how well you meet each one today (your Current Profile) and where you intend to be (your Target Profile). It's the most direct way to show a customer, an auditor or your board that you follow the framework, and most companies skip it.
NIST describes three kinds:
- Use-case profiles apply the framework to one setting. NIST's own examples are "an AI RMF hiring profile or an AI RMF fair housing profile."
- Temporal profiles describe a state. "An AI RMF Current Profile indicates how AI is currently being managed and the related risks in terms of current outcomes. A Target Profile indicates the outcomes needed to achieve the desired or target AI risk management goals."
- Cross-sectoral profiles cover risks shared across sectors, such as "the use of large language models, cloud-based services or acquisition."
The temporal pair is where the value is. NIST says "comparing Current and Target Profiles likely reveals gaps to be addressed" and "action plans can be developed to address these gaps". The gap list is your AI governance work plan, already mapped to the framework a customer asked about.
NIST "does not prescribe profile templates". That means you can keep it short. A table with one row per subcategory, a current rating, a target rating, an owner and a date is enough. There's a template below.
What is NIST AI 600-1, the Generative AI Profile?
NIST AI 600-1 is the Generative AI Profile, released on July 26, 2024: a cross-sectoral profile that applies the AI RMF to generative AI such as ChatGPT, Copilot, Claude and Gemini, and lists 12 risks that it creates or makes worse. It calls itself "a cross-sectoral profile of and companion resource for" the framework, and the risks are ones "unique to or exacerbated by" generative AI.
| Risk (NIST's name) | In plain terms |
|---|---|
| CBRN information or capabilities | Easier access to information on chemical, biological, radiological or nuclear weapons |
| Confabulation | "Confidently stated but erroneous or false content", known as hallucinations |
| Dangerous, violent or hateful content | Easier production of violent, inciting or threatening content |
| Data privacy | Leakage or misuse of personal or sensitive data |
| Environmental impacts | High compute and energy use |
| Harmful bias or homogenization | Amplified bias, and outputs that all look the same |
| Human-AI configuration | Over-reliance, automation bias, or treating the tool as a person |
| Information integrity | Content that blurs fact and opinion, at scale |
| Information security | Easier cyberattacks, and attacks on the AI itself |
| Intellectual property | Easier copying of copyrighted or trademarked material |
| Obscene, degrading or abusive content | Easier production of abusive imagery |
| Value chain and component integration | Third-party parts nobody can trace, and weak supplier vetting |
For a company whose AI is mostly chat assistants and copilots, confabulation, data privacy, information security, intellectual property, harmful bias, human-AI configuration and the value chain are the ones that turn up in ordinary work. The rest matter more to the companies that build and host models. This profile also matters legally in one state: Texas names it in a defense, covered below.
Is there a NIST AI RMF certification?
No: NIST publishes the AI RMF as a voluntary framework and offers no certification against it, so anything sold under that name comes from a private provider, not from NIST. Neither NIST's framework page nor its FAQ describes any certification or conformity scheme.
If a customer wants a certificate an outside auditor has issued, the standard is ISO/IEC 42001, which accredited certification bodies certify against. Our AI governance framework guide covers when that's worth it. The two fit together. NIST's resource center lists a "NIST AI Risk Management Framework to ISO-IEC-42001 Crosswalk" contributed by Microsoft, alongside other crosswalks, though NIST notes that listing one doesn't mean it endorses it or that either document fully covers the other.
So the honest answer to "Are you NIST AI RMF certified?" is: "No one is, because NIST doesn't certify. Here's our profile against it, with owners and dates." That answer is stronger than a badge from a training course.
Is the NIST AI RMF mandatory?
No: no US law requires a private company to adopt it, and NIST's FAQ says plainly, "No. NIST has produced the AI RMF as a voluntary Framework." But one state rewards it, and customers ask about it.
