NIST AI RMF Trustworthy AI Characteristics (NIST AI 100-1)

NIST AI 100-1, the Artificial Intelligence Risk Management Framework (AI RMF 1.0) of January 2023, gives seven characteristics of trustworthy AI in Section 3:

• valid and reliable
• safe
• secure and resilient
• accountable and transparent
• explainable and interpretable
• privacy-enhanced
• fair – with harmful bias managed.

The AI RMF is voluntary guidance for organizations and AI actors, and it is not law. Some outcomes of the AI RMF Core use the characteristics. Two examples are GOVERN 1.2 for the policies of the organization, and MEASURE 2 for the evaluation of AI systems.

As of October 2026, the AI RMF page of NIST has this information: "The AI RMF 1.0 is being revised as part of the White House AI Action Plan." No changed AI RMF is available from NIST. Thus, the characteristics on this page come from AI RMF 1.0 of January 2023. For more information, see the NIST AI RMF page.

Primary sources

NIST AI 100-1, Artificial Intelligence Risk Management Framework (AI RMF 1.0), January 2023: Section 3 with Figure 4, and Sections 3.1 to 3.7, for the characteristics. For their use in the Core: GOVERN 1.2 in Table 1, Section 5.3, and MEASURE 2 in Table 3. The NIST AI 100-1 PDF has the full framework.

How the trustworthy AI characteristics fit into NIST AI RMF 1.0

NIST AI 100-1 gives the characteristics in Section 3, in Part 1 of the framework. Section 3 tells organizations that "Creating trustworthy AI requires balancing each of these characteristics based on the AI system’s context of use." Part 2, the AI RMF Core, uses the characteristics in some outcomes. Two of these outcomes are:

• GOVERN 1.2 in Table 1: the outcome is that the characteristics of trustworthy AI are made part of "organizational policies, processes, procedures, and practices". See GOVERN 1.2 on the GOVERN page.
• MEASURE 2 in Table 3: in this category, AI systems are evaluated for trustworthy characteristics. MEASURE 2 has 13 subcategories, MEASURE 2.1 to MEASURE 2.13.

The MEASURE function is about more than the characteristics. Section 5.3 of NIST AI 100-1 gives this information: "Measuring AI risks includes tracking metrics for trustworthy characteristics, social impact, and human-AI configurations." For more on the function, see How Measure fits into NIST AI RMF 1.0.

The table below is how this page reads Table 3 of NIST AI 100-1. For each characteristic, the table gives the MEASURE 2 subcategory that is most directly related to it. NIST does not give a one-to-one mapping. For example, in MEASURE 2.6 (safe), the safety metrics also show system reliability and robustness. In MEASURE 2.9, "The AI model is explained, validated, and documented, and AI system output is interpreted within its context".

Characteristic	Section of NIST AI 100-1	Related MEASURE subcategory
Valid and reliable	3.1	MEASURE 2.5
Safe	3.2	MEASURE 2.6
Secure and resilient	3.3	MEASURE 2.7
Accountable and transparent	3.4	MEASURE 2.8
Explainable and interpretable	3.5	MEASURE 2.9
Privacy-enhanced	3.6	MEASURE 2.10
Fair – with harmful bias managed	3.7	MEASURE 2.11

In the table above, no characteristic has MEASURE 2.1 to MEASURE 2.4, MEASURE 2.12, or MEASURE 2.13 as its related subcategory. For example, MEASURE 2.12 is about "Environmental impact and sustainability of AI model training and management activities". MEASURE 2.13 is about the evaluation and documentation of the "Effectiveness of the employed TEVV metrics and processes in the MEASURE function".

Figure 4 and the tradeoffs between the characteristics

NIST AI 100-1 shows the seven characteristics in Figure 4. In Figure 4, NIST gives two relations between the characteristics:

NIST AI 100-1, Figure 4: Characteristics of trustworthy AI systems. Valid & Reliable is a necessary condition of trustworthiness and is shown as the base for other trustworthiness characteristics. Accountable & Transparent is shown as a vertical box because it relates to all other characteristics.

