Summary
- NIST published AI RMF 1.0 (NIST AI 100-1) on 26 Jan 2023. It is voluntary, free, sector-neutral and not tied to any one law.
- Its Core has four functions: GOVERN (culture, policy, accountability; applies across everything), MAP (understand context and risks), MEASURE (test and track risks) and MANAGE (prioritise and act). These split into 19 categories and 72 subcategories.
- It defines seven characteristics of trustworthy AI: valid and reliable; safe; secure and resilient; accountable and transparent; explainable and interpretable; privacy-enhanced; fair with harmful bias managed.
- The Generative AI Profile (NIST AI 600-1), released 26 Jul 2024, lists 12 risks that are unique to or made worse by generative AI and offers more than 200 suggested actions mapped to the same four functions. Unlike ISO 42001, it does name technical threats such as prompt injection and data poisoning.
- Status (as of 2026-10-19): AI RMF 1.0 is still the current version. NIST says it is being revised under the July 2025 AI Action Plan, but no revised draft was found on nist.gov. Related work in progress: the Cyber AI Profile (NIST IR 8596, preliminary draft Dec 2025) and a concept note for a critical infrastructure profile (Apr 2026).
Who it applies to
- Anyone designing, developing, deploying or using AI, in any sector and of any size. NIST calls these participants "AI actors".
- No legal reach outside or inside the US. Indian firms meet it through US customers, US-regulated parents or state laws that reference it.
- AI 600-1 targets organisations working with generative AI, whether they build foundation models or deploy them through APIs.
Key dates
- NIST issues Request for Information on the AI RMF
- Initial draft of the AI RMF released for comment
- Second draft of the AI RMF released for comment
- AI RMF 1.0 (NIST AI 100-1) released
- Trustworthy and Responsible AI Resource Center (AIRC) launched
- Generative AI Profile (NIST AI 600-1) released
- America's AI Action Plan directs NIST to revise the AI RMF
- Preliminary draft Cyber AI Profile (NIST IR 8596) released
- Comment period on the Cyber AI Profile preliminary draft closes
- Concept note for an AI RMF Profile on Trustworthy AI in Critical Infrastructure released
Full date record
| Date | Event |
|---|---|
| 2021-07-29 | Request for Information on the AI RMF |
| 2022-03-17 | Initial draft released |
| 2022-08-18 | Second draft released |
| 2023-01-26 | AI RMF 1.0 (NIST AI 100-1) released |
| 2023-03-30 | AI Resource Center (AIRC) launched |
| 2024-07-26 | Generative AI Profile (NIST AI 600-1) released, prepared under Executive Order 14110 |
| 2025-01-20 | Executive Order 14110 revoked; NIST continues to publish AI 600-1 |
| 2025-07-23 | America's AI Action Plan tells NIST to revise the AI RMF and remove references to misinformation, DEI and climate change |
| 2025-12-16 | Cyber AI Profile (NIST IR 8596) preliminary draft, built on CSF 2.0 |
| 2026-01-30 | Cyber AI Profile comment period closes |
| 2026-03-27 | NIST AI update to its advisory committee lists a "Revised NIST AI RMF" as upcoming work, plus SP 800-53 control overlays for AI |
| 2026-04-07 | Concept note: AI RMF Profile on Trustworthy AI in Critical Infrastructure |
| 2026-10-19 | No revised AI RMF draft found on nist.gov; AI RMF 1.0 still current |
Penalties and enforcement
- No penalties. NIST is a standards agency, not a regulator.
- Indirect force:
- Colorado AI Act (SB 24-205, now SB 26-189) gives developers and deployers an affirmative defence if they comply with a nationally or internationally recognised AI risk framework; the AI RMF and ISO 42001 are the usual examples.
- Texas TRAIGA also refers to recognised frameworks such as the AI RMF when weighing compliance.
- US bank supervisors expect model risk programmes (US Interagency MRM Guidance (SR 26-2, formerly SR 11-7)); many banks use the AI RMF to extend those programmes to AI.
- Contracts: US enterprise and public sector buyers increasingly ask suppliers to describe their AI RMF alignment.
