Docs

Appearance

NIST AI Risk Management Framework 1.0 (NIST AI RMF) ​

NIST AI Risk Management Framework 1.0 illustration

The NIST AI Risk Management Framework 1.0 (NIST AI RMF, AI RMF 1.0) is the document NIST AI 100-1 of January 2023. It is from the National Institute of Standards and Technology (NIST) of the U.S. Department of Commerce. NIST AI 100-1 writes that "the goal of the AI RMF is to offer a resource to the organizations designing, developing, deploying, or using AI systems to help manage the many risks of AI". The NIST AI RMF web page adds that the framework "is intended for voluntary use and to improve the ability to incorporate trustworthiness considerations into the design, development, use, and evaluation of AI products, services, and systems". The framework is voluntary guidance, not a law.

As of October 2026, the NIST AI RMF web page gives this information: "The AI RMF 1.0 is being revised as part of the White House AI Action Plan". For the status and the Playbook, see The framework and its status.

Modulos gives the NIST AI RMF as two Frameworks: MFF-3 for each AI System and OFF-3 for the Organization. See NIST AI RMF in Modulos.

Primary sources

NIST AI 100-1, Artificial Intelligence Risk Management Framework (AI RMF 1.0), January 2023. NIST AI 600-1, the Generative AI Profile, July 2024. NIST, AI Risk Management Framework web page.

Key facts
Publisher
NIST (U.S. Department of Commerce)
Version
AI RMF 1.0 (NIST AI 100-1), January 2023. Revision in progress as of October 2026.
Type
Voluntary guidance, not a law
For
Organizations and AI actors that design, develop, deploy, or use AI systems
Structure
Core: 4 functions, 19 categories, 72 subcategories. Profiles.
Modulos Frameworks
MFF-3 (AI System) and OFF-3 (Organization)
Case studyThe NIST AI RMF and the EU AI Act A Modulos document about the NIST AI RMF and the EU AI Act. Read the case study

The framework and its status ​

NIST AI 100-1 of January 2023 is the version of the NIST AI RMF as of October 2026. This section gives the type of the framework, its update schedule, its revision, and the Playbook.

  • Voluntary use: NIST AI 100-1 writes that the framework "is intended to be voluntary, rights-preserving, non-sector-specific, and use-case agnostic".
  • Outcomes: NIST AI 100-1 gives the attributes of the framework in Appendix D. Attribute 7 is "Be outcome-focused and non-prescriptive", attribute 9 is "Be law- and regulation-agnostic", and attribute 10 is "Be a living document".
  • Update schedule: NIST AI 100-1 writes that "a review with formal input from the AI community is expected to take place no later than 2028". The version number has two parts. The first number "will represent the generation of the AI RMF and its companion documents", for example 1.0. NIST uses ".n" after it for "Minor revisions", for example 1.1.
  • Evaluation of the framework: NIST AI 100-1 Section 4 tells organizations that they "are encouraged to periodically evaluate whether the AI RMF has improved their ability to manage AI risks".
  • Drafts: the NIST AI RMF web page shows two drafts in its part "Prior Documents". These are the "Initial draft of the AI Risk Management Framework" of March 17, 2022 and the "Second draft of the AI Risk Management Framework" of August 18, 2022. These drafts came before NIST AI 100-1 of January 2023.

Revision (as of October 2026): the NIST AI RMF web page gives this information: "The AI RMF 1.0 is being revised as part of the White House AI Action Plan". No new version of NIST AI 100-1 is available. Thus AI RMF 1.0 of January 2023 continues to be the version of the framework.

The AI Action Plan: the AI Action Plan of the White House ("America's AI Action Plan", July 2025) is a policy document, not a law. One of its recommended policy actions is that NIST "revise the NIST AI Risk Management Framework to eliminate references to misinformation, Diversity, Equity, and Inclusion, and climate change".

The NIST AI RMF Playbook: NIST AI 100-1 refers to the Playbook as "An online companion resource to the AI RMF". It also writes: "Like the AI RMF, the Playbook is voluntary". The Playbook gives suggested actions for the outcomes of the Core (Tables 1 to 4 of NIST AI 100-1), and it is not Core text.

