Notes on the NIST AI RMF
What the framework actually gives you, and where it stops being useful.
I use the NIST AI Risk Management Framework at work, so I wanted to write down what it actually is and where it runs out of road.
The basics
NIST published AI RMF 1.0 in January 2023 as NIST AI 100-1. It's voluntary. Nobody is going to fine you for ignoring it. It exists because AI systems fail in ways normal software doesn't, and most risk programs had nothing written down for that.
The four functions
GOVERN is the policy and culture layer. Who is accountable, what the process is, how third-party AI gets handled. It's the only one that runs across the other three rather than in sequence with them.
MAP establishes context. What is this system for, who does it affect, what could go wrong. NIST's point here is that whoever builds one piece of an AI system usually can't see the rest, so impacts are hard to anticipate unless someone deliberately writes the context down.
MEASURE analyzes, benchmarks, and monitors the risks you mapped, using quantitative or qualitative methods. Test before deployment and keep testing while it runs.
MANAGE is acting on what you measured. Allocate resources to the risks that matter, respond, recover, communicate.
Govern is the one people skip and the one that makes the other three repeatable.
The seven characteristics
The framework defines trustworthy AI as valid and reliable, safe, secure and resilient, accountable and transparent, explainable and interpretable, privacy-enhanced, and fair with harmful bias managed.
Valid and reliable is the base. NIST is explicit that the rest don't count for much if the system doesn't work in the first place, which is worth remembering when a vendor leads with fairness metrics for a model that's wrong a third of the time.
What I actually use it for
Most of my AI work is data loss prevention around Microsoft Copilot in a bank. The framework does not tell you how to configure a DLP policy, and it isn't trying to.
What it gives you is a structure for the conversation that happens before the configuration. Who owns this risk. What data can the tool reach. What happens when it surfaces something it shouldn't. How would we find out. Those questions are the difference between deploying an AI tool and being able to explain the deployment to an examiner.
In practice I spend most of my time in GOVERN and MAP. MEASURE is the hard one. Working out whether an AI control is doing its job is a lot harder than checking whether a firewall rule is.
Where it's thin
It's deliberately general, which is the tradeoff for covering every kind of AI system. If you want to know what to configure on Monday morning, this document won't tell you.
Two things fill that gap. The AI RMF Playbook has suggested actions for each subcategory. And the Generative AI Profile, published July 2024 as NIST AI 600-1, is the more useful document if you're working with LLMs specifically, because it names concrete generative AI risks instead of abstract ones.
Takeaway
It's a vocabulary and a structure, not a checklist. If you need to show that your organization takes AI risk seriously, it gives you something real to point at. If you're trying to secure an actual LLM deployment, start with the Generative AI Profile and use the RMF to organize what you find.