- The NIST AI RMF is a voluntary AI risk management framework, released in January 2023, with a generative AI profile from July 2024.
- The four functions are Govern, Map, Measure and Manage; in a small team they are four questions and a one-page register.
- NIST states that version 1.0 is being revised, so check current documents.
Managing AI risk sounds like something for large organizations, compliance departments and lengthy documents. Yet the framework developed by the US institute NIST scales down to a team of a few people if you extract its essence. The NIST AI Risk Management Framework was created to better manage risks to individuals, organizations and society associated with artificial intelligence. NIST stresses that it is intended for voluntary use and is meant to help incorporate trustworthiness into the design, development, use and evaluation of AI products, services and systems.
Where it came from and what state it is in
According to NIST’s page the framework was released on 26 January 2023 after an open process with consultations, draft versions and workshops. It is accompanied by a Playbook, a roadmap and other materials, and on 26 July 2024 a profile for generative AI (NIST AI 600-1) was released, which helps identify risks unique to such systems and proposes actions. NIST also states that AI RMF 1.0 is being revised as part of the action plan on AI, and on 7 April 2026 it published a concept note for a profile for critical infrastructure. The conclusion: the framework is alive, so check the project’s page before adoption. The full AI RMF 1.0 document is available free of charge.
Four functions as four questions
The core of the framework is four functions: Govern, Map, Measure, Manage. In a large organization each has its own processes, while in a small team you can turn them into four questions that you answer once a quarter and with every new use of AI.
| A question in a small team | An example action | |
|---|---|---|
| Govern | Who is responsible for what and what rules are there? | A one-page policy: allowed tools, data, an owner for each use |
| Map | Where is AI used and what can go wrong? | A list of uses with audiences, data and the impact of an error |
| Measure | How is it known to work and how often does it err? | A test set and a periodic quality check |
| Manage | What to do about the risk and how to react to an incident? | Permission limits, human consent, a response plan |
A risk register on one page
The simplest form of adoption is a table with one row per use of AI. Columns: a description of the use, an owner, the data, which errors are possible and how serious, current safeguards, the way quality is measured, the date of the last review. Start with three uses that really work in the company. For each ask what happens when the model errs and who will notice. This exercise corresponds to the Map function, and the columns on safeguards and measurement to Manage and Measure. For applications with language models use the OWASP list as a list of risks, and for measurement the tests described in the article How to evaluate an agent before you trust it.
- 01GovernRules, owners, one page.
- 02MapA list of uses and possible errors.
- 03MeasureTests and a periodic quality check.
- 04ManageSafeguards, consents, an incident plan.
- 05RegisterOne row per use.
- 06ReviewEvery quarter and at every change.
The first quarter step by step
In the first month do an inventory: list all uses of AI in the company, including those the team mentions in passing, such as an assistant in an editor or a transcription tool. In the second month fill in the register for the three most important and write a one-page policy. In the third prepare a test set for the most important of them and plan the first review. At the end of the quarter discuss the results with the team: which risks shrank, which remain, what has to change. Such a rhythm does not need a compliance department, only one person with a mandate and two hours a month.
How it relates to the law
The AI RMF does not replace the law. The EU regulation on AI introduces obligations depending on the risk level, with prohibitions, requirements for high-risk systems and transparency rules; I describe them in the article The AI Act in brief. The practical benefit of the NIST framework is different: an orderly way of thinking about risk that also eases meeting legal requirements, because you have a description of uses, owners and measurements. For small teams a light version and a habit of review are enough. You will find the whole topic in the AI in business hub, and a first adoption plan in the article AI in a small business.
Last checked: 20 October 2026. NIST is revising the framework; this is not legal advice.