NIST AI Risk Management Framework

Organizations that want to manage AI risk need a common way to think about it. Which risks matter? Who is responsible? How should risks be measured, and what should happen when they are too high? The NIST AI Risk Management Framework offers a widely recognized answer. It describes the characteristics of trustworthy AI and organizes AI risk management into four functions that apply across the AI lifecycle. Because it is voluntary and not tied to any one sector, organizations of every size use it to structure their AI governance, often alongside other standards and regulations. It is designed to be used by organizations that build AI, buy it or both.

NIST released version 1.0 of the framework in January 2023, as directed by the National Artificial Intelligence Initiative Act of 2020, together with a companion Playbook of suggested actions. In July 2024 it published a Generative AI Profile, NIST AI 600-1, describing risks specific to generative AI. NIST has said that the framework is being revised as part of the White House AI Action Plan. For risk, compliance, technology and data leaders, the AI RMF is often the starting point for building an AI governance framework in the United States.

Definition of NIST AI Risk Management Framework

The NIST AI Risk Management Framework is a voluntary, non-sector-specific resource that provides a structured approach for organizations designing, developing, deploying or using AI systems to manage the risks of AI to individuals, organizations and society, and to promote trustworthy and responsible AI.

It is a common basis for an AI governance framework, structures AI risk management and is often used alongside ISO 42001 and the NIST Cybersecurity Framework.

The Four Functions

Govern establishes the culture, policies, roles, accountability and processes for AI risk management across the organization. It applies throughout and informs the other three functions. Without strong governance, the other functions tend to be applied inconsistently.

Map establishes the context for each AI system, including its intended purpose, users, potential impacts, risks and benefits. Good mapping often reveals risks that are not obvious from a technical view alone.

Measure uses quantitative and qualitative methods to analyze, assess, benchmark and monitor AI risks and the trustworthiness of AI systems. Measurement continues after deployment, since AI behavior can change over time.

Manage allocates resources to the risks that have been mapped and measured, deciding how to respond, monitor and recover.

Each function is broken into categories and subcategories that describe specific outcomes, and the Playbook suggests actions for achieving them.

Characteristics of Trustworthy AI

The framework describes trustworthy AI systems as valid and reliable, safe, secure and resilient, accountable and transparent, explainable and interpretable, privacy-enhanced, and fair with harmful bias managed.

Valid and reliable is presented as the foundation for the other characteristics.

The characteristics can involve tradeoffs, such as between accuracy and interpretability, which organizations must weigh in context.

These characteristics give organizations a common vocabulary for defining what good looks like for each AI system.

Importance of the NIST AI RMF in AI Governance

The AI RMF provides a common structure. Teams across technology, risk, legal and the business can describe and manage AI risk in the same terms. A shared structure also makes it easier to compare risks across different AI systems.

It is flexible. Because it is voluntary and outcome-based, organizations can adapt it to their size, sector and maturity, and apply it to AI they build or buy.

It also supports compliance and assurance. Many organizations use it to demonstrate responsible AI practices to customers, auditors and regulators, and it maps to other frameworks and laws.

The NIST AI RMF and Financial Management

Using the framework to prioritize risks helps focus spending on testing, monitoring and controls for the AI systems with the greatest potential impact.

The Map function encourages organizations to weigh benefits against risks, which supports decisions about which AI uses are worth funding.

Adopting a recognized framework can reduce the cost of meeting customer and regulatory expectations later.

Because the framework is free and voluntary, the main costs are staff time, tools and any external assessments.

Common Challenges

The framework describes outcomes rather than specific controls, so organizations must decide how to implement and evidence each one. Crosswalks to other frameworks, such as ISO 42001, can help translate outcomes into controls.

Its scope is broad, and trying to address every subcategory at once can overwhelm teams. Prioritizing the subcategories most relevant to current AI uses keeps the work manageable.

Organizations need to track updates, including the revision under way and new profiles and companion documents.