United States (federal) · voluntary framework
NIST AI RMF: what it asks, and the records to keep
NIST's voluntary framework for managing AI risks, organized into four functions (GOVERN, MAP, MEASURE, MANAGE) with 19 categories and 72 subcategories, plus seven characteristics of trustworthy AI. It is the most widely referenced US AI risk vocabulary and is being revised under the 2025 AI Action Plan.
01 / What it asks
What NIST AI RMF asks
Any organization that designs, develops, deploys, evaluates or uses AI systems and chooses to adopt it; no one is required to by the framework itself.
- 01GOVERN: set policies, accountability, culture and third-party controls for AI risk across the organization.
- 02MAP: establish each AI system's context, purpose, categorization, benefits, costs and impacts.
- 03MEASURE: select metrics and test, evaluate, verify and validate AI systems for trustworthiness characteristics; track risks over time.
- 04MANAGE: prioritize and treat AI risks, manage third-party risk, and monitor deployed systems with response and recovery plans.
- 05Optionally build use-case or sector profiles that select and tailor the subcategories that matter.
02 / AI work
Where it touches AI work
AI-specific. It addresses risks such as validity, reliability, safety, security, accountability, explainability, privacy and harmful bias in AI systems across their lifecycle.
03 / Dates
The dates that matter
NIST releases AI RMF 1.0 (NIST AI 100-1)
Generative AI Profile (NIST AI 600-1) released
AI Action Plan directs NIST to revise the AI RMF
Concept note for critical infrastructure AI RMF profile
EO 14434 shifts federal terminology from 'AI' to 'Super Intelligence'
04 / Enforcement
Who enforces it
None; voluntary. Contracts, agency policies or other laws may reference it.
05 / Records
Records an organisation keeps
What an auditor or an inquiry usually asks to see. Your obligations depend on your role and your facts.
- 01AI risk management policy mapped to AI RMF functions
- 02AI system inventory with context and risk categorization
- 03Test, evaluation, verification and validation (TEVV) reports with documented metrics
- 04Risk register with treatment decisions and post-deployment monitoring plans
Optional evidence · where Planisphere fits
Keep a record anyone can check
When your team meets a duty, Planisphere can seal the event it reports as a receipt.
A disclosure shown, a review signed, a model change approved: the event your system reports.
The event becomes a sealed receipt, dated and attributed to whoever is signed in.
Paste the receipt into Verify. No account or key.
A record supports your compliance evidence process. It is not a legal finding or a certification. Systems that call Planisphere's gate API can also hold or refuse an action before it runs.
QUESTIONS
The questions that come next
How does an evidence record map to NIST AI RMF?+
A record of how an AI system was tested maps mainly to the MEASURE function and feeds MANAGE. Documented test sets, metrics and tools match MEASURE 2.1; results under deployment-like conditions match 2.3; production monitoring matches 2.4; validity, reliability and generalizability limits match 2.5; and evaluation of the testing process itself matches 2.13. MANAGE uses those results to decide whether to deploy and how to treat risks. GOVERN and MAP remain organizational work. The AI RMF is voluntary, and NIST is revising version 1.0 under the July 2025 AI Action Plan. Read the full answer
SOURCES
Go back to the source
National Institute of Standards and Technology
National Institute of Standards and Technology
NIST Trustworthy and Responsible AI Resource Center
The White House
CHANGE LOG
What changed, and when
Rebuilt from primary sources; facts checked on this date.
Related: NIST AI RMF vs ISO/IEC 42001 · NIST AI RMF vs DoW RAI S&IP · NIST AI RMF vs EO 14179 · NIST AI RMF vs SSDF SP 800-218 · NIST AI RMF vs OMB M-25-21/22 · NIST AI RMF for defense AI workflows · OMB M-25-21/22 · DoW RAI S&IP · EO 14179 · FIPS 140-3 · SHA-256 / FIPS 180-4 · NIST SP 800-53 Rev. 5