Glossary
Updated
A non-binding set of principles and practices organized into Core Functions (Govern, Map, Measure, Manage) and Tiers (organizational maturity levels). It helps organizations identify AI risks (bias, safety, security), prioritize controls, and measure progress over time. Governance integrates the NIST AI RMF into policies, aligns internal risk-assessment tools to its categories, and uses its maturity model to benchmark capabilities against peers.
Example
A financial firm adopts the NIST AI RMF: they map all AI assets to RMF risk categories, assign each a maturity tier, and conduct quarterly “Map” sessions to refresh risk profiles. Over a year, they progress from Tier 2 (Repeatable) to Tier 3 (Defined) by formalizing risk-assessment templates and integrating them into project workflows.