NIST AI 100-1 Artificial Intelligence Risk Management Framework (AI RMF 1.0)
Artificial Intelligence Risk Management Framework (AI RMF 1.0)
The NIST Artificial Intelligence Risk Management Framework (AI RMF 1.0) is a voluntary guidance document designed to help organizations manage risks associated with artificial intelligence systems throughout their lifecycle. It establishes a flexible, non-sector-specific approach focused on improving trustworthiness characteristics such as validity, reliability, safety, security, resilience, accountability, transparency, explainability, privacy, and fairness. The framework is structured around four core functions: Govern, Map, Measure, and Manage.
Summary and content fields are drawn from the document text and are pending editorial review.
Who issued it
Who it governs
This framework is for organizations and individuals designing, developing, deploying, or using AI systems to help manage risks and promote trustworthy practices.
What the document contains
The document addresses the identification, assessment, prioritization, and management of risks related to artificial intelligence systems. It outlines the characteristics of trustworthy AI, establishes foundational concepts for framing risks, and provides a structured core of four functions (Govern, Map, Measure, and Manage) to guide organizations in responsible AI development and deployment.
The framework does not prescribe specific risk tolerances, mandatory regulations, or legal enforcement mechanisms, as it is designed to be voluntary and adaptable.
- The AI RMF is a voluntary, rights-preserving, and non-sector-specific framework designed to improve the trustworthiness of AI systems.
- AI risks differ from traditional software risks due to data dependency, system complexity, opacity, and socio-technical interactions.
- Trustworthy AI characteristics include being valid and reliable, safe, secure and resilient, accountable and transparent, explainable and interpretable, privacy-enhanced, and fair with harmful bias managed.
- The framework is organized into four core functions: Govern, Map, Measure, and Manage.
- Governance serves as a cross-cutting function that informs and is integrated throughout all other risk management activities.
· Executive Summary · Part 1: Foundational Information - 1 Framing Risk - 2 Audience - 3 AI Risks and Trustworthiness - 4 Effectiveness of the AI RMF · Part 2: Core and Profiles - 5 AI RMF Core - 6 AI RMF Profiles · Appendix A: Descriptions of AI Actor Tasks from Figures 2 and 3 · Appendix B: How AI Risks Differ from Traditional Software Risks · Appendix C: AI Risk Management and Human-AI Interaction · Appendix D: Attributes of the AI RMF
How it scores
Each score is backed by a quote verified against the document text. Editorial review has not yet confirmed them.
Accountability
4/5Clear responsibility for AI outcomes
GOVERN 2: Accountability structures are in place so that the appropriate teams and individuals are empowered, responsible, and trained for mapping, measuring, and managing AI risks.
5.1 Govern
screening score · 2026-10-23
Human Dignity
3/5Respect for the inherent worth of persons
Privacy refers generally to the norms and practices that help to safeguard human autonomy, identity, and dignity.
3.6 Privacy-Enhanced
screening score · 2026-10-23
Privacy
4/5Protection of personal data and private life
Privacy values such as anonymity, confidentiality, and control generally should guide choices for AI system design, development, and deployment.
3.6 Privacy-Enhanced
screening score · 2026-10-23
Transparency
4/5Openness about how AI systems work and are used
Meaningful transparency provides access to appropriate levels of information based on the stage of the AI lifecycle and tailored to the role or knowledge of AI actors or individuals interacting with or using the AI system.
3.4 Accountable and Transparent
screening score · 2026-10-23
Enforcement
1/5Consequences and compliance mechanisms with real force
In cases where an AI system presents unacceptable negative risk levels – such as where significant negative impacts are imminent, severe harms are actually occurring, or catastrophic risks are present – development and deployment should cease in a safe manner until risks can be sufficiently managed.
1.2.3 Risk Prioritization
screening score · 2026-10-23
Impact Assessment
4/5Required assessment of an AI system's risks/impacts before or during use
AI system impact assessment approaches can help AI actors understand potential impacts or harms within specific contexts.
1.2.1 Risk Measurement
screening score · 2026-10-23