NIST AI Risk Management Framework

The NIST AI Risk Management Framework is a voluntary guide to identifying, assessing, and managing the risks of artificial intelligence systems. It was published by the US National Institute of Standards and Technology in January 2023, after a public process that began in 2021, and it organises risk work into four functions: govern, map, measure, and manage 1.

The framework is not a law and does not create obligations. It is a vocabulary and a process, intended to be usable by any organisation in any sector. Its influence comes from adoption: federal agencies, contractors, standards bodies, and companies have written it into policies, procurement requirements, and management systems 2.

This entry describes the framework's structure, its trustworthiness characteristics, its generative AI profile, how organisations use it, and the criticism it attracts both for being too burdensome and for being too weak.

The framework grew out of the National AI Initiative Act of 2020, which asked NIST to develop standards and guidance for trustworthy AI. NIST issued a concept paper, took public comments, released a draft in 2022, and published version 1.0 in January 2023 2. NIST described the result as voluntary, rights-preserving, non-sector specific, and use-case agnostic.

The process was deliberately consensus-oriented. NIST convened workshops with industry, academia, civil society, and government, and the final document reflects compromises among those groups. That is one reason it is broad and process-focused: a document that specified quantitative thresholds would have been much harder to agree.

NIST has continued to publish companions rather than revise the core. A playbook of suggested actions appeared alongside the framework, followed by profiles for particular uses and crosswalks to other standards 3 4. The most consequential companion is the Generative AI Profile, published in July 2024, which applies the framework to risks specific to generative models 5.

The framework's development reflected a particular American approach: set a voluntary standard through a technical agency, let adoption spread through procurement and practice, and avoid legislation until the politics support it.

The framework is built around four functions. Govern is the cross-cutting function: it establishes accountability, policies, roles, and a risk culture. Map establishes context by describing the system, its intended use, its affected parties, and the risks it may pose. Measure analyses and assesses those risks with quantitative or qualitative methods. Manage prioritises risks and allocates responses, including monitoring and incident handling 1.

The functions are not a sequence. Govern runs throughout; mapping informs measurement; measurement informs management; and management feeds back into governance. Organisations are expected to iterate rather than complete a checklist.

Under each function the framework lists categories and subcategories — outcomes such as documented roles, tested systems, and monitored performance. The subcategories are deliberately general, and the playbook suggests concrete actions that could satisfy them 3.

The framework also defines profiles: descriptions of how the functions apply to a particular use case, sector, or risk tolerance. A profile is the mechanism by which a generic framework becomes specific, and the generative AI profile is the best-known example.

The framework names seven characteristics of trustworthy AI. Valid and reliable means the system performs as intended and its outputs are accurate for the context. Safe means it does not cause unacceptable harm under defined conditions. Secure and resilient means it withstands attacks and recovers from failure.

Accountable and transparent means responsibilities are assigned and decisions can be explained to affected parties. Explainable and interpretable means the system's outputs and mechanisms can be understood by the people who need to understand them. Privacy-enhanced means personal data is protected across the lifecycle. Fair, with harmful bias managed, means the system avoids discriminatory outcomes and the organisation actively works to reduce bias 1.

The characteristics can conflict. A more transparent system may reveal information that undermines privacy; a more secure system may be harder to audit. The framework treats these tensions as management problems rather than as a checklist to be maximised, which is realistic and leaves the trade-offs to the organisation.

The list is also a political settlement. It includes fairness and explainability, which civil-society groups demanded, alongside security and reliability, which industry emphasised, without ranking them or defining thresholds for any of them.

In practice, an organisation begins by defining the system and its context: who uses it, who is affected, what decisions it informs, and what could go wrong. That is the map function. It then selects measurements, which may include testing, red-teaming, audits, or expert review, and records the results.

The manage function turns those results into decisions: accept, mitigate, transfer, or avoid the risk. This is where the framework connects to ordinary risk management, and where its abstractions can become frustrating, because it does not say what level of risk is acceptable.

The playbook provides suggested actions for each subcategory, and crosswalks map the framework to other standards, including ISO/IEC 42001 for AI management systems 3 4. Organisations that already operate a management system can integrate the framework rather than build a separate process, which is the intended use. Larger organisations often pair it with a maturity model, assessing themselves against the subcategories and tracking progress over time.

The framework is also used in procurement. A contract can require a supplier to document its risk process against the framework, which gives the document force without legislation. That mechanism is now one of its main routes into practice 6.

The Generative AI Profile, NIST AI 600-1, was published in July 2024 in response to an executive order that asked NIST to address risks specific to generative models. It keeps the framework's structure and adds a list of risk categories and suggested actions 5.

