United States (federal) · voluntary framework
NIST AI RMF · GOVERN: what it asks, and the records to keep
GOVERN is the cross-cutting function of the AI RMF, with 6 categories and 19 subcategories that set the policies, accountability, culture, stakeholder engagement and third-party controls under which AI risk is mapped, measured and managed. NIST describes it as informing and infused throughout the other three functions.
01 / What it asks
What NIST AI RMF · GOVERN asks
Organizations adopting the AI RMF; GOVERN is owned by leadership and applies across all AI systems and lifecycle stages.
- 01Understand and document legal and regulatory requirements involving AI (GOVERN 1.1).
- 02Keep an inventory of AI systems and processes for safely decommissioning them (GOVERN 1.6, 1.7).
- 03Document roles, responsibilities and lines of communication; executive leadership owns AI risk decisions (GOVERN 2.1, 2.3).
- 04Have teams document and communicate risks and impacts of the AI they build or use (GOVERN 4.2).
- 05Collect and integrate feedback from people outside the development team about AI impacts (GOVERN 5.1, 5.2).
- 06Set policies for AI risks from third-party software, data and supply chain, including IP infringement (GOVERN 6.1, 6.2).
02 / AI work
Where it touches AI work
AI-specific. It defines the organizational program that oversees AI systems rather than testing any one model.
03 / Dates
The dates that matter
NIST releases AI RMF 1.0 (NIST AI 100-1)
Generative AI Profile (NIST AI 600-1) released
AI Action Plan directs NIST to revise the AI RMF
Concept note for critical infrastructure AI RMF profile
04 / Enforcement
Who enforces it
None; voluntary.
05 / Records
Records an organisation keeps
What an auditor or an inquiry usually asks to see. Your obligations depend on your role and your facts.
- 01AI risk management policy and documented risk tolerance
- 02AI system inventory with owners
- 03RACI or role charter for AI risk decisions
- 04Third-party AI supplier risk policy and contingency plans
Optional evidence · where Planisphere fits
Keep a record anyone can check
When your team meets a duty, Planisphere can seal the event it reports as a receipt.
A disclosure shown, a review signed, a model change approved: the event your system reports.
The event becomes a sealed receipt, dated and attributed to whoever is signed in.
Paste the receipt into Verify. No account or key.
A record supports your compliance evidence process. It is not a legal finding or a certification. Systems that call Planisphere's gate API can also hold or refuse an action before it runs.
QUESTIONS
The questions that come next
What does a NIST AI RMF GOVERN program look like for a federal agency?+
GOVERN is the cross-cutting AI RMF function that sets policies, accountability and risk culture; it has 6 categories and 19 subcategories. For an agency, that means documented legal requirements, an inventory of AI systems, named roles with leadership owning risk decisions, teams that document impacts, channels for outside feedback, and policies for third-party and supply-chain risk. The RMF is voluntary; binding duties, such as designating a Chief AI Officer and publishing a use-case inventory, come from OMB memo M-25-21. NIST is revising the RMF, and GOVERN 3's diversity, equity and inclusion language is the kind the 2025 AI Action Plan told NIST to remove. Read the full answer
SOURCES
Go back to the source
National Institute of Standards and Technology
National Institute of Standards and Technology
NIST Trustworthy and Responsible AI Resource Center
The White House
CHANGE LOG
What changed, and when
Rebuilt from primary sources; facts checked on this date.
Related: NIST AI RMF · GOVERN for defense AI workflows · NIST AI RMF · OMB M-25-21/22 · DoW RAI S&IP · EO 14179 · FIPS 140-3 · SHA-256 / FIPS 180-4