The NIST AI Risk Management Framework and its four functions

NIST AI RMF 1.0, published as AI 100-1 in January 2023, is the most widely adopted AI governance framework in the world and it is entirely voluntary. No body enforces it. That combination confuses people, so it is worth being direct about what it is for: it gives a programme a defensible structure and a shared vocabulary, and it does not give you compliance with anything.

The four functions

GOVERN, MAP, MEASURE, MANAGE. The shape matters more than the names.

GOVERN is not a phase. It runs across the other three and holds the things that make the rest possible: policy, accountability, culture, roles, and the organisational appetite for risk. A programme that treats GOVERN as a setup step and moves on has misread the framework at the first turn.

MAP establishes context. What is this system for, in whose hands, affecting whom, in what setting, with what assumptions. This is the function most organisations skip, because it produces no artefact anyone asked for and it is where the uncomfortable questions live.

MEASURE is analysis and tracking: how the identified risks are assessed, with what metrics, against what thresholds, and how measurement is repeated over time. The framework's own insistence is that measurement requires a defined method, not a judgement.

MANAGE allocates resources to the risks that were mapped and measured, decides what is treated, transferred, avoided or accepted, and covers response and recovery.

The Playbook, which is the useful part

The framework's companion Playbook publishes, for each subcategory, a set of Transparency and Documentation questions an organisation should be able to answer. That is a more practical instrument than the framework text, because a question you cannot answer is a gap you can act on, whereas an outcome statement is something you can assert your way past.

A reasonable way to use the Playbook is as an internal interview script rather than a checklist. Take one system, ask the questions of the people who built and run it, record the answers, and treat every unanswerable question as an open finding with an owner. The output is not a maturity score. It is a list of things nobody knows about a system in production.

The Generative AI Profile

NIST AI 600-1, published 26 July 2024, is a profile of the framework for generative AI. Use it where generative systems are in scope. Note what a profile is: a contextualisation of the same four functions, not a separate framework, so a programme built on the RMF does not restructure to adopt it.

Where the RMF helps and where it does not

It helps most with structure. A programme that has organised its controls under four functions can show an auditor, a board or a supervisor a coherent shape, and can say where any given activity sits. It helps with vocabulary, since a great deal of the market including several governance platforms is organised around the same four words.

It does not help with legal obligation. The RMF cannot tell you whether a system is Annex III, when a report is due, or who must be informed of an automated decision. It was not written to. And its voluntary status has become more rather than less important: Colorado's SB 24-205 contained a rebuttable presumption tied to the NIST framework, and that presumption did not survive. SB 24-205 was repealed and replaced by SB 26-189, signed 14 May 2026 and effective 1 January 2027, and both the impact assessment duty and the NIST-RMF rebuttable presumption were removed. What survives there is developer-to-deployer documentation, pre-use consumer notice, post-adverse-decision disclosure within 30 days, and three-year record retention.

The lesson generalises. Frameworks that acquire legal force by cross-reference can lose it by amendment, and a control library justified solely by "NIST says so" has no foundation when the cross-reference disappears.

Worked example: an RMF-shaped programme that fails an examination

A bank organises its AI governance programme under the four functions. GOVERN holds the policy and the committee charter. MAP holds a context template completed for each system. MEASURE holds a model performance dashboard. MANAGE holds a risk register with treatment decisions.

It is a good programme and it presents well. Then the supervisor asks four questions.

Which of your systems fall within Annex III, and what is the reasoning? Not in the framework, and the MAP templates record business context without a regulatory classification field.

For the credit scoring model, where is the fundamental rights impact assessment and when were its results notified to the market surveillance authority? Not in the framework; Article 27 has no RMF equivalent.

Show the metrics and probabilistic thresholds defined in advance for the model that went live last quarter. MEASURE has a dashboard of metrics computed after the fact. The Article 9 requirement is that thresholds are set beforehand, which is a documentary difference and a substantive one.

Who did you inform before deploying the workforce scheduling model, and when? Not in the framework. Article 26(7) requires workers' representatives and affected workers to be informed before workplace use.

Nothing in the programme was wrong. The framework did its job, which is structure. The gap was treating structure as coverage, and mapping controls to functions without ever mapping obligations to controls. The fix is a second mapping, obligation to control, maintained alongside the first, so that any obligation without a control is visible as a gap rather than hidden inside a well-populated function.

As of 24 September 2026.