NIST AI Risk Management Framework — a practical reading for small organizations
Voluntary standard · reviewed 2026-10-14
The AI RMF is a voluntary framework published by the US National Institute of Standards and Technology on 26 January 2023. It organizes AI risk management into four functions: Govern (policies, roles, accountability, culture), Map (context, intended use, affected people, risks per system), Measure (metrics, testing, trustworthiness characteristics) and Manage (prioritize, act, monitor, respond to incidents). The Generative AI Profile (AI 600-1, July 2024) adds generative-AI-specific risks and suggested actions.
It is referenced by some US state laws as evidence of reasonable care, notably Texas TRAIGA, but it is not law and there is no NIST certification. NIST has stated the framework is being revised under the 2025 AI Action Plan; our dataset records the 1.0 text.
How the platform maps
| Framework element | Where it lives in the workspace |
|---|---|
| Govern | Governance policy, acceptable-use policy, owners per system, training record, audit log |
| Map | AI inventory fields: purpose, affected people, data, jurisdictions, decision authority, agent permissions |
| Measure | Assessment findings with severity, likelihood and exposure; evidence of testing attached to controls |
| Manage | Tasks, risk acceptance records, incident register, reassessment triggers, regulatory change reviews |
Mapping your records to the four functions helps you demonstrate a structured approach. It does not make you "NIST compliant"; no such status exists.