NIST AI RMF

Published by the US National Institute of Standards and Technology as NIST AI 100-1, the AI RMF is sector-agnostic and not legally binding, which makes it a common reference far beyond the United States. It describes the characteristics of trustworthy AI: valid and reliable, safe, secure and resilient, accountable and transparent, explainable and interpretable, privacy-enhanced, and fair with harmful bias managed.

Its core has four functions. Govern builds the culture, policies and accountability that run through everything else. Map establishes context and identifies risks for a specific system. Measure analyzes, assesses and tracks those risks with qualitative and quantitative methods. Manage prioritizes and acts on them, including responses to incidents. Each function breaks down into categories and subcategories, and companion profiles adapt the framework to specific uses; the Generative AI Profile (NIST AI 600-1) covers risks such as confabulation and information integrity. Organizations often combine the AI RMF with ISO/IEC 42001, using the first for risk practice and the second for a certifiable management system. Applying it is central to RAIP.