NIST AI RMF Measure Function

The MEASURE function is one of the four functions of the Core of NIST AI RMF 1.0 (NIST AI 100-1, January 2023). In Section 5.3, NIST writes that the MEASURE function "employs quantitative, qualitative, or mixed-method tools, techniques, and methodologies to analyze, assess, benchmark, and monitor AI risk and related impacts". The function has four categories and 22 subcategories (Table 3). Each subcategory is an outcome. The AI RMF is voluntary guidance, and its outcomes are not obligations.

As of October 2026, the AI RMF page of NIST gives this information: AI RMF 1.0 "is being revised as part of the White House AI Action Plan". No new AI RMF is available at that date. Thus, the MEASURE outcomes on this page are from AI RMF 1.0 of January 2023. For the status of the AI RMF, see The framework and its status on the page NIST AI Risk Management Framework 1.0 (NIST AI RMF).

Primary sources

NIST AI 100-1, AI RMF 1.0 (January 2023): Section 5.3 (the MEASURE function) and Table 3 (the MEASURE categories and subcategories).

How Measure fits into NIST AI RMF 1.0

NIST AI 100-1, Section 5.3 gives this information about the MEASURE function:

• It uses "knowledge relevant to AI risks identified in the MAP function and informs the MANAGE function".
• "AI systems should be tested before their deployment and regularly while in operation."
• "Measuring AI risks includes tracking metrics for trustworthy characteristics, social impact, and human-AI configurations."
• "Processes for independent review can improve the effectiveness of testing and can mitigate internal biases and potential conflicts of interest."
• "After completing the MEASURE function, objective, repeatable, or scalable test, evaluation, verification, and validation (TEVV) processes including metrics, methods, and methodologies are in place, followed, and documented."

Section 5.3 ends with the relation between MEASURE and MANAGE:

NIST AI 100-1, Section 5.3: Measurement outcomes will be utilized in the MANAGE function to assist risk monitoring and response efforts. It is incumbent on Framework users to continue applying the MEASURE function to AI systems as knowledge, methodologies, risks, and impacts evolve over time.

For the sequence of the four functions and the relation of GOVERN to the other functions, see The four functions of the Core. This section is on the page NIST AI Risk Management Framework 1.0 (NIST AI RMF).

The four MEASURE categories

NIST AI 100-1, Table 3 puts the 22 MEASURE subcategories in four categories.

MEASUREAnalyze, assess, benchmark, and monitor AI risk (NIST AI 100-1, Section 5.3)

MEASURE 1Appropriate methods and metrics are identified and applied. 3 subcategories

MEASURE 2AI systems are evaluated for trustworthy characteristics. 13 subcategories

MEASURE 3Mechanisms for tracking identified AI risks over time are in place. 3 subcategories

MEASURE 4Feedback about efficacy of measurement is gathered and assessed. 3 subcategories

MEASURE 1

NIST AI 100-1, Table 3, MEASURE 1: Appropriate methods and metrics are identified and applied.

The category MEASURE 1 of NIST AI 100-1 has three subcategories, MEASURE 1.1 to 1.3.

MEASURE 1.1

NIST AI 100-1, Table 3: Approaches and metrics for measurement of AI risks enumerated during the MAP function are selected for implementation starting with the most significant AI risks. The risks or trustworthiness characteristics that will not – or cannot – be measured are properly documented.

MEASURE 1.2

NIST AI 100-1, Table 3: Appropriateness of AI metrics and effectiveness of existing controls are regularly assessed and updated, including reports of errors and potential impacts on affected communities.

MEASURE 1.3

NIST AI 100-1, Table 3: Internal experts who did not serve as front-line developers for the system and/or independent assessors are involved in regular assessments and updates. Domain experts, users, AI actors external to the team that developed or deployed the AI system, and affected communities are consulted in support of assessments as necessary per organizational risk tolerance.

MEASURE 1.3 refers to "organizational risk tolerance". NIST AI 100-1 "does not prescribe risk tolerance" (Section 1.2.2). See AI risk in NIST AI 100-1 on the page NIST AI Risk Management Framework 1.0 (NIST AI RMF).

MEASURE 2: AI systems are evaluated for trustworthy characteristics

NIST AI 100-1, Table 3, MEASURE 2: AI systems are evaluated for trustworthy characteristics.

The category MEASURE 2 of NIST AI 100-1 has 13 subcategories. This page puts them in four groups:

• The first four (MEASURE 2.1 to 2.4) are about TEVV (test, evaluation, verification, and validation) documentation, human subjects, "performance or assurance criteria", and monitoring "when in production".
• The next seven (MEASURE 2.5 to 2.11) are about the seven characteristics of trustworthy AI.
• MEASURE 2.12 is about "Environmental impact and sustainability of AI model training and management activities". This outcome is not about one of the seven characteristics.
• MEASURE 2.13 is about the "Effectiveness of the employed TEVV metrics and processes".

NIST AI 100-1 does not give a one-to-one mapping between these seven subcategories and the seven characteristics. The text of some subcategories also refers to a different characteristic. For example, in MEASURE 2.6 the safety metrics "reflect system reliability and robustness". In NIST AI 100-1, reliability and robustness are part of Section 3.1 (valid and reliable). See the characteristics and their MEASURE subcategories.

MEASURE 2.1

NIST AI 100-1, Table 3: Test sets, metrics, and details about the tools used during TEVV are documented.

MEASURE 2.2

NIST AI 100-1, Table 3: Evaluations involving human subjects meet applicable requirements (including human subject protection) and are representative of the relevant population.

