The NIST AI Risk Management Framework (AI RMF) is a voluntary guide from the US National Institute of Standards and Technology for managing the risks of building, buying and using AI. It is organized into four functions called Govern, Map, Measure and Manage. It is not a checklist and nobody certifies you against it. You use it to describe how you manage that risk today, decide where you need to be, and work the gap.
That last sentence is the part most programs skip. We keep seeing the same scene in steering meetings, where someone asks “are we aligned with the NIST AI RMF?” and the room answers with a slide that lists the four functions next to a green tick. The honest answer is a document, two of them in fact, and by the end of this post you should know what goes in each and why the question gets harder in 2026, not easier.
What the NIST AI RMF is, and where it stands in 2026
NIST released AI RMF 1.0 (NIST AI 100-1) on January 26, 2023, after a process that ran 18 months and drew in more than 240 contributing organizations. Nobody is required to use it, which matters later when we get to the one place the law reaches for it.
The status has changed since publication, though. America’s AI Action Plan, published in July 2025, told NIST to revise the framework “to eliminate references to misinformation, Diversity, Equity, and Inclusion, and climate change”. NIST’s own page now states that the AI RMF 1.0 is being revised as part of the White House AI Action Plan. As of October 30, 2026 the download offered there is still 1.0, with no revised draft or version number published. The Playbook carries the same notice and says it will be updated after the framework is.
Our advice is to build on 1.0 anyway. The revision NIST was asked for targets specific references, while the risk-management machinery of functions, outcomes and profiles is what security teams actually implement, and we would be surprised to see that machinery thrown out. We will come back to why the version number still matters, because one US state wrote it into law.
NIST AI RMF core functions: Govern, Map, Measure, Manage
The Core breaks the four functions into categories and subcategories, which are outcomes rather than controls. The framework is blunt that these “do not constitute a checklist, nor are they necessarily an ordered set of steps”. Govern is designed as a cross-cutting function that runs through the other three, and once it is in place NIST expects most users to start with Map and then continue to Measure or Manage, iterating as they go.
Counting the four tables in AI 100-1 gives 19 categories and 72 subcategories, and the distribution tells you where the effort goes.
In practice, each function produces different evidence, and a few subcategories carry most of the security weight.
- Govern sets policy, accountability and culture. For a security team, the outcome that matters first is GOVERN 1.6, “mechanisms are in place to inventory AI systems”, followed by GOVERN 6.2, contingency processes for failures in high-risk third-party data or systems.
- Map establishes context for each system, starting with MAP 1.1 (intended purpose, users, setting and applicable laws documented) and MAP 4.1, which covers the risks of components, third-party data and software included.
- Measure tests what Map found. MEASURE 2.7 asks that “AI system security and resilience” be evaluated and documented, and MEASURE 1.1 asks you to record the risks you cannot measure, which in our reviews is the one we most often find empty.
- Manage acts on the results. MANAGE 2.4 requires mechanisms “to supersede, disengage, or deactivate” systems that drift outside their intended use, and MANAGE 4.1 covers post-deployment monitoring, incident response, recovery and change management.
What the AI RMF expects from security teams
Secure and resilient is one of seven trustworthiness characteristics in the framework, alongside valid and reliable, safe, accountable and transparent, explainable and interpretable, privacy-enhanced, and fair with harmful bias managed. Section 3.3 names the threats directly, adversarial examples, data poisoning, and exfiltration of models, training data or other intellectual property through AI system endpoints, and points to the NIST Cybersecurity Framework for the controls.
That pointer is easy to misread as “your existing program covers it”. It does not, because Appendix B of the same document lists what makes AI risk different from software risk. Training changes can fundamentally alter behavior, datasets go stale relative to the deployment context, data, model and concept drift trigger more frequent maintenance, and it is often hard to decide what to test at all. A vulnerability scan answers none of those questions. We wrote about one of them, data poisoning, on October 23, and it is a good example of a risk that lives in Map and Measure rather than in your patch cycle.
For the controls themselves, NIST is building a second track. The Cyber AI Profile (NIST IR 8596) maps AI cybersecurity to CSF 2.0 outcomes across three focus areas (securing AI system components, AI-enabled defence and thwarting AI-enabled attacks), and its preliminary draft closed for comments on January 30, 2026. Use the AI RMF for the risk decisions and the CSF profile for the security outcomes, so the two programs reinforce each other instead of competing for the same owners.
