By the end you'll know
- What the NIST AI RMF is, who it's for, and why it's voluntary but everywhere
- The seven characteristics of a trustworthy AI system
- The four functions, and how their categories and subcategories are numbered
- The Generative AI Profile's twelve risks, and how to tell which apply
- What's changed around the framework in 2025 and 2026
- How to write a profile for a real system: outcome, evidence, gap
Before you start
- You need: Lesson 1. The Compliance track's NIST frameworks lesson helps: the AI RMF is built the same way as NIST's Cybersecurity Framework.
- Not legal advice. Quotes from the framework were checked against NIST's text in November 2026.
- Maps to: the IAPP's AIGP (Domain III, governing AI development, and Domain IV, deployment and use).
The short version
- The AI RMF (NIST AI 100-1, January 2023) is a voluntary, risk-based framework for anyone who builds, buys or uses AI.
- Trustworthy AI has seven characteristics: valid and reliable; safe; secure and resilient; accountable and transparent; explainable and interpretable; privacy-enhanced; fair, with harmful bias managed.
- Four functions: Govern (everywhere), then Map, Measure and Manage for each system. 19 categories, 72 subcategories, each an outcome to reach.
- The Generative AI Profile (NIST AI 600-1, July 2024) adds twelve risks specific to generative models, from confabulation to supply chain.
- In 2026: a revision is under way, a Cyber AI Profile and control overlays are in draft, and NIST's pages now say "super intelligence".
- The mayor check's profile: most of Map, Measure and Manage have evidence; Govern is mostly gaps.
What the AI RMF is
The NIST AI Risk Management Framework (published as NIST AI 100-1) was released on January 26, 2023, after two drafts and two years of public comment. NIST, the National Institute of Standards and Technology, is the US agency behind the Cybersecurity Framework and SP 800-53, and the AI RMF works the same way: it describes outcomes to reach, not tools to use or steps to follow.
Three things to know about it:
- It's voluntary. No law requires it on its own. But it's referenced by OMB's memos for federal agencies, by state laws as a defense (following a recognized framework counts in your favor), by contracts, and by vendors' assurance reports. In practice, "we follow the NIST AI RMF" is the common language.
- It's for anyone in the AI lifecycle: people who build models, build systems on them, buy them, deploy them, or are affected by them. NIST calls them all AI actors.
- It's about risk, not rules. It asks you to decide what could go wrong, how likely and how bad, and to act in proportion. A chatbot suggesting recipes and a model screening loan applications get different answers to the same questions.
It comes with a Playbook, a companion with suggested actions, references and documentation ideas for every subcategory. The framework says what to achieve; the Playbook suggests how.
Trustworthy AI: seven characteristics
Part 1 of the framework describes what it's aiming for. A trustworthy AI system is:
- Valid and reliable: it does what it's meant to, accurately, and keeps doing so. NIST treats this as the base the others rest on.
- Safe: it doesn't put people, property or the environment in danger.
- Secure and resilient: it resists attacks and recovers from failures, including ones aimed at the model.
- Accountable and transparent: someone is answerable for it, and information about it is available to the people who need it.
- Explainable and interpretable: people can understand how it works, and what an output means.
- Privacy-enhanced: it protects people's autonomy and data.
- Fair, with harmful bias managed: it doesn't produce unjust outcomes for groups of people.
They pull against each other. A more explainable model can be less accurate; more privacy can mean less data to check fairness with. The framework doesn't settle those trade-offs: it asks you to make them on purpose, and write down why.
The core: four functions
- Govern runs across everything: the policies, roles, culture and supplier rules that make the other three happen. It applies to the organization, not to one system.
- Map establishes context for one system: what it's for, who's affected, what could go wrong.
- Measure checks it: tests, metrics, tracking over time.
- Manage acts on what Map and Measure found: decides what to fix, responds, monitors after release.
