CEIAI Governance Database
Back to the database
Record STMT-M016Voluntary

Artificial Intelligence Risk Management Framework (AI RMF 1.0)

NIST AI Risk Management Framework 1.0

Framework State lawNorthern America · USin force

NIST's voluntary framework for managing risks of AI systems across their lifecycle. Defines seven characteristics of trustworthy AI (valid and reliable, safe, secure, accountable and transparent, explainable, privacy-enhanced, fair) and four core functions - GOVERN, MAP, MEASURE, MANAGE - with suggested actions in a companion Playbook. Explicitly voluntary, rights-preserving, non-sector-specific, and use-case agnostic.

Summary and content fields are drawn from the document text and are pending editorial review.

Who issued it

National Institute of Standards and TechnologyGovernment · US
Lead issuer
Legal forceVoluntary
Under whose authorityState law
Judged fromfull text

Who it governs

CompaniesPublic sector bodiesAI developers and providersAI deployers and usersResearchers and academics

This document is for organizations designing, developing, deploying, or using AI systems to help them manage risks and promote trustworthy AI.

Sectors
Cross-sector

What the document contains

What's covered

The document addresses the identification, measurement, prioritization, and management of risks associated with artificial intelligence systems throughout their lifecycle. It defines seven characteristics of trustworthy AI and sets out four core functions (Govern, Map, Measure, Manage) with associated categories and subcategories to help organizations operationalize risk management.

What's missing

The framework does not provide mandatory regulatory enforcement mechanisms, specific penalties for non-compliance, or legally binding compliance mandates since it is entirely voluntary.

Key takeaways
  • The AI RMF is a voluntary, flexible, and rights-preserving framework intended for organizations of all sizes and sectors.
  • Trustworthy AI characteristics include being valid and reliable, safe, secure and resilient, accountable and transparent, explainable and interpretable, privacy-enhanced, and fair with harmful bias managed.
  • AI risks differ from traditional software risks due to factors like data dependency, complexity, opacity, and socio-technical interactions.
  • The framework core consists of four continuous functions: Govern, Map, Measure, and Manage.
  • Governance acts as a cross-cutting function to inform and infuse risk management activities across the organization.
Principles it states
Valid and ReliableSafeSecure and ResilientAccountable and TransparentExplainable and InterpretablePrivacy-EnhancedFair – with Harmful Bias Managed
Outline
· Executive Summary
· Part 1: Foundational Information
  - 1 Framing Risk
    - 1.1 Understanding and Addressing Risks, Impacts, and Harms
    - 1.2 Challenges for AI Risk Management
  - 2 Audience
  - 3 AI Risks and Trustworthiness
    - 3.1 Valid and Reliable
    - 3.2 Safe
    - 3.3 Secure and Resilient
    - 3.4 Accountable and Transparent
    - 3.5 Explainable and Interpretable
    - 3.6 Privacy-Enhanced
    - 3.7 Fair – with Harmful Bias Managed
  - 4 Effectiveness of the AI RMF
· Part 2: Core and Profiles
  - 5 AI RMF Core
    - 5.1 Govern
    - 5.2 Map
    - 5.3 Measure
    - 5.4 Manage
  - 6 AI RMF Profiles
· Appendix A: Descriptions of AI Actor Tasks
· Appendix B: How AI Risks Differ from Traditional Software Risks
· Appendix C: AI Risk Management and Human-AI Interaction
· Appendix D: Attributes of the AI RMF
Issued26 January 2023
Length15,911 words
FormatPDF
Scopenational

How it scores

Pending review

Each score is backed by a quote verified against the document text. Editorial review has not yet confirmed them.

Accountability

3/5

Clear responsibility for AI outcomes

Trustworthy AI depends upon accountability. Accountability presupposes transparency.

s.3.4

screening score · 2026-08-20

Fairness

3/5

Non-discrimination and equitable treatment

Fairness in AI includes concerns for equality and equity by addressing issues such as harm- ful bias and discrimination.

s.3.7 Fair with Harmful Bias Managed

screening score · 2026-08-20

Human Dignity

2/5

Respect for the inherent worth of persons

safeguard human autonomy, identity, and dignity

s.3.6 (within privacy definition)

screening score · 2026-08-20

Human Oversight

3/5

Humans remain in control of consequential decisions

human oversight are defined, assessed, and documented in accordance with organizational policies from the GOVERN function

MEASURE 2.8 / GOVERN

screening score · 2026-08-20

Privacy

3/5

Protection of personal data and private life

norms and practices that help to safeguard human autonomy, identity, and dignity

s.3.6 Privacy-Enhanced

screening score · 2026-08-20

Transparency

3/5

Openness about how AI systems work and are used

Transparencyreflects the extent to which information about an AI system and its outputs is available to individuals interacting with such

s.3.4 Accountable and Transparent

screening score · 2026-08-20

Enforcement

0/5

Consequences and compliance mechanisms with real force

The Framework is intended to be voluntary, rights-preserving, non-sector-specific, and use-case agnostic

s.1 Overview

screening score · 2026-08-20

Impact Assessment

3/5

Required assessment of an AI system's risks/impacts before or during use

impact assessment approaches can help AI actors understand potential impacts or harms within specific contexts

MAP function

screening score · 2026-08-20

Topics

ai_risk_management trustworthy_ai voluntary_framework
Artificial Intelligence Risk Management Framework (AI RMF 1.0) · CEI AI Governance Database