NIST AI 600-1: the Generative AI Profile
If your exposure is mostly large language models, the document you will spend more time in is NIST AI 600-1, released July 26, 2024. It is a cross-sectoral profile of the AI RMF, and it defines 12 risks that generative AI creates or makes worse. Among them are confabulation, data privacy, information integrity, information security, intellectual property, harmful bias or homogenization, human-AI configuration, and value chain and component integration.
The profile then lists more than 200 suggested actions keyed to AI RMF subcategories, concentrated on four considerations its working group chose: governance, content provenance, pre-deployment testing and incident disclosure. That focus is useful to know before you start. Our reading is that runtime operations get comparatively little attention as a result, so expect to bring your own detection and response design. Our prompt injection defence guide is one place to start on that side.
How to use the NIST AI RMF Playbook and profiles
Back to the steering meeting. The two documents the honest answer needs are what the framework calls profiles. A Current Profile describes how AI is managed today and a Target Profile describes the outcomes you need, and comparing them reveals the gaps an action plan has to close. NIST deliberately prescribes no template, which is freedom and a trap at once.
Here is the sequence we use, in the order the framework suggests.
- Inventory first (GOVERN 1.6). List every system you build, buy or embed that uses a model, including features switched on inside SaaS products, with an owner for each. Without this, every later step samples the systems you already knew about.
- Write the Current Profile per system or per system class, subcategory by subcategory, with the evidence that exists today. “Partially, owner X, evidence Y” beats a percentage.
- Set the Target Profile from your risk tolerance and legal exposure. A customer-facing generative system should carry the AI 600-1 actions, while an internal summarization tool may not need all 72 subcategories.
- Pull suggested actions from the AI RMF Playbook, which aligns suggestions to each subcategory and is explicitly “neither a checklist nor set of steps to be followed in its entirety”. Borrow what fits and record why you skipped the rest.
- Prove the deactivation path (MANAGE 2.4) and the third-party contingency (GOVERN 6.2) with a tabletop exercise, because those are the outcomes most likely to exist only on paper.
Why the version number matters in Texas
The revision would be an academic detail if no law referred to the framework, but one does. The Texas Responsible AI Governance Act has been in force since January 1, 2026. Its section 552.105(e) says a defendant may not be found liable when it discovers a violation through an internal review process while substantially complying with “the most recent version” of NIST’s Generative AI Profile or another recognized AI risk framework. We walked through that defence in our explainer on the Texas law.
“Most recent version” is a moving target. When NIST publishes a revised framework or profile, the standard your internal review is measured against moves with it. That is why the profile documents from the previous section need a named owner who watches for the release and resets the Target Profile within weeks, not at the next annual review. Colorado’s original AI law pointed at the AI RMF too, before the replacement statute dropped that duty, which is a reminder that the legal hooks change faster than the framework does.
Frequently asked questions
Is there a NIST AI RMF certification?
Not from NIST. The framework, the Playbook and NIST’s FAQ describe a voluntary resource, and none of them sets out a certification scheme. If a customer or regulator wants an audited certificate for your governance program, the standard built for that is ISO/IEC 42001.
NIST AI RMF vs ISO 42001: which do you need?
Usually both, doing different jobs. ISO/IEC 42001 is a management system you can be audited against, as our ISO 42001 certification guide explains, while the AI RMF describes outcomes and leaves the evidence to you. NIST lists a NIST AI RMF to ISO/IEC 42001 crosswalk contributed by Microsoft, with the caveat that a listing does not mean either resource fully covers the other. We run the profiles as the risk engine and let the 42001 system hold the evidence.
Is the NIST AI RMF mandatory?
No. NIST’s FAQ answers that question with a plain no and describes the framework as voluntary. Law can still give it weight, as the Texas defence above shows, because a voluntary framework becomes a yardstick once a statute names it.
Is there a NIST AI RMF 2.0?
Not yet. As of October 30, 2026, NIST’s AI RMF page offers version 1.0 for download and says it is being revised under the White House AI Action Plan, without a published draft or date. Build on 1.0, and assign someone to track the release so your Target Profile is reset when it lands.
Is NIST AI 600-1 still valid?
Yes. It remains the published Generative AI Profile and is listed on NIST’s framework page. NIST has not said whether it will change alongside the framework, and Texas law ties its defence to whichever version is most recent, so treat your 600-1 mapping as a living document rather than a one-time project.
Bottom line: what to do this week
If someone asks whether you are aligned with the NIST AI Risk Management Framework, answer with a Current Profile and a Target Profile, not a slide. Start this week with the inventory behind GOVERN 1.6, name an owner for the revision, and if you want an outside view of the gap, our AI governance and assurance team builds exactly these profiles.