Each function has categories, numbered like MAP 3, and each category has subcategories, numbered like MAP 3.5, the outcomes you'd actually show evidence for. The counts, from NIST's own tables:
| Function | Categories | Subcategories | The categories, in short |
|---|---|---|---|
| Govern | 6 | 19 | 1 policies and processes · 2 accountability · 3 workforce diversity and inclusion · 4 a culture that talks about risk · 5 engaging the people affected · 6 third parties and supply chain |
| Map | 5 | 18 | 1 context · 2 categorizing the system · 3 capabilities, uses, costs and benefits · 4 risks of every component, third-party ones too · 5 impacts on people and society |
| Measure | 4 | 22 | 1 methods and metrics · 2 evaluation against the trustworthy characteristics · 3 tracking risks over time · 4 checking the measurement works |
| Manage | 4 | 13 | 1 prioritizing and responding · 2 maximizing benefit, minimizing harm · 3 third-party risks · 4 response, recovery, monitoring and communication |
72 outcomes in all. Nobody does all 72 at once, for every system. You pick the ones that matter for your risk, and that choice is written down as a profile.
A few subcategories, in NIST's words, to show the level they're written at:
- GOVERN 1.6: "Mechanisms are in place to inventory AI systems and are resourced according to organizational risk priorities."
- MAP 1.1: "Intended purposes, potentially beneficial uses, context-specific laws, norms and expectations, and prospective settings in which the AI system will be deployed are understood and documented."
- MAP 3.5: "Processes for human oversight are defined, assessed, and documented in accordance with organizational policies from the GOVERN function."
- MEASURE 2.5: "The AI system to be deployed is demonstrated to be valid and reliable."
- MANAGE 2.4: "Mechanisms are in place and applied, and responsibilities are assigned and understood, to supersede, disengage, or deactivate AI systems that demonstrate performance or outcomes inconsistent with intended use."
Each is a claim you could be asked to prove. That's how to read the framework: not "did we think about this?", but "where's the evidence?".
Profiles
A profile is the framework applied to something specific: a sector, a kind of system, or one system. NIST describes two uses:
- A use-case profile: the subcategories that matter for, say, hiring tools or medical imaging, with guidance specific to them.
- Current and target profiles: where a system stands today, and where it needs to be. The difference is your work plan.
The most important profile NIST has published is for generative AI.
The Generative AI Profile: twelve risks
NIST AI 600-1, released July 26, 2024, applies the AI RMF to generative models (ones that produce text, images, audio or code). It names twelve risks that are new, or much worse, with generative AI, and suggests around two hundred actions against them, each tied to an AI RMF subcategory.
| Risk | In plain words | The mayor check? |
|---|---|---|
| CBRN information or capabilities | Help with chemical, biological, radiological or nuclear weapons | No: it reads names |
| Confabulation | Confident, made-up answers | Yes: an invented name. The verbatim guard rejects any name not on the page |
| Dangerous, violent or hateful content | Producing harmful material | No: its output is one name |
| Data privacy | Exposing or inferring personal data | Low: public officials' names, published by cities |
| Environmental impacts | Energy and resources used | Low: a 7-billion-parameter model, and pages that haven't changed are skipped |
| Harmful bias or homogenization | Worse results for some groups | Worth checking: nickname matching was built around common English names |
| Human-AI configuration | Over-trust, automation bias, the wrong human role | Yes: the reviewer at /admin/review |
| Information integrity | False information that looks true | Yes: a wrong name marked verified (Lancaster, Ohio) |
| Information security | Attacks on or through the model, prompt injection | Yes: page text could carry instructions; the model can't write anything, and its answer must be on the page |
| Intellectual property | Using or reproducing others' work | Low: reads public pages, honors robots.txt |
| Obscene, degrading or abusive content | Producing it | No |
| Value chain and component integration | Risks from models, data and tools you didn't make | Yes: an open model from another company, run through Ollama |
Six apply, and that's the useful part. Twelve risks sound overwhelming; going down the list for one system shows most are irrelevant to it, and the rest become a short, specific list. The bias row is the kind of thing this exercise is for: nobody set out to make the check worse for some names, but a nickname list built for "Bill" and "William" may do nothing for names from other languages. That's a test to write, not a conclusion to draw.
What's changed in 2025 and 2026
The framework hasn't changed, but a lot has moved around it:
- A revision is under way. NIST's page says AI RMF 1.0 "is being revised as part of the White House AI Action Plan". The plan, from July 2025, asked NIST to remove the framework's references to misinformation, diversity, equity and inclusion, and climate change. If that happens, expect changes to GOVERN 3 (workforce diversity), and possibly to the Generative AI Profile's information integrity and environmental risks. Check the version you're citing.