MEASURE 2.3

NIST AI 100-1, Table 3: AI system performance or assurance criteria are measured qualitatively or quantitatively and demonstrated for conditions similar to deployment setting(s). Measures are documented.

MEASURE 2.4

NIST AI 100-1, Table 3: The functionality and behavior of the AI system and its components – as identified in the MAP function – are monitored when in production.

MEASURE 2.5

NIST AI 100-1, Table 3: The AI system to be deployed is demonstrated to be valid and reliable. Limitations of the generalizability beyond the conditions under which the technology was developed are documented.

MEASURE 2.6

NIST AI 100-1, Table 3: The AI system is evaluated regularly for safety risks – as identified in the MAP function. The AI system to be deployed is demonstrated to be safe, its residual negative risk does not exceed the risk tolerance, and it can fail safely, particularly if made to operate beyond its knowledge limits. Safety metrics reflect system reliability and robustness, real-time monitoring, and response times for AI system failures.

MEASURE 2.7

NIST AI 100-1, Table 3: AI system security and resilience – as identified in the MAP function – are evaluated and documented.

MEASURE 2.8

NIST AI 100-1, Table 3: Risks associated with transparency and accountability – as identified in the MAP function – are examined and documented.

MEASURE 2.9

NIST AI 100-1, Table 3: The AI model is explained, validated, and documented, and AI system output is interpreted within its context – as identified in the MAP function – to inform responsible use and governance.

MEASURE 2.10

NIST AI 100-1, Table 3: Privacy risk of the AI system – as identified in the MAP function – is examined and documented.

MEASURE 2.11

NIST AI 100-1, Table 3: Fairness and bias – as identified in the MAP function – are evaluated and results are documented.

For the three categories of AI bias in Section 3.7 of NIST AI 100-1, see Fair – with Harmful Bias Managed.

MEASURE 2.12

NIST AI 100-1, Table 3: Environmental impact and sustainability of AI model training and management activities – as identified in the MAP function – are assessed and documented.

MEASURE 2.13

NIST AI 100-1, Table 3: Effectiveness of the employed TEVV metrics and processes in the MEASURE function are evaluated and documented.

MEASURE 3

NIST AI 100-1, Table 3, MEASURE 3: Mechanisms for tracking identified AI risks over time are in place.

The category MEASURE 3 of NIST AI 100-1 has three subcategories, MEASURE 3.1 to 3.3.

MEASURE 3.1

NIST AI 100-1, Table 3: Approaches, personnel, and documentation are in place to regularly identify and track existing, unanticipated, and emergent AI risks based on factors such as intended and actual performance in deployed contexts.

MEASURE 3.2

NIST AI 100-1, Table 3: Risk tracking approaches are considered for settings where AI risks are difficult to assess using currently available measurement techniques or where metrics are not yet available.

MEASURE 3.3

NIST AI 100-1, Table 3: Feedback processes for end users and impacted communities to report problems and appeal system outcomes are established and integrated into AI system evaluation metrics.

MEASURE 4

NIST AI 100-1, Table 3, MEASURE 4: Feedback about efficacy of measurement is gathered and assessed.

The category MEASURE 4 of NIST AI 100-1 has three subcategories, MEASURE 4.1 to 4.3.

For the evaluation of the TEVV metrics, see MEASURE 2.13.

MEASURE 4.1

NIST AI 100-1, Table 3: Measurement approaches for identifying AI risks are connected to deployment context(s) and informed through consultation with domain experts and other end users. Approaches are documented.

MEASURE 4.2

NIST AI 100-1, Table 3: Measurement results regarding AI system trustworthiness in deployment context(s) and across the AI lifecycle are informed by input from domain experts and relevant AI actors to validate whether the system is performing consistently as intended. Results are documented.

MEASURE 4.3

NIST AI 100-1, Table 3: Measurable performance improvements or declines based on consultations with relevant AI actors, including affected communities, and field data about context-relevant risks and trustworthiness characteristics are identified and documented.

MEASURE in Modulos

In Modulos, the MEASURE subcategories of NIST AI RMF 1.0 are Requirements in two Frameworks. You add MFF-3 to each AI System, and you add OFF-3 to the organization AI System. Only OFF-3 has a Requirement for MEASURE 2.1. Each other MEASURE subcategory has a Requirement in MFF-3, and some also have one in OFF-3. For the Requirement of each MEASURE subcategory, see the Requirements.

Where to go next

To compare the AI RMF with ISO/IEC 42001 and the EU AI Act, see How NIST AI RMF compares to other frameworks.

NIST AI RMF overview

The AI RMF, its four functions, its profiles, and the status of its revision

NIST AI RMF Map function

The context of an AI system, and its risks and impacts

NIST AI RMF Manage function

The response to the mapped and measured AI risks

Trustworthy AI characteristics

The seven characteristics of Section 3, with MEASURE 2.5 to 2.11

Sources of this page

• NIST AI 100-1 — Artificial Intelligence Risk Management Framework (AI RMF 1.0), January 2023: Executive Summary, Section 1.2.2 (risk tolerance), Section 3.7 (bias), Section 5 (the Core), Section 5.3 (MEASURE), and Table 3. PDF.
• NIST AI Risk Management Framework page — the status of the revision of AI RMF 1.0, as of October 2026. NIST page.
• NIST AI RMF Playbook — an "online companion resource" to the AI RMF (NIST AI 100-1, Section 5), with "suggested actions for achieving the outcomes laid out in the AI Risk Management Framework (AI RMF) Core". Its use is voluntary. The Playbook page gives this information: "The Playbook will be updated after the AI RMF is revised." Playbook page.

Disclaimer

This page gives general information only. It is not legal advice.