NIST AI Risk Management Framework
The NIST AI Risk Management Framework is voluntary for all organizations and organized around four functions: Govern, Map, Measure, and Manage. No law or certification requires adopting it, though several US state AI laws cite it as a compliance benchmark. Organizations use it to structure AI risk programs.
Updated 2026-11-01 · 463 tracked updates
The NIST AI Risk Management Framework provides a voluntary, flexible framework for managing risks associated with AI systems throughout their lifecycle. It is structured around four core functions: Govern, Map, Measure, and Manage.
Who Needs to Comply?
Any organization worldwide that develops or deploys AI systems — adoption is voluntary for every organization, public or private, with no certification requirement. Several US state AI laws cite it as a benchmark, and international standards bodies reference it.
Key Dates & Timeline
Version 1.0 published January 2023. NIST AI RMF Playbook and Generative AI Profile released throughout 2023-2024. Crosswalk with EU AI Act published 2024.
Upcoming Milestones
Article 5 prohibitions on realistic intimate synthetic content and CSAM-related AI practices apply
Digital Omnibus on AI amends the EU AI ActProviders of AI systems generating synthetic audio, image, video or text must comply with Article 50(2) marking steps if placed on market before 2 Aug 2026
Digital Omnibus on AI amends the EU AI ActOPC 2026-27 service-standard and enforcement indicator targets due
Office of the Privacy Commissioner of Canada 2026-27 Departmental PlanOPC 2025-26 privacy-rights awareness targets due
Office of the Privacy Commissioner of Canada 2026-27 Departmental PlanCommission deadline to publish AI Act guidance on complementarity and proportionality for Annex I-sector AI systems
Digital Omnibus on AI amends the EU AI ActLatest NIST AI RMF Updates
Clear 2022 comprehensive governance of algorithms special action
The Cyberspace Administration of China launched a special action in April 2022 to push implementation of the algorithm recommendation provisions through self-inspection, inspections, filing, and rectification.
AI Guidelines for Business Ver. 1.0
METI and MIC compiled AI Guidelines for Business Ver. 1.0 by integrating and updating prior AI guidelines for a broad range of AI business operators.
OECD AI Law Radar tool
The OECDs AI Law Radar is a daily refreshed tracker of AI laws, regulations, and obligations across jurisdictions for compliance and governance teams.
AI Act Guidelines Implementation Update
The Commission says it is preparing additional AI Act guidelines, including on high-risk systems, the AI value chain, substantial modification, post-market monitoring and interplay with other EU laws.
AI Act Fact Page
The fact page presents the AI Act’s risk-based structure, GPAI transparency and systemic-risk obligations, and the AI governance architecture.
OPC guidance on AI and your business
The OPC says organizations using or developing generative AI should label AI-generated content or decisions, establish legal authority, be transparent, explain tools, limit data sharing, and embed privacy by design.
FCA review of the long-term impact of AI on retail financial services
The FCA is reviewing how AI may reshape retail financial services by 2030 and beyond and is seeking views on future technology, market, consumer, and regulatory implications rather than proposing new rules now.
EU AI Act: draft implementing act for AI regulatory sandboxes
The Commission opened feedback on a draft implementing act that would set common rules for establishing and operating AI regulatory sandboxes under the AI Act.
EU AI Act: draft guidelines on classification of high-risk AI systems
The Commission opened a consultation on draft guidelines to help providers, deployers, and market surveillance authorities assess whether an AI system is high-risk.
AP fine for Uber automated driver blocking
The AP fined Uber nearly 825 million euros for fully automated driver deactivations without human review and for insufficient transparency about automated decision-making.
Jurisdiction Coverage
Related Frameworks
Key Topics
Frequently Asked Questions
Is the NIST AI RMF mandatory and how is it used?
The NIST AI Risk Management Framework is voluntary for all organizations and organized around four functions: Govern, Map, Measure, and Manage. No law or certification requires adopting it, though several US state AI laws cite it as a compliance benchmark. Organizations use it to structure AI risk programs.
What is the NIST AI RMF?
The NIST AI Risk Management Framework is a voluntary framework developed by the US National Institute of Standards and Technology for managing risks in AI systems. It provides a structured approach organized around four functions: Govern, Map, Measure, and Manage.
Is the NIST AI RMF mandatory?
No — the NIST AI RMF is voluntary for all organizations, public and private; no law or certification requires adopting it. Several US state AI laws cite it as a compliance benchmark, and organizations worldwide use it to structure AI risk programs.
How does NIST AI RMF compare to ISO 42001?
NIST AI RMF is a risk management framework focused on AI-specific risks, while ISO 42001 is a management system standard. NIST AI RMF is more prescriptive about risk categories and measurement, while ISO 42001 is more focused on organizational processes. They are complementary — many organizations adopt both.
Keep exploring
This hub tracks published actions referencing the NIST AI RMF; the framework itself is voluntary, and this page is not legal or accreditation advice.