← Global AI Laws & Governance Research Library
NIST Artificial Intelligence Risk Management Framework (AI RMF 1.0)
Prepared by Shubhank Suman · Last reviewed
CURRENT / VOLUNTARY / REVISION UNDERWAY
- Legal character
- Voluntary AI risk-management framework
- Region
- North America
- Published
- 26 January 2023
What it covers
NIST AI RMF 1.0 is a voluntary, non-sector-specific and use-case-agnostic framework for managing risks to individuals, organisations and society across the AI lifecycle. Its four functions are GOVERN, MAP, MEASURE and MANAGE, supported by trustworthy-AI characteristics.
Why it matters
It integrates AI, privacy and security risk into a continuous organisational governance cycle without creating a generally applicable federal statutory requirement.
Refer to it when
Use it for AI governance programmes, risk ownership, contextual risk mapping, testing and evaluation, metrics, red teaming, monitoring, mitigation, third-party risk and lifecycle review.
AI, privacy and cybersecurity relevance
- AI: Very High
- Privacy: Very High
- Cyber: Very High
AI
VERY HIGH RELEVANCE
GOVERN, MAP, MEASURE and MANAGE provide a continuous organisational AI-risk structure.
Privacy
VERY HIGH RELEVANCE
Privacy-enhanced AI is an express trustworthy-AI characteristic, connecting data collection, governance, quality, de-identification, development, deployment and monitoring.
Cybersecurity
VERY HIGH RELEVANCE
Security and resilience are explicit characteristics relevant to model security, data security, operational resilience, incidents, third parties and lifecycle monitoring. AI RMF does not replace NIST CSF.
Applicability
Voluntary use by AI developers, deployers, procurers, public bodies, private organisations and internal AI-governance programmes.
Current validity
CURRENT VOLUNTARY FRAMEWORK: REVISION UNDERWAY. It is not United States federal AI law.
Read first
Introduction → Trustworthy & Responsible AI → GOVERN → MAP → MEASURE → MANAGE → AI RMF Playbook → GenAI Profile → Critical Infrastructure Profile.
Provisions / sections covered
GOVERN
Establish policies, roles, responsibilities, accountability, risk tolerance, culture and procedures.
MAP
Contextualise intended use, stakeholders, potential harms, limitations and dependencies.
MEASURE
Use testing, evaluation, measurement, monitoring and trustworthiness assessment.
MANAGE
Prioritise, mitigate, treat, monitor, escalate, review, accept or avoid risk.
Trustworthy AI characteristics
Valid and reliable; safe; secure and resilient; accountable and transparent; explainable and interpretable; privacy-enhanced; and fair with harmful bias managed.
Companion resources
NIST AI 600-1 is the Generative AI Profile. A 2026 concept note addresses a trustworthy-AI profile for critical infrastructure; these complement rather than replace AI RMF 1.0.
Subject-matter tags
- Profiling
- Anonymisation
- Surveillance
- AI governance
- Generative AI
- Transparency
- Explainability
- Risk management
- Accountability
Subject-matter tags describe what the indexed text discusses. They are not legal conclusions.
Related instruments in this library
- HIPAA: United StatesLaw · Current (amended)Same jurisdiction; assess applicability separately.
- Stored Communications Act – 18 U.S.C. Chapter 121Law · CurrentSame jurisdiction; assess applicability separately.
- Video Privacy Protection Act – 18 U.S.C. § 2710Law · CurrentSame jurisdiction; assess applicability separately.
- Cybersecurity Information Sharing Act of 2015Law · CurrentSame jurisdiction; assess applicability separately.
- Federal Information Security Modernization Act of 2014 (FISMA)Law · CurrentSame jurisdiction; assess applicability separately.
- Right to Financial Privacy Act of 1978Law · Current (amended)Same jurisdiction; assess applicability separately.
Document page in the Knowledge Base - full text or PDF where it is available for this record.
This library locates primary and official sources. It does not interpret the law and it is not legal advice.