On the Playbook page, NIST writes that the Playbook "is neither a checklist nor set of steps to be followed in its entirety". The same page gives this information: "The Playbook will be updated after the AI RMF is revised".

The Generative AI Profile: NIST AI 600-1 "was developed per Section 4.1(a)(i)(A) of EO 14110". Executive Order 14148 of January 20, 2025 revoked Executive Order 14110 in its Section 2. For the Profile, see NIST AI RMF Generative AI Profile.

NIST AI 100-1 is voluntary guidance and not a law or a regulation. NIST AI 100-1 sets no obligation for an organization or for an AI actor. NIST AI 100-1 gives outcomes, and it uses "should" for the actions that it recommends.

Texas H.B. 149 (the Texas Responsible Artificial Intelligence Governance Act) is in effect from January 1, 2026 (SECTION 10). SECTION 4 of H.B. 149 adds Chapter 552 to the Texas Business & Commerce Code. Section 552.105(b) of that chapter lets the attorney general start an action for a civil penalty or an injunction. Section 552.105(e) gives defenses in that action:

Texas H.B. 149, Sec. 552.105(e): A defendant in an action under this section may not be found liable if: ... (2) the defendant discovers a violation of this chapter through: ... (D) if the defendant substantially complies with the most recent version of the "Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile" published by the National Institute of Standards and Technology or another nationally or internationally recognized risk management framework for artificial intelligence systems, an internal review process.

This provision has these limits:

  • It names NIST AI 600-1, the Generative AI Profile, and not AI RMF 1.0. It also accepts "another nationally or internationally recognized risk management framework for artificial intelligence systems".
  • It is one of four alternatives in Section 552.105(e)(2). The other three alternatives are "feedback from a developer, deployer, or other person who believes a violation has occurred", "testing, including adversarial testing or red-team testing", and "following guidelines set by applicable state agencies". Section 552.105(e)(1) gives a different defense.
  • It is a condition of a defense in an action of the attorney general. It does not give an obligation to use a NIST document. Compliance with NIST AI 600-1 is not sufficient for the defense. This defense applies only if the defendant also finds the violation through an internal review process.

Laws such as the EU AI Act give obligations that the NIST AI RMF does not change. To compare the NIST AI RMF with these laws, see How NIST AI RMF compares to other frameworks.

AI risk in NIST AI 100-1 ​

NIST AI 100-1 Part 1 gives these items about AI risk.

  • AI system: NIST AI 100-1 refers to an AI system as "an engineered or machine-based system that can, for a given set of objectives, generate outputs such as predictions, … or decisions influencing real or virtual environments". The outputs in that text also include "recommendations". AI systems are "designed to operate with varying levels of autonomy". NIST adapted this text from the OECD Recommendation on AI:2019 and ISO/IEC 22989:2022.
  • Risk (Section 1.1): risk is "the composite measure of an event's probability of occurring and the magnitude or degree of the consequences of the corresponding event". The impacts "can be positive, negative, or both". NIST AI 100-1 adds: "Negative impact or harm can be experienced by individuals, groups, communities, organizations, society, the environment, and the planet".
  • Socio-technical systems: NIST AI 100-1 writes that "AI systems are inherently socio-technical in nature, meaning they are influenced by societal dynamics and human behavior". It adds: "AI risks – and benefits – can emerge from the interplay of technical aspects combined with societal factors related to how a system is used, its interactions with other AI systems, who operates it, and the social context in which it is deployed". In Appendix B, NIST AI 100-1 compares AI risks with the risks of "traditional software".
  • Risk tolerance (Section 1.2.2): "While the AI RMF can be used to prioritize risk, it does not prescribe risk tolerance". Risk tolerance refers to "the organization's or AI actor's (see Appendix A) readiness to bear the risk in order to achieve its objectives". Risk tolerance is "highly contextual and application and use-case specific", and risk tolerances "are likely to change over time". NIST recommends that organizations follow the regulations and guidelines that apply to them for "risk criteria, tolerance, and response". If there are no such guidelines, NIST recommends that organizations "define reasonable risk tolerance".
  • Risk tolerance in the Core: in MAP 1.5, the outcome is that "Organizational risk tolerances are determined and documented". In GOVERN 1.3, the outcome is that "Processes, procedures, and practices are in place to determine the needed level of risk management activities based on the organization's risk tolerance".
  • Risk prioritization (Section 1.2.3): NIST AI 100-1 writes that "Attempting to eliminate negative risk entirely can be counterproductive in practice". It adds that "risks which the organization determines to be highest for the AI systems within a given context of use call for the most urgent prioritization and most thorough risk management process".
  • Residual risk (Section 1.2.3): residual risk is "risk remaining after risk treatment", from ISO Guide 73. Residual risk "directly impacts end users or affected individuals and communities". The documentation of residual risks "will inform end users about potential negative impacts of interacting with the system". For the Core outcome, see MANAGE 1.4.
  • Enterprise risk management (Section 1.2.4): NIST AI 100-1 writes that "AI risks should not be considered in isolation" and that "AI risk management should be integrated and incorporated into broader enterprise risk management strategies and processes". It also writes that organizations "need to establish and maintain the appropriate accountability mechanisms, roles and responsibilities, culture, and incentive structures for risk management to be effective". It adds: "Use of the AI RMF alone will not lead to these changes or provide the appropriate incentives".

