NIST AI RMF Govern Function

GOVERN is one of the four functions of the Core of the NIST AI Risk Management Framework (AI RMF 1.0, NIST AI 100-1, January 2023). NIST AI 100-1 is voluntary guidance. It gives outcomes, and it sets no obligations for organizations. Table 1 of NIST AI 100-1 divides GOVERN into six categories (GOVERN 1 to GOVERN 6) and 19 subcategories. This page gives the outcome of each category and subcategory from Table 1.

NIST AI 100-1, Section 5.1, gives these points about the GOVERN function:

• It "cultivates and implements a culture of risk management within organizations designing, developing, deploying, evaluating, or acquiring AI systems".
• It "outlines processes, documents, and organizational schemes that anticipate, identify, and manage the risks a system can pose, including to users and others across society – and procedures to achieve those outcomes".
• It "incorporates processes to assess potential impacts".
• It "provides a structure by which AI risk management functions can align with" the "principles, policies, and strategic priorities" of the organization.
• It "connects technical aspects of AI system design and development to organizational values and principles, and enables organizational practices and competencies for the individuals involved in acquiring, training, deploying, and monitoring such systems".
• It "addresses full product lifecycle and associated processes, including legal and other issues concerning use of third-party software or hardware systems and data".

Primary sources

The GOVERN function is in NIST AI 100-1, Section 5.1 and Table 1. As of October 2026, the AI RMF page of NIST gives this information: "The AI RMF 1.0 is being revised as part of the White House AI Action Plan." For more information, see the section about the framework on the NIST AI RMF page.

How Govern fits into NIST AI RMF 1.0

NIST AI 100-1, Section 5.1, gives the relation of GOVERN to the other functions:

NIST AI 100-1, Section 5.1: GOVERN is a cross-cutting function that is infused throughout AI risk management and enables the other functions of the process. Aspects of GOVERN, especially those related to compliance or evaluation, should be integrated into each of the other functions. Attention to governance is a continual and intrinsic requirement for effective AI risk management over an AI system's lifespan and the organization's hierarchy.

Section 5.1 also tells Framework users that it is "incumbent" on them to continue the GOVERN function "as knowledge, cultures, and needs or expectations from AI actors evolve over time".

In the Executive Summary of NIST AI 100-1, GOVERN "applies to all stages of organizations' AI risk management processes and procedures", and MAP, MEASURE, and MANAGE "can be applied in AI system-specific contexts and at specific stages of the AI lifecycle".

For more information, see the section about the four functions on the NIST AI RMF page.

The six GOVERN categories

NIST AI 100-1 Table 1 gives six GOVERN categories with 19 subcategories in total. Below are the six categories, each with its number of subcategories.

GOVERNCross-cutting function, NIST AI RMF 1.0

GOVERN 1Policies, processes, procedures, and practices (7 subcategories)

GOVERN 2Accountability structures (3 subcategories)

GOVERN 3Workforce diversity, equity, inclusion, and accessibility (2 subcategories)

GOVERN 4Organizational culture (3 subcategories)

GOVERN 5Engagement with relevant AI actors (2 subcategories)

GOVERN 6Third-party software, data, and supply chain (2 subcategories)

GOVERN 1

NIST AI 100-1, Table 1, GOVERN 1: Policies, processes, procedures, and practices across the organization related to the mapping, measuring, and managing of AI risks are in place, transparent, and implemented effectively.

GOVERN 1.1 Legal and regulatory requirements

NIST AI 100-1, Table 1: Legal and regulatory requirements involving AI are understood, managed, and documented.

GOVERN 1.2 Trustworthy AI characteristics in policy

NIST AI 100-1, Table 1: The characteristics of trustworthy AI are integrated into organizational policies, processes, procedures, and practices.

Section 3 of NIST AI 100-1 gives seven characteristics of trustworthy AI. They are valid and reliable, safe, secure and resilient, accountable and transparent, explainable and interpretable, privacy-enhanced, and "fair – with harmful bias managed" (see Trustworthy AI characteristics).