In Figure 4, NIST gives no sequence for the other five characteristics.

Section 3 of NIST AI 100-1 also gives these points about all the characteristics:

• "While all characteristics are socio-technical system attributes, accountability and transparency also relate to the processes and activities internal to an AI system and its external setting".
• NIST recommends this for the selection of metrics: "Human judgment should be employed when deciding on the specific metrics related to AI trustworthiness characteristics and the precise threshold values for those metrics."
• "Understanding and treatment of trustworthiness characteristics depends on an AI actor’s particular role within the AI lifecycle."

Section 3 gives these points about the tradeoffs between the characteristics:

• If an organization works on each characteristic independently, that work does not make sure that the AI system is trustworthy. Tradeoffs usually occur. It is not usual that all characteristics apply in all contexts, and some characteristics are more important or less important in a given condition.
• Trustworthiness "is a social concept that ranges across a spectrum and is only as strong as its weakest characteristics".
• Organizations can find it hard to balance the characteristics when they manage AI risks. NIST gives three examples. There can be a tradeoff "between optimizing for interpretability and achieving privacy" or "between predictive accuracy and interpretability". Also, "privacy-enhancing techniques can result in a loss in accuracy" in some conditions (see Privacy-Enhanced).
• To find a balance between the characteristics, it is necessary to know the context of the decision. NIST adds: "These analyses can highlight the existence and extent of tradeoffs between different measures, but they do not answer questions about how to navigate the tradeoff. Those depend on the values at play in the relevant context and should be resolved in a manner that is both transparent and appropriately justifiable."

On page 13, before Section 3.1, NIST AI 100-1 gives this information about the relations between the characteristics:

NIST AI 100-1, Section 3: Trustworthiness characteristics explained in this document influence each other. … A comprehensive approach to risk management calls for balancing tradeoffs among the trustworthiness characteristics.

The same text on page 13 gives these points:

• Three types of system are "all undesirable": "Highly secure but unfair systems, accurate but opaque and uninterpretable systems, and inaccurate but secure, privacy-enhanced, and transparent systems".
• It is "the joint responsibility of all AI actors to determine whether AI technology is an appropriate or necessary tool for a given context or purpose, and how to use it responsibly".
• NIST recommends this: "The decision to commission or deploy an AI system should be based on a contextual assessment" of the trustworthiness characteristics and "the relative risks, impacts, costs, and benefits, and informed by a broad set of interested parties".

The seven characteristics

NIST AI 100-1, Section 3, gives the seven characteristics below. Each item has short information from its subsection or from Figure 4. The sections after this one give the important points that NIST makes about each characteristic.

Trustworthy AISeven characteristics, NIST AI 100-1 Section 3

Valid and ReliableNecessary condition of trustworthiness, the base in Figure 4

SafeAI systems should not endanger life, health, property, or the environment under defined conditions

Secure and ResilientResilience to unexpected adverse events, and protection against attacks

Accountable and TransparentRelates to all other characteristics (Figure 4)

Explainable and InterpretableThe mechanisms of operation, and the meaning of output in context

Privacy-EnhancedNorms and practices that help to keep autonomy, identity, and dignity safe

Fair – with Harmful Bias ManagedEquality and equity, with harmful bias and discrimination addressed

Valid and Reliable

NIST AI 100-1, Section 3.1, gives this information about validation and reliability:

NIST AI 100-1, Section 3.1: Validation is the “confirmation, through the provision of objective evidence, that the requirements for a specific intended use or application have been fulfilled” (Source: ISO 9000:2015). Deployment of AI systems which are inaccurate, unreliable, or poorly generalized to data and settings beyond their training creates and increases negative AI risks and reduces trustworthiness. Reliability is defined in the same standard as the “ability of an item to perform as required, without failure, for a given time interval, under given conditions” (Source: ISO / IEC TS 5723:2022). Reliability is a goal for overall correctness of AI system operation under the conditions of expected use and over a given period of time, including the entire lifetime of the system.