- A Cyber AI Profile is in draft: a profile of the Cybersecurity Framework 2.0 for AI, around three focus areas: securing AI system components, using AI for cyber defense, and thwarting AI-enabled attacks. Its preliminary draft closed for comment in January 2026.
- Control overlays for SP 800-53, which turn AI security into the control language federal systems already use. The project started in 2025 as COSAiS ("Control Overlays for Securing AI Systems"), released an annotated outline in January 2026, and was renamed in October 2026.
- A critical infrastructure profile: a concept note, April 2026.
- A new name. Executive Order 14434 (September 29, 2026) has federal agencies use "super intelligence" (SI) for what used to be called AI, in their own documents and websites. NIST's pages are being updated; the overlays project is now "Control Overlays for Super Intelligence Systems". The legal meaning is unchanged, and so far the framework itself is still called the AI RMF.
For engineers, the practical effect is small: the 72 outcomes are what reviews ask about, and they haven't changed. But when you cite the framework, cite the version and date.
A profile for the mayor check
A current profile for one system: the subcategories that matter for its risk, the evidence that each is met, and the gaps. Evidence is from the check's documentation and code (version 7).
| Subcategory | Outcome, in short | Evidence | Status |
|---|---|---|---|
| GOVERN 1.1 | Legal requirements understood and documented | Public pages only; robots.txt honored; identified user agent | Partly: practiced, not written down |
| GOVERN 1.6 | AI systems are inventoried | None: this is the only AI system, but nothing records that | Gap (Lesson 6) |
| GOVERN 2.1 | Roles and responsibilities documented | One owner, who also reviews; not written | Gap |
| GOVERN 6.1 | Third-party AI risks covered by policy | Model pinned by name (qwen2.5:7b); no policy on changing it | Partly |
| MAP 1.1 | Purpose, context and limits documented | The check's own documentation: purpose, steps, what it never does | Met |
| MAP 3.5 | Human oversight defined and documented | Every name change is a proposal for /admin/review; the only automatic write is a stamp on an exact match | Met |
| MAP 4.1 | Risks of every component mapped, third-party ones too | The generative AI risks above; the model's source not assessed | Partly |
| MEASURE 2.3 | Performance measured in deployment-like conditions | Regression cases on real cities (Bullhead City, Lancaster, Wausau), dry run first | Met |
| MEASURE 2.5 | Shown to be valid and reliable | Three cases; no measured accuracy across all cities | Partly (Lesson 8) |
| MEASURE 3.1 | Risks tracked over time | Every run, verification and proposal recorded; nobody reviews the trend | Partly |
| MANAGE 2.4 | Ways to stop or override it | Circuit breaker halts a run if too many cities change; reviewer can reject | Met |
| MANAGE 4.1 | Monitoring after release | Weekly runs, records; no alert on reviewer approval rate | Partly (Lesson 9) |
| MANAGE 4.3 | Incidents and errors handled and communicated | Lancaster, Ohio: cause found, controls added, regression case; no written incident record | Partly |
The pattern is common for small, careful teams: the engineering outcomes (Map, Measure, Manage) are mostly met, because the person who built it thought about failure. The organizational outcomes (Govern) are mostly gaps, because they're about writing things down, assigning roles and having policies, and one person "just knows". Govern is what lets a system outlive the person who built it, and what an auditor asks for first.
The gaps also make this track's plan: an inventory (Lesson 6), data rules (Lesson 7), measured accuracy (Lesson 8), oversight that can be shown to work (Lesson 9), and a use policy (Lesson 11).
In real systems
- Profiles are the deliverable. Teams keep a current and target profile per significant AI system, usually a spreadsheet: subcategory, owner, evidence link, status, due date. Governance tools (and GRC platforms) have the AI RMF built in.
- Crosswalks map it to everything else. NIST publishes crosswalks from the AI RMF to ISO/IEC 42001, the EU AI Act and others, so one set of evidence answers several frameworks. Lesson 3 uses the ISO one.
- Scale to the risk. A low-impact internal tool might cover a dozen subcategories lightly; a system making decisions about people covers most of them, with independent review.
