A voluntary framework for managing AI risk.
The NIST AI Risk Management Framework, NIST AI 100-1, released as AI RMF 1.0 on 26 January 2023, is a voluntary framework for managing AI risk in the United States. It carries no force of law.
The four functionsThe Generative AI ProfileFAQAll frameworks
No compliance claim under these frameworks. iTmethods makes no compliance, certification or accreditation claim under the NIST AI Risk Management Framework or any other framework named on this page. Beyond SOC 2 Type II for Reign Ops, no other certification or accreditation is claimed.
More on what we do not claim
We are not certified against, accredited for, or approved under any of them. Alignment is not compliance. The determination belongs to your own risk function, and nothing here transfers it to us. No authority responsible for it endorses, approves or recommends Reign or iTmethods.
Govern, Map, Measure, Manage.
The framework organizes AI risk work into four core functions. The difficulty is not understanding them, it is running them.
Govern
The policies, roles and accountability around AI risk. The function most organizations can describe and fewest can evidence on a given day.
Who owns this, by name?
Map
Context, intended use and where a system sits in the business. Mapping goes stale the moment a use case moves, which is constantly.
When was yours last true?
Measure
Analyzing and tracking what the system actually does. Measurement is only credible if it happened at the time rather than at review.
Measured when, exactly?
Manage
Acting on what the other three surface: prioritizing, treating and monitoring risk over the lifecycle rather than at a point.
What did you act on last quarter?
Govern runs through the other three. Each function is easy to describe and hard to evidence continuously. An annual documentation exercise satisfies the shape of the framework and not its intent, which is where most programs stall.
The framework also names the characteristics of trustworthy AI the functions work toward: valid and reliable, safe, secure and resilient, accountable and transparent, explainable and interpretable, privacy-enhanced, and fair with harmful bias managed.
The Generative AI Profile.
NIST AI 600-1, published 26 July 2024, applies the four functions to generative systems specifically.
The Generative AI Profile is not a second framework. It identifies the risks that are particular to generative systems and proposes actions against them, organized under the same Govern, Map, Measure and Manage structure as AI RMF 1.0. When an enterprise risk team asks which NIST document applies to a model-backed workflow, this is usually the one they mean.
It is the profile, rather than the parent framework, that most often turns up in a vendor questionnaire, which is why it is named here rather than left implied.
Govern and Manage, as a running record.
Operationalizing the framework means turning the functions into something continuous, not a once-a-year exercise.
Reign Ops and Reign Gateway map to Govern and Manage in operational terms. They produce the operating record those two functions draw on: what was governed, and what was done about it. Map and Measure stay with your risk function. Whether that adds up to a mature program is your risk function’s assessment to make.
Questions risk teams ask about the framework.
What is the NIST AI Risk Management Framework?
Voluntary guidance from the United States National Institute of Standards and Technology, NIST AI 100-1, released as AI RMF 1.0 on 26 January 2023, to help organizations manage AI risk and build trustworthy AI. It gives engineering, security, legal and the business a shared vocabulary and a structure of four functions: Govern, Map, Measure and Manage.
Is the NIST AI RMF mandatory?
No. It is voluntary and carries no force of law. An organization can adopt it as its internal standard.
What are the four functions of the NIST AI RMF?
Govern (culture, policy, roles and accountability), Map (context, intended use and what could go wrong), Measure (assessing, analyzing and tracking risk) and Manage (prioritizing and acting on risk over the lifecycle). Govern runs through all of them.
Does the NIST AI RMF cover generative AI?
Yes, through the Generative AI Profile, NIST AI 600-1, published 26 July 2024. It identifies the risks particular to generative systems and organizes actions against them under the same four functions.
How do you implement the NIST AI RMF?
The framework defines what to do, not how. Implementing it means making the four functions continuous: policy applied at the moment AI acts, a current map of the models, agents and tools in use, evidence captured as the work happens, and risk managed on an ongoing basis. Reign produces the operating record for Govern and Manage. Whether that adds up to a mature program is your risk function’s assessment.
How does the NIST AI RMF relate to the EU AI Act?
They are different instruments: the EU AI Act is law, and the NIST AI RMF is voluntary guidance. Both ask for risk management, documentation, oversight and monitoring, so evidence organized around Govern, Map, Measure and Manage tends to support both. Your advisers own the mapping.
Turn Govern and Manage into a running record.
We will look at which of Govern, Map, Measure and Manage your estate could evidence today without a documentation project.