NIST AI RMF Explained: What It Asks of a Business That Uses AI

The NIST AI RMF is a free, voluntary framework for managing AI risk. It splits the work into four functions, Govern, Map, Measure, and Manage, and it applies to businesses that use AI tools, not only the ones building models.

You probably don't build AI. You almost certainly run it, though. It's in Microsoft 365, in a chat window someone on the sales team opened last spring, and inside the HR and CRM software you already pay for. The framework covers all of that. For a business, the workable version isn't a 72-item engineering program. It's an owner, an inventory, a use policy, and a short list of questions for your vendors, and it belongs right next to the managed cybersecurity services that protect the rest of your environment.

Companies tend to get this backward. They buy the AI tool, read the vendor's trust page, and assume the risk went with the invoice. It didn't. The vendor carries the risk of how the model was built. You carry the risk of what your people feed it, what it's allowed to see, and what decisions get made on its output.

That gap is already showing up in breach data. IBM's 2026 Cost of a Data Breach Report found 68% of breached organizations lacked AI governance to manage AI or detect unapproved use, up from 63% the year before. More tools won't close that gap. It closes when somebody is accountable for the ones you already have.

What is the NIST AI RMF?

The NIST AI Risk Management Framework, published as NIST AI 100-1 on January 26, 2023, is guidance for managing the risks of designing, developing, deploying, or using AI systems. It's voluntary, free, and written for organizations of any size in any sector.

NIST wrote it under the National Artificial Intelligence Initiative Act of 2020, after two public drafts and a round of workshops, and because the same agency publishes the Cybersecurity Framework, the framework will feel familiar to anyone who's sat through a NIST CSF assessment. Functions, categories, subcategories, profiles. Same bones.

The definition of "AI system" matters, because it's broader than people expect. NIST calls it "an engineered or machine-based system that can, for a given set of objectives, generate outputs such as predictions, recommendations, or decisions influencing real or virtual environments."

Read that twice. A lead-scoring feature inside your CRM qualifies. So does the tool that flags suspicious expense reports, and the one that ranks inbound resumes. None of them call themselves AI on the invoice.

Two companion resources sit beside the framework. The NIST AI RMF Playbook lists suggested actions for every subcategory, and it's voluntary too, so you pick what fits. The second is the Generative AI Profile, covered below. There's no certification attached to either one. The AI RMF is one of several AI governance frameworks a business can adopt, and it's the one written by the agency whose frameworks your auditors already know.

Does the AI RMF apply if you only use AI?

Yes. The framework covers organizations that deploy or use AI, not only those that build it, and NIST treats deployers as a distinct group with risks of their own. A vendor's model can be well built and still create risk in how you use it.

NIST's own text is direct about it. Page 6 of AI 100-1 describes the gap between a model's developer and the business deploying it.

"Such deployers may not recognize that their particular uses could entail risks which differ from those perceived by the initial developer."

Picture Microsoft 365 Copilot. It's designed to answer questions using anything the person asking can already open. In a Microsoft 365 environment where the salary spreadsheet has been shared with "Everyone" since 2019, Copilot will summarize it for whoever asks. Microsoft didn't create that exposure. Your SharePoint permissions did, years ago, when someone shared a folder with the whole company to save a few clicks, and the AI simply made it searchable in plain English for anyone who thinks to ask. Copilot governance is mostly permission cleanup for exactly this reason.

Then there's the AI nobody approved. Shadow AI (AI tools employees use without IT's knowledge) was involved in 43% of security incidents in IBM's 2026 research, more than double the 20% a year earlier, and those incidents averaged $5.39M. Among organizations hit by an AI-related breach, 92% lacked proper AI access controls like role-based access and multifactor authentication. Those controls are the core of an AI security posture for Copilot, ChatGPT, and Gemini.

None of that is a model failure. It's a use failure. It's also one of the few frameworks written to catch it.

The four functions, translated for a business that uses AI

The AI RMF Core has four functions, 19 categories, and 72 subcategories. NIST says the actions "do not constitute a checklist, nor are they necessarily an ordered set of steps." A business picks the outcomes that fit its risk and works toward those.

Govern

NIST calls Govern "a cross-cutting function that is infused throughout AI risk management and enables the other functions." It's the only function that touches every other one, and it's the one businesses skip.

Govern has 19 subcategories. For a company that uses AI, the ones that matter first are simple to describe. Someone owns AI risk by name. A policy says what's allowed. New tools get approved before they're connected to company data. An AI acceptable use policy covers most of the policy side on its own, as long as it names the tools that are approved, the data that can't go into them, and the person who signs off on anything new.

Approval is slipping, not improving. IBM found that 38% of organizations required IT approval for AI deployments in 2026, down from 45% the year before. Only 19% said their governance and security teams coordinated on AI at all.

Map

Map is context. For each AI system, you write down what it's for, who uses it, who's affected by its output, and what could go wrong.

The same label, "AI," covers wildly different risk. A tool that summarizes sales calls for the rep who was on the call is low stakes. A tool that ranks job applicants makes a decision about a person who never agreed to be scored, never saw the criteria, and may never learn the software was involved at all. Both would sit on the same line of a software inventory. Map is what separates them.

Measure

Measure has the most subcategories of any function, 22, and it's where builders spend their money on bias testing and model evaluation. A business using a drafting assistant to write first-pass proposals doesn't need a testing lab, a data science team, or a bias audit to get the Measure function roughly right for that use.

It does need evidence. Somebody should spot-check what the tool produces in the workflows that matter, track the mistakes, and confirm what data leaves the building. NIST adds a warning that's easy to miss. Being unable to measure a risk "does not imply that an AI system necessarily poses either a high or low risk." Unknown isn't the same as fine.