The Texas Responsible AI Governance Act, in effect since January 1, 2026, says a defendant may not be found liable if it discovers a violation through "an internal review process" where it "substantially complies with the most recent version of the 'Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile' published by the National Institute of Standards and Technology or another nationally or internationally recognized risk management framework for artificial intelligence systems". A written profile and a dated record of your reviews are the kind of evidence that defense would rest on. Our guide to the Texas AI law covers who the act reaches.
Is the NIST AI RMF the same as the NIST RMF?
No. The "NIST RMF" most security teams know is the Risk Management Framework in NIST SP 800-37, with seven steps: Prepare, Categorize, Select, Implement, Assess, Authorize and Monitor. It's about information security and privacy controls. The AI RMF is a separate document with no numbered steps. If your security team already runs SP 800-37 or similar controls, MEASURE's security outcomes will feel familiar, but the AI RMF adds questions those frameworks don't ask, such as what each AI use is for and who it affects.
A NIST AI RMF profile template you can copy
A first profile for a company that uses AI can be one table: about 15 subcategories, a current and target rating for each, an owner and a date. Copy it, rate each row honestly, and fill the brackets. Use three ratings: None, Partial, In place.
| Subcategory | The outcome, in short | Current | Target | Owner | By |
|---|---|---|---|---|---|
| GOVERN 1.1 | "Legal and regulatory requirements involving AI are understood, managed, and documented." | [ ] | In place | [Role] | [Date] |
| GOVERN 1.5 | Monitoring and periodic review are planned, "including determining the frequency of periodic review" | [ ] | In place | [Role] | [Date] |
| GOVERN 1.6 | "Mechanisms are in place to inventory AI systems" | [ ] | In place | [Role] | [Date] |
| GOVERN 2.1 | Roles, responsibilities and lines of communication are documented | [ ] | In place | [Role] | [Date] |
| GOVERN 6.1 | Policies address AI risks from third parties | [ ] | In place | [Role] | [Date] |
| GOVERN 6.2 | Contingency processes for failures in third-party AI deemed high-risk | [ ] | Partial | [Role] | [Date] |
| MAP 1.1 | Intended purposes, context-specific laws and settings are documented | [ ] | In place | [Role] | [Date] |
| MAP 4.1 | Technology and legal risks of components, including third-party software, are mapped | [ ] | Partial | [Role] | [Date] |
| MEASURE 1.1 | Measurement starts "with the most significant AI risks" | [ ] | Partial | [Role] | [Date] |
| MEASURE 3.1 | Existing, unanticipated and emergent risks are tracked over time | [ ] | Partial | [Role] | [Date] |
| MANAGE 1.1 | A determination of whether each system meets its purpose and "should proceed" | [ ] | In place | [Role] | [Date] |
| MANAGE 2.4 | Mechanisms "to supersede, disengage, or deactivate AI systems" | [ ] | In place | [Role] | [Date] |
| MANAGE 3.1 | Third-party AI risks are "regularly monitored" | [ ] | In place | [Role] | [Date] |
| MANAGE 4.1 | Post-deployment monitoring, including "incident response, recovery, and change management" | [ ] | Partial | [Role] | [Date] |
| MANAGE 4.3 | Incidents and errors are communicated and tracked | [ ] | In place | [Role] | [Date] |
The target column above is our suggestion for a mid-size company that buys its AI; set your own. Two rules keep the table honest. Rate "In place" only where you could show someone the document or the record. And add a row from the Generative AI Profile for each generative AI risk you decide matters, such as confabulation in client-facing drafts.
A profile is only true on the day you write it
Many companies that write a NIST profile write it once, for a customer questionnaire, and file it. Six months later staff are using three new tools, one owner has left, and the profile describes a company that no longer exists. NIST saw this coming: GOVERN 1.5 asks you to plan "ongoing monitoring and periodic review", "including determining the frequency of periodic review."
