NIST AI Risk Management Framework
A voluntary guidance from the U.S. National Institute of Standards and Technology outlining best practices for mitigating risks across AI system lifecycles.
Definition
A non-binding set of principles and practices organized into Core Functions (Govern, Map, Measure, Manage) and Tiers (organisational maturity levels). It helps organizations identify AI risks (bias, safety, security), prioritize controls, and measure progress over time. Governance integrates the NIST AI RMF into policies, aligns internal risk-assessment tools to its categories, and uses its maturity model to benchmark capabilities against peers.
Real-World Example
A financial firm adopts the NIST AI RMF: they map all AI assets to RMF risk categories, assign each a maturity tier, and conduct quarterly “Map” sessions to refresh risk profiles. Over a year, they progress from Tier 2 (Repeatable) to Tier 3 (Defined) by formalizing risk-assessment templates and integrating them into project workflows.
.svg)