What it means for an Indian company
- Exporters to the US (SaaS, IT services, GCCs): expect AI questionnaires written in AI RMF language (Govern, Map, Measure, Manage). Keep a one-page crosswalk from your controls to the 19 categories.
- GenAI product companies: AI 600-1 is the most practical public checklist for LLM risks (confabulation, data leakage, prompt injection, value chain). Use its 12 risks to structure red teaming (SC-AI-018 Robustness and adversarial testing (red teaming)) and security controls (SC-AI-029 AI-specific security controls (prompt injection, model abuse)).
- BFSI: RBI's RBI FREE-AI asks for risk tiers, model lifecycle governance, monitoring, red teaming and incident reporting; MAP 2, MEASURE 2 to 3 and MANAGE 2 to 4 cover the same ground and give a structure many global bank parents already use.
- Pair with ISO 42001: the AI RMF tells you what good risk work looks like; ISO/IEC 42001 gives you the certifiable management system to prove you do it. Doing both is common and they overlap heavily.
- Nothing to file, register or certify in India or the US.
Obligations
"Obligation" here means the outcome each AI RMF category expects; the framework itself is voluntary. Category numbers are from NIST AI 100-1, Tables 1 to 4.
Showing 19 of 19
| ID | Obligation | Reference | Applies to | Controls |
|---|---|---|---|---|
| NISTRMF-01 | Have policies, processes and practices for AI risk that are in place, transparent and actually used: track legal requirements, set risk tolerance, keep an AI inventory, and retire systems safely | GOVERN 1 (1.1 to 1.7) | Both | |
| NISTRMF-02 | Set up accountability so the right teams and people are empowered, responsible and trained for AI risk, with executive leadership owning the decisions | GOVERN 2 (2.1 to 2.3) | Both | |
| NISTRMF-03 | Use diverse, multidisciplinary teams in AI risk decisions and define roles for human oversight of AI | GOVERN 3 (3.1, 3.2) | Both | |
| NISTRMF-04 | Build a culture that thinks critically about AI risk: document potential impacts and support testing, incident spotting and information sharing | GOVERN 4 (4.1 to 4.3) | Both | |
| NISTRMF-05 | Engage people outside the AI team, including affected users, and feed their input back into design and deployment | GOVERN 5 (5.1, 5.2) | Both | |
| NISTRMF-06 | Cover risks from third-party software, data and other supply chain links, including contingency plans for high-risk third-party failures | GOVERN 6 (6.1, 6.2) | Both | |
| NISTRMF-07 | Establish and understand the context: intended purpose, users, laws, business value, risk tolerance and system requirements | MAP 1 (1.1 to 1.6) | Both | |
| NISTRMF-08 | Categorise the AI system: define its tasks and methods, its knowledge limits and how humans will use its outputs | MAP 2 (2.1 to 2.3) | Both | |
| NISTRMF-09 | Understand capabilities, intended use, goals, benefits and costs against benchmarks, and define human oversight processes | MAP 3 (3.1 to 3.5) | Both | |
| NISTRMF-10 | Map risks and benefits for every component, including third-party software and data | MAP 4 (4.1, 4.2) | Both | |
| NISTRMF-11 | Describe likely impacts on individuals, groups, communities, organisations and society, with their likelihood and size | MAP 5 (5.1, 5.2) | Both | |
| NISTRMF-12 | Pick and apply suitable methods and metrics for measuring AI risks, with regular review and independent assessors where needed | MEASURE 1 (1.1 to 1.3) | Both | |
| NISTRMF-13 | Evaluate the system for the trustworthy characteristics: validity, safety, security and resilience, transparency, explainability, privacy, fairness and environmental impact | MEASURE 2 (2.1 to 2.13) | Both | |
| NISTRMF-14 | Track identified and emerging AI risks over time, including through feedback from end users and affected communities | MEASURE 3 (3.1 to 3.3) | Deployer | |
| NISTRMF-15 | Gather and assess feedback on whether your measurements actually work in the real deployment context | MEASURE 4 (4.1 to 4.3) | Both | |
| NISTRMF-16 | Prioritise and respond to risks found in MAP and MEASURE, including a go or no-go decision on deployment and documented treatment of residual risk | MANAGE 1 (1.1 to 1.4) | Both | |
| NISTRMF-17 | Plan strategies that maximise benefit and minimise harm, including ways to supersede, disengage or deactivate a system that misbehaves | MANAGE 2 (2.1 to 2.4) | Deployer | |
| NISTRMF-18 | Manage risks and benefits from third-party entities, including monitoring pre-trained models you use | MANAGE 3 (3.1, 3.2) | Both | |
| NISTRMF-19 | Document and regularly monitor risk treatments, response and recovery, post-deployment monitoring, change management and incident communication | MANAGE 4 (4.1 to 4.3) | Both |
Generative AI risks (NIST AI 600-1)
The profile names 12 risks. It suggests actions against the 19 categories above rather than adding new categories. Its working group focused on four themes: governance, content provenance, pre-deployment testing and incident disclosure.
