NIST AI RMF Explained: Functions, Categories, Profiles, and How to Implement It

The NIST AI Risk Management Framework (AI RMF), published as NIST AI 100-1, is a free, voluntary framework for identifying, measuring, and managing risks from AI systems. It is organized into four functions (GOVERN, MAP, MEASURE, and MANAGE) and describes seven characteristics of trustworthy AI. There is no NIST AI RMF certification. Organizations align with it and can describe that alignment, and many pair it with ISO/IEC 42001 when a customer wants a certificate.

NIST released AI RMF 1.0 on January 26, 2023. It was developed at the direction of the National Artificial Intelligence Initiative Act of 2020 and through a public process with input from industry, academia, and civil society. The full text is at nvlpubs.nist.gov, and supporting material lives on NIST's Trustworthy and Responsible AI Resource Center.

Who the NIST AI RMF is for

The framework is written for any organization that designs, develops, deploys, evaluates, or uses AI systems. It is non-sector-specific and use-case agnostic, so it works for a fintech scoring model, a healthcare triage tool, or a SaaS company adding an LLM feature.

In practice, the companies that reach for it fall into three groups:

• US companies selling to enterprises or government that are asked, "How do you manage AI risk?" and want to answer with a recognized framework.
• Teams that need a risk practice before a management system. The AI RMF is detailed about how to think about AI risk, and less prescriptive about documentation and audits.
• Organizations already pursuing ISO/IEC 42001 that use the AI RMF to inform their risk and impact assessments. See our NIST AI RMF vs ISO 42001 comparison.

How the framework is structured

AI 100-1 has two parts.

Part 1 frames the problem. It explains how AI risks differ from traditional software risks, introduces the people involved across the AI life cycle (NIST calls them "AI actors"), and defines the characteristics of trustworthy AI.

Part 2 is the AI RMF Core and Profiles. The Core is the operational part: four functions, broken into categories and subcategories that describe outcomes to achieve. Profiles show how the Core applies to a particular setting.

The Core does not prescribe controls. Each subcategory describes an outcome, such as "roles and responsibilities are documented and clear," and leaves you to decide how to get there. That flexibility is the framework's main strength and the main reason teams find it hard to start.

The four functions: GOVERN, MAP, MEASURE, MANAGE

Function	What it is for	Categories	Subcategories
GOVERN	Build the culture, policies, accountability, and oversight for AI risk. Cross-cutting: it informs the other three	6	19
MAP	Establish context and identify risks for a specific AI system	5	18
MEASURE	Analyze, assess, test, and track the risks you mapped	4	22
MANAGE	Prioritize risks and act on them: treat, respond, recover, communicate	4	13
Total		19	72

Counts are from the Core tables in NIST AI 100-1. NIST notes the functions are not a strict sequence. GOVERN applies throughout, and MAP, MEASURE, and MANAGE are revisited as systems change.

Categories overview

The category descriptions below are paraphrased. Read the subcategories in AI 100-1 for the full detail.

GOVERN

• GOVERN 1: Policies, processes, and practices for managing AI risk are in place, transparent, and working.
• GOVERN 2: Accountability structures exist, and the right people are empowered, responsible, and trained.
• GOVERN 3: Workforce diversity, equity, inclusion, and accessibility are prioritized in AI risk work.
• GOVERN 4: Teams are committed to a culture that considers and communicates AI risk.
• GOVERN 5: There are processes for engaging with relevant AI actors, including outside stakeholders.
• GOVERN 6: Policies and procedures address risks and benefits from third-party software, data, and other supply chain issues.

MAP

• MAP 1: The context of the AI system is established and understood.
• MAP 2: The AI system is categorized.
• MAP 3: The system's capabilities, intended use, goals, and expected benefits and costs are understood.
• MAP 4: Risks and benefits are mapped for every component, including third-party data and software.
• MAP 5: Impacts on individuals, groups, communities, organizations, and society are characterized.

MEASURE

• MEASURE 1: Appropriate methods and metrics are identified and applied.
• MEASURE 2: AI systems are evaluated for the trustworthy characteristics.
• MEASURE 3: There are mechanisms to track identified risks over time.
• MEASURE 4: Feedback on whether measurement is working is gathered and assessed.

MANAGE

• MANAGE 1: Risks identified in MAP and MEASURE are prioritized, responded to, and managed.
• MANAGE 2: Strategies to maximize benefits and minimize negative impacts are planned, implemented, and documented.
• MANAGE 3: Risks and benefits from third parties are managed.
• MANAGE 4: Risk treatments, including response, recovery, and communication plans, are documented and monitored.

The seven characteristics of trustworthy AI

The AI RMF defines trustworthy AI through seven characteristics. MEASURE 2 is largely about evaluating systems against them.

Characteristic	What it means in practice
Valid and reliable	The system does what it is supposed to, consistently, under expected conditions. NIST treats this as the base the others rest on
Safe	The system does not, under defined conditions, put human life, health, property, or the environment at risk
Secure and resilient	It resists attacks and misuse, and can withstand or recover from adverse events
Accountable and transparent	Information about the system and its outputs is available to the people who need it, and someone answers for its outcomes
Explainable and interpretable	People can understand how the system works (explainability) and what its outputs mean in context (interpretability)
Privacy-enhanced	The system respects norms and practices that protect autonomy, identity, and dignity, including data minimization
Fair, with harmful bias managed	Harmful bias, whether systemic, computational, or human-cognitive, is identified and managed

NIST is explicit that these characteristics involve tradeoffs. Raising interpretability might cost some accuracy, and privacy techniques can reduce the data available to test for bias. The framework asks you to make those tradeoffs deliberately and document them.

