The NIST AI Risk Management Framework: govern, map, measure and manage
The NIST AI Risk Management Framework is a voluntary resource that helps organizations manage risks from artificial intelligence. It is structured around four functions: Govern, Map, Measure, and Manage. The framework is supported by a Playbook, a Generative AI Profile, and other guidance.
Purpose and development of the AI RMF
The NIST AI Risk Management Framework helps organizations manage risks to individuals, organizations, and society from artificial intelligence. It is voluntary and aims to improve the ability to integrate trustworthiness into the design, development, use, and evaluation of AI products and services.
The framework was created through an open and collaborative process that included a request for information, public drafts, and multiple workshops. It was released in January and has since been complemented by additional resources.
The four functions
The NIST AI RMF Playbook offers suggestions for navigating and using the AI RMF to incorporate trustworthiness throughout the AI lifecycle. It provides actions, references, and guidance to achieve the outcomes of the four functions: Govern, Map, Measure, and Manage.
Govern establishes governance structures and processes. Map focuses on understanding context and potential impacts. Measure involves assessing and evaluating risks and performance. Manage involves responding to and mitigating identified risks. These functions are iterative and should be applied throughout the AI lifecycle.
Generative AI and bias considerations
The NIST Generative AI Profile is a companion resource to the AI RMF. It helps organizations identify unique risks posed by generative AI and suggests actions for managing those risks in line with their goals.
Bias is a significant concern in AI systems. NIST's publication on bias notes that bias is pervasive in technology and can cause harmful impacts even when unintentional.
Supporting tools and international alignment
The OECD.AI catalogue of tools offers a collection of tools and metrics designed to help AI actors develop trustworthy AI systems that respect human rights and are fair, transparent, explainable, secure, and safe. This catalogue complements the NIST framework by providing practical resources for implementation.
Organizations can combine the AI RMF with other resources, such as the AI Resource Center and the AI RMF Crosswalk, to support their risk management efforts.
| Function | Focus | Example Actions |
|---|---|---|
| Govern | Establish governance structures and processes | Define policies, assign roles, develop accountability measures |
| Map | Understand context and potential impacts | Identify risks, analyze AI lifecycle, document use cases |
| Measure | Assess and evaluate risks and performance | Conduct testing, monitor metrics, validate trustworthiness |
| Manage | Respond to and mitigate identified risks | Implement controls, plan responses, communicate incidents |
Frequently asked questions
What is the NIST AI Risk Management Framework?
The NIST AI RMF is a voluntary framework that helps organizations manage risks associated with artificial intelligence. It focuses on incorporating trustworthiness considerations into the design, development, use, and evaluation of AI systems.
What are the four functions of the AI RMF?
The four functions are Govern, Map, Measure, and Manage. They are designed to be applied iteratively throughout the AI lifecycle to ensure comprehensive risk management.
How does the Generative AI Profile relate to the AI RMF?
The Generative AI Profile is a cross-sectoral companion resource that helps organizations identify unique risks posed by generative AI and suggests actions for managing those risks in alignment with the AI RMF.
What is the AI RMF Playbook?
The AI RMF Playbook is a companion document that suggests actions, references, and guidance to help organizations achieve the outcomes of the four functions. It is intended for voluntary use and can be tailored to specific use cases.