NIST AI Risk Management Framework (AI RMF)
The NIST AI Risk Management Framework is a voluntary framework, released January 26, 2023, for managing risks that AI poses to individuals, organizations, and society. Its goal is to make AI systems more trustworthy across design, development, use, and evaluation. The document, AI RMF 1.0 (NIST AI 100-1), runs 48 pages.
How the framework is organized
- Sections 1 to 4: Framing AI risk, the intended audience, AI risks and trustworthiness, and how to judge the framework’s effectiveness
- Section 5, the Core: The four functions described below
- Section 6: Profiles, which tailor the framework to particular uses or sectors
- Appendix A: Descriptions of AI actor tasks
- Appendix B: How AI risks differ from traditional software risks
The four core functions
The Core is built around Govern, Map, Measure, and Manage.
- Govern: Builds a risk-aware culture through policies, processes, roles, and accountability. It applies across the other three functions.
- Map: Establishes context: what the system is for, who is affected, and what could go wrong.
- Measure: Analyzes, assesses, and monitors identified risks using quantitative, qualitative, or mixed methods, including testing and evaluation.
- Manage: Prioritizes risks and allocates resources to respond to them, including incident response and recovery.
Seven characteristics of trustworthy AI
Valid and reliable, safe, secure and resilient, accountable and transparent, explainable and interpretable, privacy-enhanced, and fair with harmful bias managed.
Related NIST resources
- AI RMF Playbook: Companion suggestions for putting the framework into practice
- Generative AI Profile (NIST AI 600-1): Published in 2024, it covers risks specific to generative AI.