Section 1.2.3 also gives a condition to stop development and deployment:

NIST AI 100-1, Section 1.2.3: In cases where an AI system presents unacceptable negative risk levels – such as where significant negative impacts are imminent, severe harms are actually occurring, or catastrophic risks are present – development and deployment should cease in a safe manner until risks can be sufficiently managed.

AI actors ​

In Section 2, NIST AI 100-1 writes that the AI RMF "is intended to be used by AI actors across the AI lifecycle and dimensions". In Figure 2, NIST AI 100-1 shows four dimensions: the Application Context, the Data and Input, the AI Model, and the Task and Output dimensions. AI actors in these dimensions "who perform or manage the design, development, deployment, evaluation, and use of AI systems and drive AI risk management efforts are the primary AI RMF audience". The AI actors in the People & Planet dimension "comprise a separate AI RMF audience who informs the primary audience".

NIST AI 100-1 gives groups of AI actor tasks in Appendix A. These groups are the AI Design, AI Development, AI Deployment, and Operation and Monitoring tasks, and the TEVV tasks. The other groups are the Human Factors, Domain Expert, AI Impact Assessment, Procurement, and Governance and Oversight tasks. In Appendix A, NIST AI 100-1 also refers to "Third-party entities", "End users", "Affected individuals/communities", "Other AI actors", and "The general public". NIST AI 100-1 sets no obligation for an AI actor.

In Figure 2, NIST AI 100-1 changes the OECD dimensions to show "the importance of test, evaluation, verification, and validation (TEVV) processes throughout an AI lifecycle". Section 2 adds that TEVV tasks, "Performed regularly", "can assist with anticipating impacts and assessing and tracking emergent risks".

The four functions of the Core ​

NIST AI 100-1 gives the Core in Part 2 (Section 5). The Core has four functions: GOVERN, MAP, MEASURE, and MANAGE. NIST AI 100-1 divides each function into categories and subcategories in Tables 1 to 4. The subcategories give the outcomes of the Core.

FunctionText of NIST AI 100-1, Section 5CategoriesSubcategoriesPage
GOVERN, in Section 5.1 and Table 1"cultivates and implements a culture of risk management" in organizations619Govern
MAP, in Section 5.2 and Table 2"establishes the context to frame risks related to an AI system"518Map
MEASURE, in Section 5.3 and Table 3"employs quantitative, qualitative, or mixed-method tools, … to analyze, assess, benchmark, and monitor AI risk and related impacts"422Measure
MANAGE, in Section 5.4 and Table 4"entails allocating risk resources to mapped and measured risks on a regular basis and as defined by the GOVERN function"413Manage
Total1972

NIST AI 100-1 writes that "Outcomes in the MAP function are the basis for the MEASURE and MANAGE functions". MEASURE uses information from MAP and "informs the MANAGE function". Each function page gives more information.