| # | GAI risk | Plain meaning | Main controls |
|---|---|---|---|
| 1 | CBRN information or capabilities | Easier access to dangerous chemical, biological, radiological or nuclear know-how | SC-AI-034 Unlawful and prohibited content safeguards |
| 2 | Confabulation | Confident but wrong output (often called hallucination) | SC-AI-015 Pre-deployment testing and validation, SC-AI-020 Performance monitoring and drift detection |
| 3 | Dangerous, violent or hateful content | Easier production of violent, inciting or hateful material | SC-AI-034 Unlawful and prohibited content safeguards |
| 4 | Data privacy | Leaks, misuse or re-identification of personal data | SC-AI-011 Lawful basis and consent for personal data used in AI, SC-AI-012 Data minimisation and retention for AI |
| 5 | Environmental impacts | Heavy energy and resource use in training and running models | SC-AI-040 Board reporting and AI risk metrics |
| 6 | Harmful bias or homogenization | Amplified bias and loss of diversity in outputs | SC-AI-013 Data bias and representativeness checks, SC-AI-017 Fairness and discrimination testing of outputs |
| 7 | Human-AI configuration | Over-reliance, misplaced trust or poor hand-offs between people and AI | SC-AI-026 Human oversight and override, SC-AI-022 Disclose AI interaction to users |
| 8 | Information integrity | Easier creation and spread of false or misleading content at scale | SC-AI-023 Label AI-generated and synthetic content, SC-AI-036 Deepfake and impersonation safeguards |
| 9 | Information security | AI helps attackers, and the model itself can be attacked (prompt injection, data poisoning) | SC-AI-029 AI-specific security controls (prompt injection, model abuse), SC-AI-018 Robustness and adversarial testing (red teaming) |
| 10 | Intellectual property | Generating or copying protected content, or exposing trade secrets | SC-AI-010 Training and input data governance (provenance, quality) |
| 11 | Obscene, degrading or abusive content | Easier creation of abusive imagery, including non-consensual intimate content | SC-AI-034 Unlawful and prohibited content safeguards, SC-AI-036 Deepfake and impersonation safeguards |
| 12 | Value chain and component integration | Untraceable third-party models, data and components in the system | SC-AI-007 Third-party and vendor AI due diligence |
Controls that do the most work here
- SC-AI-020 Performance monitoring and drift detection4 obligations
- SC-AI-005 AI risk assessment3 obligations
- SC-AI-006 AI impact assessment (people and society)3 obligations
- SC-AI-007 Third-party and vendor AI due diligence3 obligations
- SC-AI-026 Human oversight and override3 obligations
- SC-AI-002 AI roles, accountability and oversight committee2 obligations
Evidence an auditor will ask for
There is no formal AI RMF audit, but customers, internal audit and US-facing regulators typically ask for:
- AI policy and risk tolerance statement (GOVERN 1).
- AI inventory with owners, risk tier and lifecycle status (GOVERN 1.6).
- RACI for AI risk and training records (GOVERN 2).
- Supplier AI due diligence files and contingency plans (GOVERN 6, MANAGE 3).
