NIST AI RMF Explained: Govern, Map, Measure, Manage
Short answer: the NIST AI Risk Management Framework (AI RMF 1.0) is voluntary guidance from the U.S. National Institute of Standards and Technology for managing AI risks to individuals, organizations and society. It was released on January 26, 2023, and its core is four functions: Govern, Map, Measure, Manage.
The four core functions
- Govern: the culture, policies, roles and accountability for AI risk. It applies across every stage.
- Map: understand the context. What is the system for, who does it affect, and what could go wrong?
- Measure: assess, analyze and track the risks you mapped, with methods and metrics.
- Manage: prioritize and act on risks, and keep responding as things change.
Each function breaks down into categories and subcategories with specific outcomes. Govern applies to all stages; Map, Measure and Manage apply to specific AI systems and lifecycle stages.
The seven characteristics of trustworthy AI
The framework describes trustworthy AI as:
- Valid and reliable
- Safe
- Secure and resilient
- Accountable and transparent
- Explainable and interpretable
- Privacy-enhanced
- Fair, with harmful bias managed
Companion resources
- AI RMF Playbook: suggested actions for each subcategory
- Generative AI Profile (NIST-AI-600-1): released July 26, 2024, for risks unique to generative AI
- Trustworthy and Responsible AI Resource Center: launched March 30, 2023
NIST says AI RMF 1.0 is being revised as part of the White House AI Action Plan, so check the NIST page for the current version.
NIST AI RMF and ISO/IEC 42001
NIST AI RMF gives you a risk vocabulary and structure. ISO/IEC 42001 gives you a certifiable management system. They work well together.
Sources: NIST AI RMF, nist.gov - AI RMF Core, airc.nist.gov - AI RMF 1.0 (PDF)
FAQ
What is the NIST AI RMF?
The NIST AI Risk Management Framework (AI RMF 1.0) is a voluntary framework from the U.S. National Institute of Standards and Technology to help organizations manage risks to individuals, organizations and society from AI. It was released on January 26, 2023.
What are the four functions of the NIST AI RMF?
Govern, Map, Measure and Manage. Govern applies across all stages of an organization's AI risk management; Map, Measure and Manage apply to specific AI systems and stages of the AI lifecycle.
Is there a NIST profile for generative AI?
Yes. NIST-AI-600-1, the Generative AI Profile, was released on July 26, 2024 to help organizations identify risks unique to generative AI.
Is the NIST AI RMF mandatory?
No. It is voluntary guidance. NIST notes that AI RMF 1.0 is being revised as part of the White House AI Action Plan.