GOVERN 1.3

NIST AI 100-1, Table 1: Processes, procedures, and practices are in place to determine the needed level of risk management activities based on the organization's risk tolerance.

GOVERN 1.3 uses the risk tolerance of the organization. The AI RMF "does not prescribe risk tolerance" (Section 1.2.2). MAP 1.5 is the outcome in which "Organizational risk tolerances are determined and documented". For more information, see risk tolerance on the NIST AI RMF page.

GOVERN 1.4 Transparent risk management

NIST AI 100-1, Table 1: The risk management process and its outcomes are established through transparent policies, procedures, and other controls based on organizational risk priorities.

GOVERN 1.5

NIST AI 100-1, Table 1: Ongoing monitoring and periodic review of the risk management process and its outcomes are planned and organizational roles and responsibilities clearly defined, including determining the frequency of periodic review.

GOVERN 1.6 AI system inventory

NIST AI 100-1, Table 1: Mechanisms are in place to inventory AI systems and are resourced according to organizational risk priorities.

GOVERN 1.7

NIST AI 100-1, Table 1: Processes and procedures are in place for decommissioning and phasing out AI systems safely and in a manner that does not increase risks or decrease the organization's trustworthiness.

GOVERN 2: Accountability structures

NIST AI 100-1, Table 1, GOVERN 2: Accountability structures are in place so that the appropriate teams and individuals are empowered, responsible, and trained for mapping, measuring, and managing AI risks.

GOVERN 2.1

NIST AI 100-1, Table 1: Roles and responsibilities and lines of communication related to mapping, measuring, and managing AI risks are documented and are clear to individuals and teams throughout the organization.

GOVERN 2.2 Training and competence

NIST AI 100-1, Table 1: The organization's personnel and partners receive AI risk management training to enable them to perform their duties and responsibilities consistent with related policies, procedures, and agreements.

GOVERN 2.3

NIST AI 100-1, Table 1: Executive leadership of the organization takes responsibility for decisions about risks associated with AI system development and deployment.

GOVERN 3: Workforce diversity, equity, inclusion, and accessibility

As of October 2026, the AI RMF page of NIST gives this information: "The AI RMF 1.0 is being revised as part of the White House AI Action Plan". NIST shows no new version of AI RMF 1.0. The text of GOVERN 3 on this page is from NIST AI 100-1 of January 2023.

America's AI Action Plan (The White House, July 2025), which is policy and not law, recommends that NIST "eliminate references to misinformation, Diversity, Equity, and Inclusion, and climate change" from the framework. For more information, see the status section of the NIST AI RMF page.

NIST AI 100-1, Table 1, GOVERN 3: Workforce diversity, equity, inclusion, and accessibility processes are prioritized in the mapping, measuring, and managing of AI risks throughout the lifecycle.

GOVERN 3.1

NIST AI 100-1, Table 1: Decision-making related to mapping, measuring, and managing AI risks throughout the lifecycle is informed by a diverse team (e.g., diversity of demographics, disciplines, experience, expertise, and backgrounds).

GOVERN 3.2

NIST AI 100-1, Table 1: Policies and procedures are in place to define and differentiate roles and responsibilities for human-AI configurations and oversight of AI systems.

GOVERN 4: Organizational culture

NIST AI 100-1, Table 1, GOVERN 4: Organizational teams are committed to a culture that considers and communicates AI risk.

GOVERN 4.1 Critical thinking and safety-first culture

NIST AI 100-1, Table 1: Organizational policies and practices are in place to foster a critical thinking and safety-first mindset in the design, development, deployment, and uses of AI systems to minimize potential negative impacts.

GOVERN 4.2

NIST AI 100-1, Table 1: Organizational teams document the risks and potential impacts of the AI technology they design, develop, deploy, evaluate, and use, and they communicate about the impacts more broadly.