- Use-case context documents: purpose, users, legal constraints, benefits and costs (MAP 1, MAP 3).
- Impact assessments for individuals and groups (MAP 5).
- Test plans and results for accuracy, robustness, security, privacy and fairness (MEASURE 2), including red-team reports for GenAI.
- Monitoring dashboards and user feedback logs (MEASURE 3, MANAGE 4).
- Go or no-go records and residual risk acceptance (MANAGE 1).
- Kill switch or rollback procedure and evidence it was tested (MANAGE 2.4).
- AI incident register and communications (MANAGE 4.3).
- An AI RMF Current Profile and Target Profile, if you use NIST's profile method to show gaps.
Common mistakes
- Calling it "in force" or claiming "AI RMF certification". It is voluntary and there is no certificate.
- Treating the four functions as a sequence. GOVERN runs across the others; MAP, MEASURE and MANAGE repeat through the lifecycle.
- Using the 72 subcategories as a pass or fail checklist. NIST describes them as outcomes to tailor, not mandatory controls.
- Ignoring AI 600-1 for GenAI use cases and applying only the generic RMF.
- Citing the 2024 GenAI profile as an Executive Order requirement. EO 14110 was revoked in January 2025; the profile stands as voluntary guidance.
- Assuming the revision will replace everything. Until a new version is published, AI RMF 1.0 category numbers remain the reference.
- Mixing up the Cyber AI Profile (built on the Cybersecurity Framework 2.0, still a draft) with the AI RMF profiles.
Glossary
- AI RMF Core: the four functions, 19 categories and 72 subcategories that describe AI risk outcomes.
- Function: one of the four top-level groups: GOVERN, MAP, MEASURE, MANAGE.
- Category / subcategory: finer outcomes under each function, numbered like "MAP 2" and "MAP 2.1".
- AI actor: anyone who plays a part in an AI system's lifecycle, from data supplier to end user.
- Profile: a tailored version of the framework for a sector, technology or use case; a Current Profile shows where you are and a Target Profile where you want to be.
- TEVV: test, evaluation, verification and validation.
- Confabulation: NIST's term for confident but false generative AI output.
- Value chain: the outside models, datasets and tools a GenAI system is built from.
- AIRC: NIST's online Trustworthy and Responsible AI Resource Center, which hosts the Playbook and crosswalks.
- Cyber AI Profile: draft NIST IR 8596, a Cybersecurity Framework 2.0 profile for securing AI and using AI in cyber defence.
Key takeaways
- Voluntary US framework: AI RMF 1.0 (26 Jan 2023) plus the GenAI Profile AI 600-1 (26 Jul 2024); no penalties and no certification.
- 19 categories across GOVERN (6), MAP (5), MEASURE (4) and MANAGE (4) give 19 obligation rows; AI 600-1 adds 12 GenAI risks.
- It gains teeth indirectly through Colorado and Texas laws, US bank model risk expectations and customer contracts.
- A revision is underway under the 2025 AI Action Plan, but no draft was published by 2026-10-19; the Cyber AI Profile and a critical infrastructure profile are separate work streams.
- The dates and the 19 count match; "In Force" and "Standard" overstate it, since both are voluntary NIST frameworks.
Official sources
- NIST AI Risk Management Framework page, accessed 2026-10-19
- NIST AI 100-1, AI RMF 1.0 (PDF), accessed 2026-10-19
- NIST AI 600-1, Generative AI Profile (PDF), accessed 2026-10-19
- AIRC, AI RMF resources and Playbook, accessed 2026-10-19
- NIST IR 8596 (Initial Preliminary Draft), Cyber AI Profile, accessed 2026-10-19
- Concept Note: AI RMF Profile on Trustworthy AI in Critical Infrastructure, accessed 2026-10-19
- NIST Artificial Intelligence Update, 27 Mar 2026 (PDF), accessed 2026-10-19
- America's AI Action Plan, July 2025 (PDF), accessed 2026-10-19
This is general information, not legal advice. Last verified 19 Oct 2026 against the official source. Laws change; confirm the current position with qualified counsel before acting.