- Vendors answer with it. Security questionnaires increasingly ask which AI RMF outcomes a vendor meets, and for evidence. Lesson 10 is about asking.
Spot the problem
Work out what's wrong before you read the explanation.
Fully aligned, on paper. A company announces that its customer service chatbot is "fully aligned with the NIST AI RMF". Asked for the evidence, the team shares a document: for each of the 72 subcategories, a paragraph explaining how the company "is committed to" the outcome, signed by a vice president. Three months later, the chatbot promises a customer a refund policy that doesn't exist, and a court holds the company to it. What was wrong with the alignment? It was a description of intentions, not evidence of outcomes. Every subcategory is something to show: MEASURE 2.5 asks that the system be "demonstrated to be valid and reliable", not that someone be committed to it. There were no tests of what the bot says about policies, no record of what it had told customers, and no person checking answers that create obligations. Seventy-two paragraphs, and not one of them could have caught the refund. Three fixes: for each subcategory you claim, link evidence (a test result, a log, a review record), as the mayor check's profile does; pick the subcategories that match the system's real risks, here confabulation about policies, and cover those deeply instead of all 72 thinly; and never say "fully aligned": the framework is about managing risk, and a profile with honest gaps is more credible than one without any.
Keep this
| Part | What it is |
|---|---|
| NIST AI 100-1 (AI RMF 1.0) | The framework, January 2023. Voluntary, risk-based, outcome-focused |
| Seven characteristics | Valid and reliable · safe · secure and resilient · accountable and transparent · explainable and interpretable · privacy-enhanced · fair with harmful bias managed |
| Govern | Organization-wide: policies, roles, culture, people affected, third parties (19 outcomes) |
| Map | Per system: context, categorization, uses, component risks, impacts (18) |
| Measure | Per system: metrics, evaluation, tracking, checking the measures (22) |
| Manage | Per system: prioritize, respond, third parties, monitor and communicate (13) |
| Playbook | Suggested actions and documentation for every subcategory |
| NIST AI 600-1 | Generative AI Profile, July 2024: twelve risks, about two hundred actions |
| A profile | Subcategory · evidence · status · gap, for one system or sector |
Where you are now
You can explain what the NIST AI RMF asks for, read a subcategory as a claim that needs evidence, go down the Generative AI Profile's risks for a real system and keep only the ones that apply, and write a current profile with its gaps. The next lesson turns that kind of risk management into something an auditor can certify: ISO/IEC 42001, the AI management system standard.
Check yourself
Which function applies across the organization, not to one system?
How should a subcategory like MEASURE 2.5 be read?
The Generative AI Profile lists twelve risks. What's the right way to use them?
What does MANAGE 2.4 ask for, in the mayor check's terms?
Why were most of the mayor check's gaps in Govern?
What changed about the AI RMF itself in 2026?
Key terms
- AI RMF: NIST's AI Risk Management Framework, NIST AI 100-1.
- AI actor: anyone with a role in an AI system's lifecycle: builders, buyers, deployers, users, the people affected.
- Trustworthy characteristics: the seven qualities the framework aims for.
- Function, category, subcategory: the framework's three levels, such as GOVERN, GOVERN 1, GOVERN 1.6.
- Playbook: NIST's companion of suggested actions for each subcategory.
- Profile: the framework applied to a sector, a use case or one system; current and target profiles show the gap.
- Generative AI Profile: NIST AI 600-1, the framework applied to generative models.
- Confabulation: a model's confident, made-up output.
- Crosswalk: a mapping between two frameworks, so one set of evidence serves both.
Go deeper
- NIST: the AI RMF (opens in a new tab) and the AI RMF Core (opens in a new tab), every category and subcategory.
- NIST AI 600-1, the Generative AI Profile (opens in a new tab).
- NIST's control overlays project (opens in a new tab), and Crowell's summary of the Cyber AI Profile draft (opens in a new tab).
- The Federal Register: Inaugurating the Era of Super Intelligence (opens in a new tab).
- Try: write a current profile for one AI tool you use, with five subcategories. How many have evidence you could link to?
- Try: go down the Generative AI Profile's twelve risks for a chatbot your team uses. Which six (or so) apply?