That's the part our framework is built around. Its "own" step puts an owner and a backup on every tool, a tested off switch and undo, and review dates in the calendar. Those lessons produce the evidence behind GOVERN 2.1, MANAGE 2.4 and GOVERN 1.5 in the template. Its guardrails give you an AI list and approved tools, the evidence for GOVERN 1.6 and 6.1. If you're deploying AI across the company now, build the profile as you go, so the rollout and the paperwork describe the same thing.
How do you implement the NIST AI RMF?
01 · Make the AI list
Find every AI tool and AI feature in use, including the AI built into software you already pay for. This is GOVERN 1.6, and every other row depends on it. The Shadow AI Audit does a first pass in about five minutes.
02 · Pick your subcategories
Start from the template above and add or remove rows. Add a use-case row set for anything that screens people, since hiring is the use NIST itself names for a profile. Download the Playbook spreadsheet and keep its suggestions for your chosen rows beside the table.
03 · Rate where you are today
Fill the Current column honestly, with a link to the document or record behind each "In place". This is your Current Profile.
04 · Set the target and turn gaps into tasks
Fill the Target column, then list every row where the two differ. Each gap gets an owner and a date. That list is your action plan, in the framework's own terms.
05 · Add the generative AI risks
For each chat assistant or copilot on the list, go through the 12 risks in NIST AI 600-1 and note which apply. Typical rules cover confabulation (check before you send), data privacy (what can go in) and intellectual property. Your AI usage policy is where those rules reach staff.
06 · Review on a date, and keep the record
Set the next review before you finish. At each review, update the AI list, re-rate the rows, and keep the old version. The dated history is what an auditor, a customer or a Texas internal review would ask to see. If you want help with the first round, our AI governance work starts there.
What's still open
- The revision. NIST says "the AI RMF 1.0 is being revised as part of the White House AI Action Plan." It hasn't said when the new version will appear or what will change, and the Playbook "will be updated after the AI RMF is revised." Subcategory numbers may change, so keep your profile's wording close to the outcome, not just the number.
- New profiles. On April 7, 2026, NIST released a concept note for an AI RMF profile on trustworthy AI in critical infrastructure. It isn't final.
- What customers accept. There's no standard format for showing NIST alignment, so expect questionnaires to keep asking in different ways.
We'll update this article when NIST publishes the revised framework or a new profile that changes what a company using AI should do. The date at the top of the page shows when we last checked.
Sources
- Artificial Intelligence Risk Management Framework (AI RMF 1.0), NIST AI 100-1, National Institute of Standards and Technology, January 2023: the audience, the two parts, the seven trustworthiness characteristics, the four functions, the categories and subcategories (counted by us), the subcategory wording quoted, the order of use, the go/no-go decision, the note that actions aren't a checklist, and the three kinds of profile.
- AI Risk Management Framework, NIST, checked November 2026: the January 26, 2023, release, voluntary status, the July 26, 2024, Generative AI Profile, the April 7, 2026, critical infrastructure concept note, and the statement that AI RMF 1.0 is being revised.
- AI RMF FAQs, NIST, checked November 2026: that the framework is voluntary and scalable to organizations of all sizes.
- AI RMF Playbook, NIST Trustworthy and Responsible AI Resource Center, checked November 2026: how the Playbook is organized, its download formats, that it isn't a checklist, and its update schedule.
- Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile, NIST AI 600-1, NIST, July 2024: the profile's description and its 12 risks.
- Crosswalks to the NIST AI RMF, NIST Trustworthy and Responsible AI Resource Center, checked November 2026: the ISO/IEC 42001 crosswalk and NIST's note on what a listing means.
- House Bill 149, enrolled version, Texas Legislature, 2025: the defense that names NIST's Generative AI Profile, and the January 1, 2026, effective date.
- About the NIST Risk Management Framework, NIST Computer Security Resource Center, checked November 2026: the seven steps of the SP 800-37 Risk Management Framework.