Four functions, deliberately not a standard

The AI Risk Management Framework (AI RMF 1.0, January 2023) is what NIST produces when Congress asks for guidance rather than regulation: a voluntary, sector-agnostic structure that an organisation of any size can adopt in part or in full. It has no certification, no audit scheme and no conformity assessment. What it has is a vocabulary that has become close to universal, and a companion Playbook of suggested actions for each of its elements.

The four functions are the vocabulary. Govern is the cross-cutting one: policies, roles, accountability, culture, and the decision to manage AI risk at all. Map establishes context: what the system is for, who it affects, what could go wrong. Measure assesses and tracks the risks identified, with metrics, tests and evaluation. Manage acts on them: prioritise, respond, monitor, and decide when to stop. Each function breaks into categories and subcategories, 72 in all, and the Playbook attaches practices to each. The AI TRiSM entry maps this structure to Gartner's category vocabulary; the ISO/IEC 42001 entry maps it to the certifiable management system that covers the same ground.

The seven characteristics of trustworthy AI

Alongside the functions, the framework names the properties a trustworthy system has, and most organisations find this list more useful day to day than the functions themselves. A system should be valid and reliable; safe; secure and resilient; accountable and transparent; explainable and interpretable; privacy-enhanced; and fair, with harmful bias managed. NIST is explicit that these trade off against each other and that the balance is a contextual judgement, which is why the framework refuses to rank them.

The list doubles as a checklist for what a risk assessment should cover, and the site's own register is organised so that each characteristic has risks and controls behind it: explainability and model interpretability for one pair, fairness and bias for another, the security entries for a third.

What NIST has added since 1.0

The framework has become a family, and it matters which member is meant.

  • AI 600-1, the Generative AI Profile (July 2024). A cross-sectoral profile that names twelve risks specific to or amplified by generative AI, from confabulation and data privacy to information integrity and harmful bias, and maps several hundred suggested actions to the four functions. This is the document most LLM governance programmes actually use, and the register's hallucination entry takes its term "confabulation" from it.
  • AI 100-2 E2025, Adversarial Machine Learning (March 2025). A taxonomy and shared vocabulary for attacks on AI systems and their mitigations: evasion, poisoning and privacy attacks on predictive models, plus supply-chain attacks, direct and indirect prompt injection, misuse and agent security for generative ones. It is the NIST document this glossary's security entries, such as prompt injection and data poisoning, map to.
  • IR 8596, the Cybersecurity Framework Profile for AI (preliminary draft, December 2025). Bridges the AI RMF to the Cybersecurity Framework 2.0 around three focus areas: securing AI components, using AI for cyber defence, and thwarting AI-enabled attacks. Comments closed on 30 January 2026 and an initial public draft is expected during 2026. Treat as direction, not requirement.
  • COSAIS, control overlays for securing AI systems (in development). Maps SP 800-53 controls onto AI deployment types, including single- and multi-agent systems, and identifies where the existing control families fall short. The first annotated outline, for predictive AI, was published in January 2026; no overlay is final.
  • The AI Agent Standards Initiative (February 2026). Launched by NIST's Center for AI Standards and Innovation, with work on agent security, identity infrastructure and interoperability. See agentic AI.

Only the first two of these are final. An organisation citing NIST for AI cyber security or agent security in 2026 is citing drafts, and should say so.

A framework under revision

America's AI Action Plan, published by the White House on 23 July 2025, directed NIST to revise the AI RMF to remove references to misinformation, diversity, equity and inclusion, and climate change. As of October 2026 no revised draft has been published and 1.0 remains the current version. Nothing published so far changes the four functions or the structure of the trustworthiness characteristics.

The section to watch is the treatment of information integrity in the Generative AI Profile, which several governance programmes use as the basis of their misinformation controls. A programme that cites it should record which version it relied on. The same plan reshaped the institutions around the framework: the US AI Safety Institute became the Center for AI Standards and Innovation (CAISI) in June 2025, with a narrower focus on standards and national-security evaluation.

How organisations actually use it

Three patterns, in descending order of frequency.

As a vocabulary and a gap analysis. Most organisations take the 72 subcategories, mark each as done, partial or not applicable, and use the result as a roadmap. This is also how the framework is most often used as evidence: not as a certificate but as a structured self-assessment a board or regulator can read.

As the risk-management half of a 42001 programme. 42001 says a risk assessment must be done; the AI RMF and ISO/IEC 23894 say how. Most crosswalks pair them.

As the reference regulators point to. The framework has no legal force anywhere, but US federal agencies, several state laws and a number of sector regulators cite it, and the EU AI Act's harmonised standards work draws on it. Conforming to it is not compliance with anything, and it is the most widely recognised way of showing that an AI risk process exists.

Where it sits in the register

The four functions are the register's own lifecycle. Govern is the AI ownership and accountability framework and the AI acceptable use policy. Map is the AI inventory and the AI impact assessment process. Measure is testing AI systems and bias testing and fairness monitoring. Manage is AI system monitoring and logging and incident response and rollback. AI lifecycle controls gap is what happens when one of the four is missing, and unclear AI ownership and accountability is Govern stated as its failure.