GOVERN 4.3

NIST AI 100-1, Table 1: Organizational practices are in place to enable AI testing, identification of incidents, and information sharing.

GOVERN 5

NIST AI 100-1, Table 1, GOVERN 5: Processes are in place for robust engagement with relevant AI actors.

Appendix A of NIST AI 100-1 gives the tasks of AI actors, for example AI design, AI development, AI deployment, TEVV, and governance and oversight. Appendix A also gives "Additional AI Actors", for example third-party entities, end users, and affected individuals and communities. For more information, see AI actors on the NIST AI RMF page. GOVERN 5.1 is about policies and practices "to collect, consider, prioritize, and integrate feedback from those external to the team that developed or deployed the AI system regarding the potential individual and societal impacts related to AI risks". GOVERN 5.2 is about mechanisms "to enable the team that developed or deployed AI systems to regularly incorporate adjudicated feedback from relevant AI actors into system design and implementation".

GOVERN 5.1

NIST AI 100-1, Table 1: Organizational policies and practices are in place to collect, consider, prioritize, and integrate feedback from those external to the team that developed or deployed the AI system regarding the potential individual and societal impacts related to AI risks.

GOVERN 5.2

NIST AI 100-1, Table 1: Mechanisms are established to enable the team that developed or deployed AI systems to regularly incorporate adjudicated feedback from relevant AI actors into system design and implementation.

GOVERN 6

NIST AI 100-1, Table 1, GOVERN 6: Policies and procedures are in place to address AI risks and benefits arising from third-party software and data and other supply chain issues.

GOVERN 6.1 Third-party AI risk policies

NIST AI 100-1, Table 1: Policies and procedures are in place that address AI risks associated with third-party entities, including risks of infringement of a third-party's intellectual property or other rights.

GOVERN 6.2

NIST AI 100-1, Table 1: Contingency processes are in place to handle failures or incidents in third-party data or AI systems deemed to be high-risk.

GOVERN 6.2 applies only to third-party data or AI systems "deemed to be high-risk".

GOVERN in Modulos

Modulos has two Frameworks with the name NIST AI RMF: MFF-3 for an AI System and OFF-3 for the Organization. The two Frameworks have Govern Requirements. Some Govern subcategories have a Requirement in each Framework, and others are in one Framework only. For example, Govern 1.1 and Govern 2.3 are only in OFF-3, and Govern 6.1 and Govern 6.2 are only in MFF-3. The page Operationalizing NIST AI RMF in Modulos gives the Requirement for each subcategory and the steps that Modulos recommends.

Where to go next

The section about other frameworks on the NIST AI RMF page compares the AI RMF with ISO/IEC 42001 and the EU AI Act.

NIST AI RMF overview

The framework, the four functions, and profiles

NIST AI RMF Map function

MAP 1 to MAP 5: the context of the risks of an AI system

Operationalizing NIST AI RMF in Modulos

MFF-3 and OFF-3, the Requirement for each subcategory, and the steps

ISO/IEC 42001 vs NIST AI RMF

The NIST AI RMF and ISO/IEC 42001 side by side

Sources of this page

• NIST AI 100-1 — Artificial Intelligence Risk Management Framework (AI RMF 1.0), National Institute of Standards and Technology, January 2023. PDF. This page uses the Executive Summary, Sections 1.2.2, 3, 5, and 5.1, Table 1, and Appendix A.
• AI RMF page of NIST — National Institute of Standards and Technology: the information about AI RMF 1.0 and the White House AI Action Plan. NIST page.
• NIST AI RMF Playbook — an "online companion resource to the AI RMF" (NIST AI 100-1, Section 5), with suggested actions for the outcomes of the Core. In the same section, NIST writes: "Like the AI RMF, the Playbook is voluntary". Playbook page.
• America's AI Action Plan — The White House, July 2025: the recommended policy action about the AI RMF. PDF.

Disclaimer

This page gives only general information. It is not legal advice. Always compare this page with NIST AI 100-1.