The risks it names include confabulation, information integrity and disinformation, harmful bias and homogenisation, privacy leakage, security vulnerabilities, intellectual property concerns, chemical, biological, radiological, and nuclear information, and environmental impacts. The list is not exhaustive, and the profile says so; it is a starting point for scoping rather than a taxonomy. For each risk, the profile suggests actions mapped to the four functions.

The profile is more specific than the core framework, and it is still not prescriptive. It does not set thresholds, require testing regimes, or define acceptable performance. It describes what an organisation should consider and leaves the standard of care to the organisation and to the law that applies to it.

The profile has become a reference for organisations deploying generative systems, particularly in the public sector, where it is named in agency guidance 6.

The framework has no legal force of its own. Its practical authority comes from three sources: federal guidance that points agencies to it, contracts that require it, and the standards ecosystem that maps to it.

In the United States, executive action and Office of Management and Budget memoranda have directed agencies to use the framework in their AI governance 6. Oversight reports have found that agencies adopted it unevenly and that key requirements, including inventories and accountability structures, were incomplete 7.

Internationally, the framework sits alongside ISO/IEC 42001, which specifies requirements for an AI management system and can be certified 8. The two are compatible: the ISO standard provides an auditable management system, and the NIST framework provides risk-process detail. Many organisations use both, and NIST publishes crosswalks between them 4.

The relationship to the EU AI Act is different. The Act imposes binding obligations and relies on harmonised standards, not on the NIST framework. Companies that operate in both markets therefore maintain two compliance structures, which is one source of the complaint that AI governance is fragmenting.

The most common industry complaint is that the framework is resource-intensive without being specific. It asks organisations to document governance, map contexts, measure risks, and manage responses, but it does not say how much documentation is enough or which measurements count. Firms report that the work is real and the endpoint is unclear.

A second complaint is duplication. Companies already subject to ISO certification, sector regulation, and customer audits must map the framework onto existing processes. Crosswalks reduce but do not eliminate the work, and small firms without compliance staff find the overhead disproportionate.

A third is uncertainty about liability. Because the framework is voluntary, following it does not guarantee that an organisation has met its legal obligations, and failing to follow it does not automatically establish negligence. That ambiguity is uncomfortable for general counsel, who would prefer a safe harbour.

A fourth is that the framework was written before generative AI became the dominant use case. The profile addresses the gap, but the core document's categories and examples still reflect an earlier generation of systems, and updating it requires a public process that moves slowly.

Civil-society criticism is that voluntary guidance cannot constrain the organisations most likely to cause harm. A framework that an organisation adopts at its own discretion, interprets through its own risk tolerance, and assesses through its own processes provides little protection to people affected by its systems.

The absence of thresholds is the specific complaint. The framework names fairness as a characteristic but does not define disparate impact or require testing against a standard. It names transparency but does not require disclosure to affected communities. Critics argue that this leaves the substantive questions to the organisation, which has an interest in answering them cheaply.

The govern function is also seen as underdeveloped. It asks for accountability but does not specify who must be accountable, how independent they must be, or what happens when they are overruled. Without external oversight, governance can become a documentation exercise.

A further concern is capture. The consensus process that produced the framework gave industry a seat at the table, and the resulting document reflects the participants' preferences for flexibility. That is how standards are made, and critics argue it is also how standards end up weak 7.

The central disagreement is whether voluntary frameworks work. One account holds that they do: they give organisations a common vocabulary, spread through procurement, and improve practice faster than legislation could. On this view, the framework's flexibility is a feature, because it can be adopted across sectors and updated without a statute 2.

The other account holds that voluntary guidance is a substitute for regulation that lets the regulated write their own rules. On this view, the framework's influence is real but shallow, and the organisations that most need to change have the least incentive to adopt it.

The second disagreement is about American exceptionalism. Supporters argue that the US approach encourages innovation and that sector regulators can impose binding rules where needed. Critics point to the EU AI Act as evidence that comprehensive legislation is feasible and argue that the US framework's weakness becomes a competitive disadvantage when companies need to demonstrate safety to customers and insurers.

A third disagreement is empirical: how much the framework has actually changed organisational behaviour. Adoption is widely reported, but adoption of a document is not the same as implementation of a process, and independent audits of practice are rare. Until there are studies that measure outcomes rather than uptake, claims about the framework's effectiveness rest on inference from its design. What is not disputed is that the framework changed the vocabulary of AI governance in the United States, and that vocabulary now shapes how companies describe their own practices.