Section 3.1 also gives these points:

• "Accuracy and robustness contribute to the validity and trustworthiness of AI systems, and can be in tension with one another in AI systems."
• NIST recommends this: "Accuracy measurements should always be paired with clearly defined and realistic test sets – that are representative of conditions of expected use – and details about test methodology; these should be included in associated documentation".
• "Robustness is a goal for appropriate system functionality in a broad set of conditions and circumstances, including uses of AI systems not initially anticipated". "Robustness requires not only that the system perform exactly as it does under expected uses, but also that it should perform in ways that minimize potential harms to people if it is operating in an unexpected setting."
• "Validity and reliability for deployed AI systems are often assessed by ongoing testing or monitoring that confirms a system is performing as intended."

In Figure 4, valid and reliable is "shown as the base for other trustworthiness characteristics" (see Figure 4). The MEASURE subcategory that is most directly related to this characteristic is MEASURE 2.5.

Safe

NIST AI 100-1, Section 3.2, uses ISO/IEC TS 5723:2022 for safe AI systems:

NIST AI 100-1, Section 3.2: AI systems should “not under defined conditions, lead to a state in which human life, health, property, or the environment is endangered” (Source: ISO/IEC TS 5723:2022).

Section 3.2 also gives these points:

• "Safe operation of AI systems is improved through" four items. The items are "responsible design, development, and deployment practices", "clear information to deployers on responsible use of the system", "responsible decision-making by deployers and end users", and "explanations and documentation of risks based on empirical evidence of incidents".
• "Different types of safety risks may require tailored AI risk management approaches based on context and the severity of potential risks presented."
• "Safety risks that pose a potential risk of serious injury or death call for the most urgent prioritization and most thorough risk management process."
• "Employing safety considerations during the lifecycle and starting as early as possible with planning and design can prevent failures or conditions that can render a system dangerous."
• NIST recommends this: "AI safety risk management approaches should take cues from efforts and guidelines for safety in fields such as transportation and healthcare, and align with existing sector- or application-specific guidelines or standards."

The MEASURE subcategory that is most directly related to this characteristic is MEASURE 2.6.

Secure and Resilient

NIST AI 100-1, Section 3.3, adapts ISO/IEC TS 5723:2022 for resilience. "AI systems, as well as the ecosystems in which they are deployed, may be said to be resilient" in one of these two conditions:

• They "can withstand unexpected adverse events or unexpected changes in their environment or use".
• They "can maintain their functions and structure in the face of internal and external change and degrade safely and gracefully when this is necessary".

Then Section 3.3 gives this information about security:

NIST AI 100-1, Section 3.3: Common security concerns relate to adversarial examples, data poisoning, and the exfiltration of models, training data, or other intellectual property through AI system endpoints. AI systems that can maintain confidentiality, integrity, and availability through protection mechanisms that prevent unauthorized access and use may be said to be secure.

Section 3.3 also gives these points:

• Guidelines in the NIST Cybersecurity Framework and the NIST Risk Management Framework "are among those which are applicable here".
• "Security and resilience are related but distinct characteristics." A resilient system can "return to normal function after an unexpected adverse event". Security includes resilience, and it also includes "protocols to avoid, protect against, respond to, or recover from attacks".
• "Resilience relates to robustness and goes beyond the provenance of the data to encompass unexpected or adversarial use (or abuse or misuse) of the model or data."

The MEASURE subcategory that is most directly related to this characteristic is MEASURE 2.7. In NIST AI 600-1, this characteristic is one of the characteristics related to the Information Security risk (Section 2.9). See Information Security on the Generative AI Profile page.

Accountable and Transparent

NIST AI 100-1, Section 3.4, starts with the relation between accountability and transparency:

NIST AI 100-1, Section 3.4: Trustworthy AI depends upon accountability. Accountability presupposes transparency. Transparency reflects the extent to which information about an AI system and its outputs is available to individuals interacting with such a system – regardless of whether they are even aware that they are doing so. Meaningful transparency provides access to appropriate levels of information based on the stage of the AI lifecycle and tailored to the role or knowledge of AI actors or individuals interacting with or using the AI system. By promoting higher levels of understanding, transparency increases confidence in the AI system.