NIST AI 100-1 gives these rules for the use of the functions:

  • GOVERN and the other functions: NIST AI 100-1 writes: "While GOVERN applies to all stages of organizations' AI risk management … procedures, the MAP, MEASURE, and MANAGE functions can be applied in AI system-specific contexts and at specific stages of the AI lifecycle". In Figure 5, NIST AI 100-1 has this text: "Governance is designed to be a cross-cutting function to inform and be infused throughout the other three functions".
  • Actions of the Core: "Actions do not constitute a checklist, nor are they necessarily an ordered set of steps". NIST AI 100-1 writes that some organizations can select from the categories and subcategories, and that others can apply all of them.
  • Sequence: if there is a governance structure, NIST AI 100-1 writes that the functions "may be performed in any order across the AI lifecycle as deemed to add value by a user of the framework". It adds: "After instituting the outcomes in GOVERN, most users of the AI RMF would start with the MAP function". These users then continue to MEASURE or MANAGE. NIST AI 100-1 also writes that "the process should be iterative, with cross-referencing between functions as necessary".
  • Risk management during the lifecycle: NIST AI 100-1 writes that "Risk management should be continuous, timely, and performed throughout the AI system lifecycle dimensions". It adds that "AI RMF Core functions should be carried out in a way that reflects diverse and multidisciplinary perspectives, potentially including the views of AI actors" that are external to the organization.

The seven characteristics of trustworthy AI ​

NIST AI 100-1 Section 3 gives seven characteristics of trustworthy AI systems:

  • valid and reliable
  • safe
  • secure and resilient
  • accountable and transparent
  • explainable and interpretable
  • privacy-enhanced
  • fair – with harmful bias managed

NIST AI 100-1 writes that "Creating trustworthy AI requires balancing each of these characteristics based on the AI system's context of use". For Figure 4, the tradeoffs, and the MEASURE subcategories for each characteristic, see Trustworthy AI characteristics.

NIST AI RMF profiles ​

NIST AI 100-1 Section 6 gives three types of AI RMF profiles. NIST AI 100-1 writes: "This Framework does not prescribe profile templates, allowing for flexibility" in the use of profiles.

  • Use-case profile: a use-case profile is one of the "implementations of the AI RMF functions, categories, and subcategories for a specific setting or application based on the requirements, risk tolerance, and resources of the Framework user". NIST gives two examples: "an AI RMF hiring profile or an AI RMF fair housing profile".
  • Temporal profile: NIST AI 100-1 writes: "AI RMF temporal profiles are descriptions of either the current state or the desired, target state of specific AI risk management activities within a given sector, industry, organization, or application context". A Current Profile "indicates how AI is currently being managed and the related risks in terms of current outcomes". A Target Profile "indicates the outcomes needed to achieve the desired or target AI risk management goals". NIST AI 100-1 adds that "Comparing Current and Target Profiles likely reveals gaps to be addressed to meet AI risk management objectives" and that "Action plans can be developed to address these gaps". It also writes: "Prioritization of gap mitigation is driven by the user's needs and risk management processes".
  • Cross-sectoral profile: AI RMF cross-sectoral profiles "cover risks of models or applications that can be used across use cases or sectors". NIST AI 100-1 adds that they "can also cover how to govern, map, measure, and manage risks for activities or business processes common across sectors such as the use of large language models, cloud-based services or acquisition".

Profile for critical infrastructure (as of October 2026): the NIST AI RMF web page gives this information: "On April 7, 2026, NIST released a concept note for an AI RMF Profile on Trustworthy AI in Critical Infrastructure". On the same page, NIST writes that the profile "will guide critical infrastructure operators towards specific risk management practices to consider when engaging AI-enabled capabilities".

The NIST page for the concept note gives "Ongoing" as the "Project Status". On that page, NIST also writes that it will give "discussion drafts" to its Community of Interest. As of October 2026, no draft of the profile is available on these NIST pages.

Cyber AI Profile (as of October 2026): NIST IR 8596, "Cybersecurity Framework Profile for Artificial Intelligence (Cyber AI Profile): NIST Community Profile", is a profile of the NIST Cybersecurity Framework. The CSRC page of NIST gives "Initial Preliminary Draft" as its status and December 16, 2025 as its date. The same page shows "Comments Due: January 30, 2026 (public comment period is CLOSED)".