The AI RMF Playbook

The AI RMF Playbook is a companion resource with suggested actions, aligned to each subcategory in the Core, for achieving the framework's outcomes. It is the most useful starting point for anyone who finds the Core too abstract.

Treat the Playbook as a menu. NIST says it is neither a checklist nor a set of steps to follow in full, and that its suggestions are voluntary. Pick the suggested actions that fit your systems and risk level, and record why you skipped the others.

The Generative AI Profile (NIST AI 600-1)

NIST released the Generative AI Profile, NIST AI 600-1, on July 26, 2024. It applies the AI RMF to generative AI and identifies 12 risks that are unique to or made worse by GenAI:

1. CBRN information or capabilities
2. Confabulation (confidently stated false output)
3. Dangerous, violent, or hateful content
4. Data privacy
5. Environmental impacts
6. Harmful bias or homogenization
7. Human-AI configuration
8. Information integrity
9. Information security
10. Intellectual property
11. Obscene, degrading, and/or abusive content
12. Value chain and component integration

For each risk, the profile maps suggested actions to AI RMF subcategories. If your product includes an LLM feature, or your staff use GenAI tools, this profile is where your risk work should start. It is also useful input for the AI risk assessment that ISO 42001 requires.

NIST has also published a concept note (April 7, 2026) for an AI RMF profile on trustworthy AI in critical infrastructure. As of October 2026, that profile is not final.

Is there a NIST AI RMF certification?

No. NIST does not certify organizations against the AI RMF, and there is no accredited certification scheme for it. NIST develops frameworks and standards; it does not audit companies.

What you can do:

• Align with it. Map your practices to the functions and subcategories and keep evidence.
• Describe your alignment. Tell customers which functions and categories you address and how. Avoid the words "NIST certified" or "NIST compliant," which suggest an endorsement that does not exist.
• Get an independent assessment. Some third parties offer assessments against the AI RMF. These can be useful, but they are opinions from that firm, not certifications.
• Certify against ISO/IEC 42001. If a customer needs a certificate, ISO 42001 is the certifiable AI management system standard. NIST hosts a crosswalk between the two, so work done for one carries over.

For people rather than organizations, there are personal credentials such as the IAPP AIGP and ISO 42001 lead implementer and lead auditor courses. Our AI governance certification guide covers the options.

Auditor's note: In assessments, the most common gap we look for is a NIST AI RMF "alignment" that is a spreadsheet of subcategories marked green with no evidence behind them. Every subcategory you claim should point to something real: a policy, a risk register entry, an evaluation result, a ticket. If a customer's security team asks for proof on one line, you should be able to produce it the same day.

How to implement the NIST AI RMF

There is no single prescribed method. This sequence works for most companies with 20 to 500 employees.

1. Set up GOVERN first

• Name an executive owner and a working group (see our AI governance framework guide for committee design).
• Write or update your AI policy. Our AI policy template gives an outline.
• Define your risk tolerance: what level of AI risk the business will accept, and who can accept more.
• Put third-party AI (model APIs, SaaS tools with AI features) under your supplier process.

2. Build an AI inventory

You cannot map what you have not listed. Catalog every AI system you build, deploy, or use, including vendor tools staff adopted on their own. Record owner, purpose, data used, users, and whether it is customer-facing.

3. MAP each system that matters

Start with the highest-exposure systems. For each one, document context, intended use, expected benefits, the people affected, and known limitations. Use the GenAI Profile for any generative system.

4. MEASURE what you mapped

Choose metrics and tests for the risks you identified: accuracy and robustness testing, bias evaluation, red-teaming for GenAI, privacy review. Record results and track them over time, not just at launch.

5. MANAGE the results

Prioritize risks, decide treatments, assign owners, and set deadlines. Write incident response and communication plans for AI failures. Monitor deployed systems and revisit MAP when something changes.

6. Write a target profile

A profile describes your current state and the target state for each function and category. The gap between the two is your roadmap. This is also the clearest artifact to show customers.

7. Decide whether you also need ISO 42001

If customers or procurement teams are asking for a certificate, the AI RMF alone will not satisfy them. Many organizations use the AI RMF for risk practice and ISO/IEC 42001 as the certifiable management system around it. The comparison guide includes a crosswalk table.

Where the AI RMF stands as of October 2026

NIST's AI RMF page states that the framework is being revised as part of the White House AI Action Plan. AI RMF 1.0 remains the current version, and the framework itself says a formal review with community input is expected no later than 2028. Check NIST's AI RMF page for updates before you finalize a program, and expect minor changes rather than a different structure.

How TrustAIMS can help

TrustAIMS was founded by former Big Four auditors. We focus on ISO/IEC 42001, and we use the NIST AI RMF as a risk practice inside it. Our ISO 42001 gap assessment (from $12,500, about two weeks) maps your current practice, including any existing AI RMF work, to ISO 42001 clauses 4 to 10 and all 38 Annex A controls, and delivers a prioritized remediation plan and a draft Statement of Applicability.

We are not a certification body and cannot certify anyone. That independence is deliberate: the firm that certifies you is not allowed to also consult for you. If you want a quick view first, take the free 10-question readiness assessment.