Section 3.4 also gives these points:

• "Transparency is often necessary for actionable redress related to AI system outputs that are incorrect or otherwise lead to negative impacts."
• "A transparent system is not necessarily an accurate, privacy-enhanced, secure, or fair system. However, it is difficult to determine whether an opaque system possesses such characteristics, and to do so over time as complex systems evolve."
• "When consequences are severe, such as when life and liberty are at stake, AI developers and deployers should consider proportionally and proactively adjusting their transparency and accountability practices."
• "Maintaining the provenance of training data and supporting attribution of the AI system’s decisions to subsets of training data can assist with both transparency and accountability."

In Figure 4, accountable and transparent "is shown as a vertical box because it relates to all other characteristics" (see Figure 4). The MEASURE subcategory that is most directly related to this characteristic is MEASURE 2.8.

Explainable and Interpretable

NIST AI 100-1, Section 3.5, gives the difference between explainability and interpretability. Explainability "refers to a representation of the mechanisms underlying AI systems’ operation". Interpretability "refers to the meaning of AI systems’ output in the context of their designed functional purposes". Then Section 3.5 gives the relation between transparency, explainability, and interpretability:

NIST AI 100-1, Section 3.5: Transparency, explainability, and interpretability are distinct characteristics that support each other. Transparency can answer the question of “what happened” in the system.

Section 3.5 also gives these points:

• Explainability "can answer the question of “how” a decision was made in the system". Interpretability "can answer the question of “why” a decision was made by the system and its meaning or context to the user".
• "Together, explainability and interpretability assist those operating or overseeing an AI system, as well as users of an AI system, to gain deeper insights into the functionality and trustworthiness of the system, including its outputs."
• "Explainable and interpretable AI systems offer information that will help end users understand the purposes and potential impact of an AI system."
• "Risk from lack of explainability may be managed by describing how AI systems function, with descriptions tailored to individual differences such as the user’s role, knowledge, and skill level."
• "Risks to interpretability often can be addressed by communicating a description of why an AI system made a particular prediction or recommendation."

The MEASURE subcategory that is most directly related to this characteristic is MEASURE 2.9.

Privacy-Enhanced

NIST AI 100-1, Section 3.6, starts with this information about privacy:

NIST AI 100-1, Section 3.6: Privacy refers generally to the norms and practices that help to safeguard human autonomy, identity, and dignity. These norms and practices typically address freedom from intrusion, limiting observation, or individuals’ agency to consent to disclosure or control of facets of their identities (e.g., body, data, reputation).

Then Section 3.6 refers to the NIST Privacy Framework.

Section 3.6 also gives these points:

• "Privacy values such as anonymity, confidentiality, and control generally should guide choices for AI system design, development, and deployment."
• "Privacy-related risks may influence security, bias, and transparency and come with tradeoffs with these other characteristics."
• "AI systems can also present new risks to privacy by allowing inference to identify individuals or previously private information about individuals."
• "Privacy-enhancing technologies (“PETs”) for AI, as well as data minimizing methods such as de-identification and aggregation for certain model outputs, can support design for privacy-enhanced AI systems."
• "Under certain conditions such as data sparsity, privacy-enhancing techniques can result in a loss in accuracy, affecting decisions about fairness and other values in certain domains."

The MEASURE subcategory that is most directly related to this characteristic is MEASURE 2.10. In NIST AI 600-1, this characteristic is one of the characteristics related to the Data Privacy risk (Section 2.4). See Data Privacy on the Generative AI Profile page.

