The NIST AI Risk Management Framework (AI RMF) is the document most often named when a company says its AI governance is "aligned with NIST". It is published by the US National Institute of Standards and Technology as AI RMF 1.0, released on January 26, 2023.[1] This guide reads the framework text and its generative AI profile directly, so you can tell what an alignment claim does and does not commit anyone to.
What it is, and what it is not
NIST says the framework is "intended for voluntary use."[1] The framework text adds that it is intended to be "voluntary, rights-preserving, non-sector-specific, and use-case agnostic," and that it is meant to help organisations that design, develop, deploy or use AI systems manage risk and promote trustworthy and responsible use.[2]
Three limits are stated in the text itself:
- No prescribed risk tolerance. "While the AI RMF can be used to prioritize risk, it does not prescribe risk tolerance." Tolerance is "highly contextual" and can be shaped by legal or regulatory requirements.[2]
- It augments, not replaces, existing rules. Organisations "should follow existing regulations and guidelines" for risk criteria, tolerance and response set by their sector or profession.[2]
- It can be a poor fit when tolerances are unresolved. The text says that where challenges in specifying AI risk tolerances remain unresolved, "there may be contexts where a risk management framework is not yet readily applicable."[2]
Our interpretation: a claim of "NIST AI RMF compliance" has no external definition to be compliant with. The more meaningful question is which subcategories the organisation has implemented, and what evidence it holds for each.
Seven characteristics of trustworthy AI
The framework lists these characteristics: valid and reliable, safe, secure and resilient, accountable and transparent, explainable and interpretable, privacy-enhanced, and fair with harmful bias managed.[2] Two structural points matter. Valid and reliable is described as a necessary condition of trustworthiness, shown as the base of the others, and accountable and transparent relates to all of them.[2]
The text is direct that these pull against each other. "Tradeoffs are usually involved, rarely do all characteristics apply in every setting," and it gives examples: interpretability against privacy, predictive accuracy against interpretability, and privacy-enhancing techniques that can reduce accuracy when data is sparse. Analysis can "highlight the existence and extent of tradeoffs," but it does not say how to resolve them; that depends on the values at play and should be resolved "in a manner that is both transparent and appropriately justifiable."[2]
The four functions
The Core is "composed of four functions: GOVERN, MAP, MEASURE, and MANAGE," each broken into categories and subcategories. The text states that actions "do not constitute a checklist, nor are they necessarily an ordered set of steps."[2]
| Function | What the framework says it does | Example subcategory |
|---|---|---|
| GOVERN | Cultivates a culture of risk management, sets processes, documents and organisational structures, and is cross-cutting: "infused throughout" the other functions[2] | GOVERN 1.1: legal and regulatory requirements involving AI are understood, managed and documented |
| MAP | Establishes the context to frame risks, including intended purposes and deployment settings; its outcomes are the basis for MEASURE and MANAGE[2] | MAP 1.1: intended purposes, beneficial uses, context-specific laws and norms, and prospective settings are understood and documented |
| MEASURE | Uses quantitative, qualitative or mixed methods to analyse, assess, benchmark and monitor AI risk; systems should be tested before deployment and regularly in operation[2] | MEASURE 1.1: metrics are selected starting with the most significant risks, and risks that will not or cannot be measured are documented |
| MANAGE | Allocates resources to mapped and measured risks, with plans to respond to, recover from and communicate about incidents[2] | MANAGE 4.3: incidents and errors are communicated to relevant AI actors, including affected communities |
On order, the text says that after instituting the GOVERN outcomes, "most users of the AI RMF would start with the MAP function and continue to MEASURE or MANAGE," but that the process should be iterative with cross-referencing between functions.[2]
Where it touches engineering work
MEASURE is the function engineers meet first. It calls for test, evaluation, verification and validation (TEVV) processes that are "objective, repeatable, or scalable," measures of uncertainty, comparisons to benchmarks, and independent review to reduce internal bias and conflicts of interest.[2] That is the same discipline as a production eval set; see how to build LLM evals for your application and how to read an AI benchmark claim. A noteworthy detail in MEASURE 1.1 is the duty to document the risks you will not or cannot measure, which is an honest-limitations requirement many teams skip.[2]
Profiles: the part that makes it usable
A profile is an implementation of the functions, categories and subcategories for a specific setting, based on "the requirements, risk tolerance, and resources of the Framework user." The text defines a Current Profile (how AI is being managed now) and a Target Profile (the desired outcomes), and says comparing them "likely reveals gaps to be addressed." It also describes cross-sectoral profiles, which cover risks of models or applications used across sectors, with large language models as an example.[2]
The practical reading: pick the subcategories that match your use case, write down where you are, write down where you need to be, and treat the gap list as your plan. The framework does not prescribe a profile template.[2]
The Generative AI Profile (NIST AI 600-1)
Published in July 2024, NIST AI 600-1 is a cross-sectoral profile for generative AI, developed under Executive Order 14110.[1][3] It defines risks "novel to or exacerbated by the use of GAI" and lists 12:[3]
- CBRN information or capabilities
- Confabulation
- Dangerous, violent or hateful content
- Data privacy
- Environmental impacts
- Harmful bias or homogenisation
- Human-AI configuration
- Information integrity
- Information security
- Intellectual property
- Obscene, degrading and abusive content
- Value chain and component integration
Several map onto topics covered elsewhere on ANTM. Confabulation is the profile's term for what many call hallucination; the profile defines it as confidently stated but erroneous or false content, and notes that the word "hallucination" can itself anthropomorphise the system.[3] For mitigations in practice, see why AI models hallucinate and what reduces it. Information security, in the profile, includes prompt injection (direct and indirect) and data poisoning, the same attack surface discussed in how AI agents work and how to secure them.[3] Value chain and component integration is the third-party risk of reused pre-trained models, datasets and libraries, which the profile says is heightened because training data may be too large for humans to vet and because a small number of models are widely reused.[3]
The profile organises "suggested actions" by AI RMF subcategory and says not every subcategory is included, and not every action applies to every actor; actions for developers may not apply to deployers.[3] Its appendix also names four primary considerations drawn from a public working group: governance, pre-deployment testing, content provenance and incident disclosure.[3] The profile is likewise for voluntary use.[3]
What is changing
NIST's program page states that "the AI RMF 1.0 is being revised as part of the White House AI Action Plan," and that on April 7, 2026 NIST released a concept note for an AI RMF profile on trustworthy AI in critical infrastructure. The page gives no revision date, and the 1.0 text says NIST expected a review with formal community input "no later than 2028."[1][2] We have not opened the revision itself, so we do not describe what will change. Before citing the framework in a policy or contract, check the NIST page for the current version.
How to use this when someone says "we follow NIST"
- Ask which version and which profile. AI 100-1, AI 600-1, or a sector profile?
- Ask which subcategories are implemented, and what artefact (policy, test report, incident log) exists for each.
- Ask for the Target Profile gap list. An organisation that cannot say where it falls short probably has not done the mapping.
- Ask what is not measured. MEASURE 1.1 expects it to be documented.
- Treat the answer as the organisation's statement. The framework has no certification scheme in the text we read, so no one at NIST has endorsed the claim.
Sources and method
We opened the NIST program page, the AI RMF 1.0 text and the Generative AI Profile on 2026-10-17, read the sections cited here, and quote them directly where marked. Anything we describe as interpretation is ours. We did not review legal requirements that may apply to specific sectors or jurisdictions; the framework itself says to follow those first.