Manage

Manage turns everything above into decisions. Which risks get handled first, what happens during an incident, and when a tool comes out of service.

Two categories stand out for deployers. MANAGE 3.1 covers risks from third-party resources, and MANAGE 3.2 covers pre-trained models, meaning the vendor models almost every business runs. Tracking what vendors tell you about those models, including where your data goes and whether it trains anything, belongs in your third-party risk management program, not in a separate AI binder nobody opens.

The line executives should read is on page 8. When an AI system "presents unacceptable negative risk levels," NIST says "development and deployment should cease in a safe manner until risks can be sufficiently managed." That's a decision someone at your company needs the authority to make before the day it's needed.

The seven trustworthiness characteristics

NIST defines trustworthy AI as valid and reliable, safe, secure and resilient, accountable and transparent, explainable and interpretable, privacy-enhanced, and fair with harmful bias managed. Valid and reliable is the base the other six sit on.

They trade off against each other. NIST calls "highly secure but unfair systems" and "accurate but opaque" ones equally undesirable, and treats balancing them as part of the job. For a business using AI, the practical read is narrower. Is the output right often enough for how we use it, is our data safe going in, and can we explain a decision it influenced if someone asks?

Those three questions cover most of what a business will ever be asked about its AI.

What does the Generative AI Profile add?

NIST AI 600-1, released July 26, 2024, applies the AI RMF to generative AI. It names 12 risks that generative models create or make worse and lists more than 200 suggested actions mapped to the four functions.

The 12 risks are chemical, biological, radiological, and nuclear (CBRN) weapons information, confabulation, dangerous or hateful content, data privacy, environmental impacts, harmful bias, human-AI configuration, information integrity, information security, intellectual property, obscene or abusive content, and value chain and component integration. A business running ChatGPT or Copilot won't face all 12 equally. Four do most of the damage:

• Confabulation. NIST's word for what everyone else calls hallucination, "confidently stated but erroneous or false content." A made-up case citation in a client memo is the classic version.
• Data privacy. Someone pastes a customer list into a free chatbot to "clean up the formatting." That data is now outside your control, and depending on the tool's terms, possibly training someone else's model.
• Information security. Prompt injection, meaning instructions hidden in a document or email that hijack the AI reading it. IBM put the average cost of a prompt-injection breach at $5.89M in 2026.
• Value chain and component integration covers the models inside your vendors' products that you can't see, can't test, and often didn't know were there.

Each one maps back to a rule you can write down. No public chatbots for client data. A human checks anything AI-drafted before it leaves the building. Vendors tell you which models sit inside their product.

Is the NIST AI RMF mandatory?

No. The AI RMF is voluntary for private businesses, and no federal law requires it. You're more likely to meet it in a customer's vendor questionnaire or a contract clause than from a regulator.

Its legal status did get messier this year. America's AI Action Plan, released in July 2025, directed NIST to revise the framework "to eliminate references to misinformation, Diversity, Equity, and Inclusion, and climate change." NIST's AI RMF page now says version 1.0 is "being revised as part of the White House AI Action Plan." As of this writing, no revised version has been published, and the four functions haven't changed.

Colorado briefly gave the framework legal teeth. The original SB 24-205 offered companies an affirmative defense if they complied with a recognized AI risk management framework, and NIST's was the obvious candidate. That law never took effect. It was repealed and replaced by SB 26-189, signed May 14, 2026 and effective January 1, 2027, which swapped risk-management programs for consumer notices and explanations. The framework defense didn't survive the rewrite.

So why bother? Because the EU AI Act is binding on any US company whose AI output is used in the EU, and because customers, insurers, and auditors ask how you manage AI whether a law requires it or not. The framework gives you an answer with a recognized structure behind it.

NIST AI RMF vs ISO 42001 vs the EU AI Act vs NIST CSF

These four get lumped together. They do different jobs.

ISO/IEC 42001 is the one to reach for when a customer wants a certificate. The EU AI Act is the one you don't get to choose. And the NIST framework is the working method that feeds both.

The newest piece connects AI back to security. NIST's Cyber AI Profile (NIST IR 8596), released as a preliminary draft on December 16, 2025, maps AI risks onto CSF 2.0. It asks organizations to keep inventories of models, agents, API keys (the credentials that let software talk to an AI service), datasets, and the AI features built into other software. If your security program already runs on CSF, that draft is the bridge, and a NIST CSF assessment is the natural place to add it. Companies juggling NIST 800-171 too can see how the two security frameworks relate in NIST 800-171 vs NIST CSF.

AI governance sits beside a compliance program, not inside your managed IT contract. Treat it as its own workstream with its own owner.

A right-sized starting point: current profile, target profile

The AI RMF doesn't give you a checklist. It gives you profiles. A Current Profile describes how AI is actually being managed today. A Target Profile describes where you want to be. The gap between them is your plan.

For a business, that's the most useful idea in the whole document, and the easiest one to skim past. You don't need to address 72 subcategories. You need an honest description of today and a specific description of next quarter.

The inventory row decides everything below it. A business that classifies only the AI it remembers will miss the resume ranker the recruiting vendor switched on last year, and that's usually the one carrying the most risk.

If you already have a security lead who owns vendor risk, a written AI policy people actually follow, and an inventory updated in the last 6 months, you can run this internally and probably don't need outside help. If two or more of those rows read "nobody" or "undefined," that's the work an AI governance program is built to do.

If you'd like a second set of eyes on your Current Profile, speak to an AI governance expert.