Run the NIST AI Risk Management Framework

What is the NIST AI RMF?

The NIST AI Risk Management Framework (AI RMF 1.0) — published as NIST AI 100-1 in January 2023 — is voluntary guidance for identifying and managing the risks of artificial intelligence across its lifecycle, from design and development through deployment and decommissioning. It was developed through an open, multi-stakeholder process at the direction of Congress and has quickly become the de facto reference for AI governance in the United States.

Rather than prescribe specific controls, the AI RMF defines a set of trustworthy-AI characteristics — valid and reliable, safe, secure and resilient, accountable and transparent, explainable and interpretable, privacy-enhanced, and fair (with harmful bias managed) — and a flexible process for achieving them.

The four functions

The AI RMF core organizes that process into four functions:

• Govern — the foundation. It establishes the organization's AI risk culture, policies, roles, and accountability, including who approves high-risk use cases, how third-party and foundation models are introduced, and how resources are allocated to testing.
• Map — the scoping function. It builds the context for each AI system and identifies the risks that context creates.
• Measure — analyzes, assesses, benchmarks, and monitors AI risks with quantitative and qualitative methods.
• Manage — allocates resources to prioritized risks, applies treatments (mitigate, transfer, avoid, accept), documents residual risk, and handles monitoring, incident response, and recovery.

Who uses the AI RMF

Any organization that builds, deploys, or procures AI — including generative AI and autonomous agents — uses the AI RMF to put structure around AI risk. It is especially common for US-based companies and federal contractors, and it is the natural companion to the certifiable ISO 42001 AI management system and to EU AI Act readiness. NIST's companion Generative AI Profile (NIST AI 600-1), published in July 2024, extends the framework with risks specific to generative models.

How episki helps

episki turns the AI RMF into a working program: a live registry of your AI systems, models, and agents; the Govern-Map-Measure-Manage workflow as repeatable tasks and evidence; and crosswalks that let the same work feed your ISO 42001 certification and EU AI Act obligations — so AI governance is one program, not three.