NIST AI RMF: The Four Functions, and the Revision Underway

The NIST AI RMF is the most widely referenced AI risk framework in the world, it is entirely voluntary, and — as of now — version 1.0 is being revised as part of the White House AI Action Plan.

That last fact should shape how you use it. The framework is stable enough to build on and unstable enough that you should not hard-code its structure into your documentation.

What the NIST AI RMF is

Released on 26 January 2023, the AI Risk Management Framework was developed by NIST’s Information Technology Laboratory with the private and public sectors, through a consensus process involving a Request for Information, several public drafts, and multiple workshops.

Its purpose is narrow and useful: to improve the ability to incorporate trustworthiness considerations into the design, development, use and evaluation of AI products, services and systems — managing risk to individuals, organisations and society.

Two characteristics matter more than anything in the text.

It is voluntary. Nobody enforces it and there is no certification. Its influence comes from adoption, and from other regimes referencing it.

It is designed to build on and align with other efforts rather than replace them — which is why NIST publishes a Crosswalk to other frameworks alongside it.

The four NIST AI RMF functions

The NIST AI RMF organises AI risk management into four functions, and the ordering is the argument.

GOVERN is the cross-cutting one — the culture, policies, accountability and oversight that make the other three meaningful. NIST puts it first deliberately. An organisation that starts with MEASURE ends up with metrics nobody is accountable for.

MAP establishes context: what the system is for, who it affects, what could go wrong, and what assumptions are baked in. Most of the risk that surfaces later was visible here and not written down.

MEASURE analyses and tracks the identified risks, using quantitative and qualitative methods — including the awkward ones, like whether the measurement method is itself valid for this system.

MANAGE allocates resources to the risks, treats them, and handles incidents when they occur.

What NIST publishes around the AI RMF

The NIST AI RMF document itself is the smallest part of what is available, and the supporting material is where the practical value sits.

The AI RMF Playbook gives suggested actions against each function — the closest thing to implementation guidance.

The Generative AI Profile, NIST-AI-600-1, was released on 26 July 2024. It identifies risks unique to generative AI and proposes actions organisations can align with their own goals and priorities. If you deploy generative AI, this is the part to read first — the base framework predates most of what you are deploying.

The Trustworthy and Responsible AI Resource Center, launched 30 March 2023, hosts a use case page showing how other organisations have applied the framework. That is unusually useful, because voluntary frameworks are hard to implement without seeing someone else’s interpretation.

A critical infrastructure profile is coming. On 7 April 2026 NIST released a concept note for an AI RMF Profile on Trustworthy AI in Critical Infrastructure, to guide operators towards specific practices when engaging AI-enabled capabilities.

The NIST AI RMF revision, and what to do about it

NIST states plainly that NIST AI RMF 1.0 is being revised as part of the White House AI Action Plan.

No published date, and no announced scope you can plan a programme around. The sensible response is not to wait — voluntary frameworks do not have compliance deadlines, and the underlying discipline is not going to be discarded.

The sensible response is to document against the four functions rather than against section numbers, and to keep your AI inventory, risk records and evaluation evidence in a form that survives a restructure. Those artefacts are the durable part; the mapping to any particular framework version is not.

How the NIST AI RMF relates to certifiable standards

Where to start with the NIST AI RMF

1. Build the AI inventory first. Which systems, doing what, affecting whom. Everything in MAP depends on it.
2. Do GOVERN before MEASURE. Accountability first, metrics second.
3. Use the Playbook rather than inventing actions against each function.
4. Read the Generative AI Profile if you deploy generative AI — the base framework predates it.
5. Watch the critical infrastructure profile if that is your sector.
6. Document against the four functions, not section numbers, because 1.0 is under revision.

This guide reflects nist.gov at 15 August 2026, on which AI RMF 1.0 is current and recorded as being revised under the White House AI Action Plan.

The NIST AI RMF Toolkit provides 36 editable AI governance templates covering the AI inventory, the context and impact mapping, the risk analysis and measurement records, the treatment and incident artefacts, and the governance documentation the GOVERN function expects.