The NIST AI Risk Management Framework: Functions, Profiles and How to Use It

The NIST AI Risk Management Framework (AI RMF) is a free, voluntary framework from the US National Institute of Standards and Technology for identifying and managing the risks of AI systems. Version 1.0, published as NIST AI 100-1 on 26 January 2023, organises the work into four functions, Govern, Map, Measure and Manage, and defines seven characteristics of trustworthy AI. It is not law and carries no certificate, but it gives organisations a shared vocabulary for AI risk.

For UK organisations it is most useful as a working method: list your AI systems, decide how much risk is acceptable, test against that and record what you did. Our AI governance guide covers the wider programme and UK law; this page explains the framework itself.

What is the NIST AI Risk Management Framework?

It is a voluntary, non-sector-specific framework for the organisations and people involved across an AI system’s life cycle, from design and development to deployment, operation and evaluation, whom NIST calls “AI actors”. It has two parts:

• Part 1 frames AI risk: how AI risks differ from software risks, who is involved, and what makes an AI system trustworthy.
• Part 2 is the AI RMF Core: four functions broken into 19 categories and 72 subcategories, plus guidance on profiles.

NIST’s AI RMF page hosts the companion Playbook (suggested actions for each subcategory), a roadmap and crosswalks to other frameworks. It also states that AI RMF 1.0 is being revised as part of the White House AI Action Plan, so check the current version before you build controls around specific subcategory wording.

What are the seven characteristics of trustworthy AI?

The framework judges AI risk against seven characteristics. Valid and reliable is the base the others rest on, and accountability and transparency apply across all of them. NIST expects trade-offs: privacy-enhancing techniques, for example, can reduce accuracy.

What are the four functions of the AI RMF?

The four functions are Govern, Map, Measure and Manage. Govern is cross-cutting: it sets the policies, roles and culture the others depend on. Map, Measure and Manage are applied to each AI system, repeatedly across its life.

Govern covers the end of a system’s life as well as the start, with a process for decommissioning AI safely (GOVERN 1.7), and it covers AI you did not build (GOVERN 6). Map ends with a go or no-go decision: you should know enough about a system’s impacts to decide whether it should be built or deployed at all. Manage asks you to mitigate, transfer, avoid or accept each priority risk (MANAGE 1.3), and to be able to supersede, disengage or deactivate a system that behaves outside its intended use (MANAGE 2.4).

What are AI RMF profiles?

A profile applies the framework to a specific setting. The AI RMF describes use-case profiles (NIST’s own examples are hiring and fair housing), temporal profiles that compare a current state with a target state, and cross-sectoral profiles for risks shared across many uses.

The best-known profile is the Generative AI Profile, NIST AI 600-1, published on 26 July 2024. It identifies 12 risks that are unique to or made worse by generative AI, including confabulation (confidently wrong output), information security, data privacy, harmful bias, intellectual property, and value chain and component integration, and maps suggested actions to the AI RMF subcategories. Use it alongside the core if you run chatbots, copilots or agents built on large language models. On 7 April 2026 NIST also released a concept note for an AI RMF Profile on Trustworthy AI in Critical Infrastructure.

Is the NIST AI RMF mandatory?

No. NIST describes the AI RMF as voluntary, and no UK law requires it. There is no certification scheme either, so nobody can issue an “AI RMF certificate”; you can say your programme is aligned to it and back that with evidence.

It still matters in the UK when US customers use it in supplier due diligence, when a new AI governance programme needs a structure, or when NIST’s crosswalks let one set of evidence serve several frameworks.

NIST AI RMF vs ISO 42001 vs the EU AI Act

The AI RMF is guidance, ISO/IEC 42001 is a certifiable management system standard, and the EU AI Act is law.

Free download: our NIST AI RMF to ISO 42001 crosswalk (.xlsx) maps all 19 AI RMF categories to the ISO/IEC 42001 clauses and Annex A controls that cover similar ground, with columns for your owner, evidence and status. It is our indicative mapping; NIST also publishes its own crosswalks on its AI RMF page.

One practical approach is to use the AI RMF to structure the risk work, ISO/IEC 42001 to certify the management system around it, and the EU AI Act to decide which obligations are mandatory. Prohibited practices have applied since 2 February 2025, while the Digital Omnibus on AI, Regulation (EU) 2026/1744, pushed most high-risk obligations back to 2 December 2027 and 2 August 2028; our AI governance guide has the full timetable and our ISO 42001 explainer covers the standard in depth.

Where does AI red teaming provide evidence?

Measure is the function that needs test evidence. AI red teaming produces it by showing whether an AI system can be manipulated, made to leak data or pushed into unsafe actions.

The OWASP Top 10 for LLM Applications is a practical checklist for the security part of MEASURE 2.7. Our AI red teaming tests against it, including the web and API layer around the AI feature and, where a model can act, the tools behind it (see agentic AI security).

How do you start using the NIST AI RMF?

Start with Govern, then take one real system through the other three functions. Each step below names the part of the framework it satisfies:

If you already run an ISO 27001 information security management system, reuse its risk method, document control and internal audit rather than building a parallel process. The NIST Cybersecurity Framework covers cyber risk across the organisation; the AI RMF adds risks that cyber frameworks do not address, such as harmful bias and, under the Generative AI Profile, confabulation.

Why Sovereign Secure?

Sovereign Secure Ltd was incorporated in 2012 and works from its headquarters in Accrington, Lancashire, and offices in Los Angeles, Singapore, Dubai and Dhaka.

• AI and LLM penetration testing, alongside web, API, cloud, network and mobile testing, so the AI feature and the systems around it can be assessed together.
• ISO 27001 certified, so we run the same kind of risk-based management system that AI governance builds on.
• PCI SSC Qualified Security Assessor (QSA) company, also a Qualified PIN Assessor and Card Production Security Assessor, and a member of the PCI SSC Global Executive Assessor Roundtable for 2026 to 2028.
• An IASME-licensed Cyber Essentials certification body.

No one can issue an AI RMF certificate, and we do not claim to; our part is independent test evidence for the Measure function.

What should you do next?

If you need independent evidence for MEASURE 2.7, ask for an AI penetration testing quote. Tell us which AI features are in scope, what data and tools they can reach and when you launch, and we will send a fixed-price proposal.