NIST Generative AI Profile (AI 600-1) ​

NIST AI 600-1 (July 2024) is a cross-sectoral profile of AI RMF 1.0 for generative AI (GAI). NIST AI 600-1 gives 12 risks "unique to or exacerbated by the development and use of GAI". It also gives suggested actions for some AI RMF subcategories. For the 12 risks and the suggested actions, see NIST AI RMF Generative AI Profile.

How NIST AI RMF compares to other frameworks ​

The NIST AI RMF is voluntary guidance. The other frameworks on this page are a standard (ISO/IEC 42001), a law (the EU AI Act), and a document about security risks (the OWASP Top 10 for LLM Applications).

ISO/IEC 42001:2023: ISO/IEC 42001 is a standard of ISO and IEC for an AI management system (AIMS) in an organization. It sets requirements for the AIMS. The NIST AI RMF is voluntary guidance that gives outcomes. For the certification of an AIMS, see ISO/IEC 42001 scope and certification.

The crosswalk to ISO/IEC 42001: NIST shows the "NIST AI Risk Management Framework to ISO-IEC-42001 Crosswalk" on the crosswalks page of its AI Resource Center. That page gives Microsoft as the provider and gives no date.

The crosswalk uses a draft of the standard, ISO/IEC FDIS 42001. For each subcategory, the crosswalk gives clause numbers of ISO/IEC 42001, Annex B numbers, or clause and Annex B numbers. ISO/IEC 42001 Annex B gives guidance for the controls of Annex A. The crosswalks page has this text: "Inclusion of a crosswalk below does not imply NIST endorsement of the resource the AI RMF is mapped to, nor does it imply that either resource comprehensively covers the contents of the other". See Comparison of ISO/IEC 42001 and the NIST AI RMF and the ISO/IEC 42001 pages.

EU AI Act: the EU AI Act (Regulation (EU) 2024/1689) is law in the European Union. The NIST AI RMF is voluntary guidance. NIST AI 100-1 gives "law- and regulation-agnostic" as an attribute of the framework (Appendix D, attribute 9). See Comparison of the NIST AI RMF and the EU AI Act and the EU AI Act pages.

OWASP Top 10 for LLM Applications: the OWASP Top 10 for LLM Applications gives security risks for software that uses large language models. It is a different document from the NIST AI RMF. See OWASP Top 10 for LLM Applications.

For more frameworks, see Comparison of AI governance frameworks.

NIST AI RMF in Modulos ​

Modulos gives NIST AI RMF 1.0 as two Frameworks with the name "NIST AI RMF". You add MFF-3 to an AI System, and you add OFF-3 to the organization AI System (the AI System for all of your organization). Each Requirement has the name of one subcategory of NIST AI 100-1. The two Frameworks have Requirements in all four functions, and together they have all the subcategories. For the set-up, the Requirement for each subcategory, and the sequence of work that Modulos recommends, see Operationalizing NIST AI RMF in Modulos.

Where to go next ​

NIST AI RMF Govern function

The six GOVERN categories and the 19 GOVERN subcategories, with the NIST text of each outcome

NIST AI RMF Map function

The five MAP categories and the 18 MAP subcategories, with the NIST text of each outcome

NIST AI RMF Measure function

The four MEASURE categories and the 22 MEASURE subcategories, with the NIST text of each outcome

NIST AI RMF Manage function

The four MANAGE categories and the 13 MANAGE subcategories, with the NIST text of each outcome

Trustworthy AI characteristics

The seven characteristics of NIST AI 100-1 Section 3 and their tradeoffs

Generative AI Profile (NIST AI 600-1)

The 12 risks of generative AI and the suggested actions of NIST AI 600-1

Operationalizing NIST AI RMF in Modulos

MFF-3 and OFF-3, the Requirement for each subcategory, and the sequence of work

Frequently asked questions about the NIST AI RMF ​

For FAQs and the full rules, see Frequently asked questions about the NIST AI RMF.

Sources of this page ​

Disclaimer

This page gives general information. It is not legal advice.