Fair – with Harmful Bias Managed

NIST AI 100-1, Section 3.7, starts with the scope of fairness: "Fairness in AI includes concerns for equality and equity by addressing issues such as harmful bias and discrimination". Section 3.7 adds that "Standards of fairness can be complex and difficult to define" because "perceptions of fairness differ among cultures and may shift depending on application". Then Section 3.7 gives the difference between mitigated bias and fairness:

NIST AI 100-1, Section 3.7: Systems in which harmful biases are mitigated are not necessarily fair. For example, systems in which predictions are somewhat balanced across demographic groups may still be inaccessible to individuals with disabilities or affected by the digital divide or may exacerbate existing disparities or systemic biases.

Section 3.7 also gives these points:

• "Bias is broader than demographic balance and data representativeness."
• NIST identifies "three major categories of AI bias to be considered and managed: systemic, computational and statistical, and human-cognitive". "Each of these can occur in the absence of prejudice, partiality, or discriminatory intent."
• Section 3.7 refers to NIST Special Publication 1270 for more information about bias and the three categories.

The MEASURE subcategory that is most directly related to this characteristic is MEASURE 2.11. In NIST AI 600-1, this characteristic is one of the characteristics related to the Harmful Bias and Homogenization risk (Section 2.6). See Harmful Bias and Homogenization on the Generative AI Profile page.

Trustworthy AI in Modulos

In Modulos, the two Frameworks with the name NIST AI RMF are MFF-3 for an AI System and OFF-3 for the Organization. The Requirements Measure 2.5 to Measure 2.11 are in MFF-3, and the Requirements Measure 2.7, Measure 2.8, and Measure 2.10 are also in OFF-3. The name of each Requirement is the name of one NIST subcategory. For the Requirement of each subcategory, see The Requirements on the page Operationalizing NIST AI RMF in Modulos.

Where to go next

For the relation of NIST AI RMF 1.0 to ISO/IEC 42001 and the EU AI Act, see How NIST AI RMF compares to other frameworks.

NIST AI RMF

The framework and how NIST changes it, the four functions of the Core, profiles, and how the framework compares with other frameworks

MEASURE function

The four MEASURE categories and 22 subcategories, with MEASURE 2.5 to MEASURE 2.11 for the characteristics

GOVERN function

The six GOVERN categories and 19 subcategories, with GOVERN 1.2 for the characteristics in policies

MAP function

The five MAP categories and 18 subcategories, for the context of an AI system

Generative AI Profile (NIST AI 600-1)

The 12 risks of generative AI, each with its related characteristics in NIST AI 600-1

Sources of this page

• NIST AI 100-1, Artificial Intelligence Risk Management Framework (AI RMF 1.0), January 2023 (PDF). This page uses these parts of it:
  • Section 3 and Figure 4.
  • Sections 3.1 to 3.7.
  • Section 5.3.
  • GOVERN 1.2 in Table 1 and MEASURE 2 in Table 3.
  • Appendix D, attribute 9.
• NIST AI 600-1, "Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile", July 2024 (PDF): Sections 2.4, 2.6, and 2.9.
• NIST, AI Risk Management Framework page: the status of AI RMF 1.0.
• NIST, AI RMF Playbook page: the Playbook gives voluntary suggested actions for the outcomes of the Core. The page also gives this information: "The Playbook will be updated after the AI RMF is revised."
• NIST, AI RMF crosswalks page on the AI Resource Center. This page uses these entries:
  • The AI RMF to ISO/IEC 42001 crosswalk.
  • The entry with the date January 26, 2023, that starts with "An illustration of how NIST AI RMF trustworthiness characteristics relate to" and names the "Proposed EU AI Act".
• Regulation (EU) 2024/1689 (EU AI Act): Chapter III, Section 2 (Articles 8 to 15).
• Section 3 of NIST AI 100-1 refers to these documents:
  • The NIST Cybersecurity Framework and the NIST Risk Management Framework (Section 3.3).
  • The NIST Privacy Framework (Section 3.6).
  • NIST Special Publication 1270, Towards a Standard for Identifying and Managing Bias in Artificial Intelligence (Section 3.7).

Disclaimer

This page gives general information only. It is not legal advice.