AI Risk Management Framework (AI RMF 1.0)
United States · Framework · National Institute of Standards and Technology (NIST), Information Technology Laboratory
High impact. A reviewer confirms each change before it is listed here.
Our summary
NIST developed this voluntary framework to help manage risks associated with artificial intelligence systems and improve their trustworthiness across design, development, use, and evaluation. The framework was created through a consensus-driven process involving public and private sectors and is intended to support and align with AI risk management efforts by organizations. It has been supplemented with related resources including a playbook, roadmap, and profiles for specific AI applications like generative AI and critical infrastructure.
Written by the Index in our own words. It is not legal advice; the official text is the authority.
Inside this policy
Every section of this policy in order. Our notes summarise each one in plain language and do not quote the official text, which is the authority.
Drafted by the Index An automated summary of the official text, not yet reviewed by a person.Reviewed Checked by a person against the official text.
20 sections
Jump to a chapter
1 Framing Risk
2 sections
AI risk management aims to reduce potential negative impacts on civil liberties and rights while maximizing positive impacts, leading to more trustworthy AI systems through effective documentation and management of risks.
1.1 Understanding and Addressing Risks, Impacts, and Harms
Risk in this context means the combination of an event's probability and the magnitude of its consequences. This framework addresses negative and positive impacts on individuals, groups, communities, organizations, society, environment, and the planet, with risk management helping AI developers and users understand limitations and improve system trustworthiness.
1.2 Challenges for AI Risk Management
The section describes key challenges in managing AI risks: risk measurement, risk tolerance, risk prioritization, and organizational integration and management of risk, which must be considered when pursuing AI trustworthiness.
1.2.1 Risk Measurement
1.2.2 Risk Tolerance
1.2.3 Risk Prioritization
1.2.4 Organizational Integration and Management of Risk
2 Audience
The framework targets diverse AI actors across the lifecycle and dimensions: those designing, developing, deploying, and evaluating AI systems, plus a secondary audience including standards organizations, researchers, advocacy groups, and potentially impacted communities who provide context, norms, boundaries, and discussion of societal value tradeoffs. Successful risk management requires collective responsibility and diverse perspectives among AI actors across lifecycle stages, enabling teams to surface implicit assumptions, problems, and emergent risks through open idea-sharing.
3 AI Risks and Trustworthiness
7 sections
Trustworthy AI systems must combine multiple characteristics: accuracy and dependability, protection against harm, security against attacks, accountability alongside transparency, explainability, privacy safeguards, and fairness with bias mitigation. Balancing these attributes based on context helps reduce negative risks. All reflect organizational behaviour, data selection, model choices, and human interactions.
3.1 Valid and Reliable
AI systems must be validated for their intended use and reliable in performance without failure under expected conditions. Accuracy and robustness, measured with representative test sets and disaggregated by data segments, support validity and trustworthiness, with ongoing monitoring and human intervention as needed to minimize potential harms.
3.2 Safe
AI systems should not endanger human life, health, property, or environment under defined conditions, through responsible design and deployment, clear documentation of risks, and approaches including rigorous testing, monitoring, and ability to shut down or modify systems deviating from intended functionality.
3.3 Secure and Resilient
AI systems are resilient when they withstand unexpected changes and maintain or safely degrade function during disruption. They are secure when confidentiality, integrity, and availability are maintained through mechanisms preventing unauthorized access. Security encompasses prevention, defence, response, and recovery from attacks; resilience is robustness extending to unexpected or adversarial use.
3.4 Accountable and Transparent
Transparency means making information about AI systems and outputs available to users and actors, tailored to their role and AI lifecycle stage. Accountability requires transparency and depends on understanding design decisions, training data, model structure, deployment choices and human-AI interaction. When consequences are severe, developers and deployers should proportionally adjust transparency and accountability practices.
3.5 Explainable and Interpretable
Explainability represents mechanisms underlying AI system operation; interpretability means the significance of outputs for their intended functional purposes. Together they help operators and users understand system functionality and trustworthiness. Explainability risk can be managed through descriptions tailored to user role and skill level; interpretability risk through communicating why particular predictions were made.
3.6 Privacy-Enhanced
Privacy protects human autonomy, identity and dignity through norms safeguarding freedom from intrusion and controlling disclosure or use of personal facets. Privacy-enhancing technologies and data minimization methods like de-identification and aggregation can support privacy-enhanced AI design. Privacy values like anonymity and confidentiality should guide AI design, development and deployment, though privacy-enhancing techniques can sometimes reduce accuracy in certain domains.
3.7 Fair, with Harmful Bias Managed
Fairness addresses equality and equity by managing harmful bias and discrimination, though definitions vary across cultures and applications. NIST identifies three bias categories to manage: systemic bias in datasets and organizational practices; computational and statistical bias from non-representative samples; and human-cognitive bias in how people perceive information and think about AI purposes. AI systems can increase the speed and scale of biases, perpetuating harms to individuals, groups and society.
4 Effectiveness of the AI RMF
Organizations should periodically evaluate whether the framework improved their ability to manage AI risks in policies, processes, practices and measurements. NIST will develop metrics, methodologies and goals for evaluating framework effectiveness. Framework users benefit from enhanced risk governance processes, clearer understanding of tradeoffs among trustworthiness characteristics, explicit system commissioning decisions, strengthened organizational accountability, better risk information sharing, and augmented capacity for testing, evaluation and verification of AI systems.
5 AI RMF Core
1 section
The Core comprises four functions: GOVERN, MAP, MEASURE, and MANAGE, structured into categories and subcategories with specific actions and outcomes. Governance cuts across all other functions. Management must be continuous throughout the AI lifecycle, drawing on diverse and interdisciplinary perspectives including external stakeholders.
5.1 Govern
GOVERN establishes organizational risk culture, policies, and lifecycle processes for anticipating and managing AI system risks through three integrated functions. GOVERN requires organizations to establish policies and accountability structures for mapping, measuring, and managing risks (including third-party software, data and supply chain issues), foster a safety-first culture, and ensure diverse teams make decisions; MAP requires establishing contextual knowledge about intended purposes, deployment settings, task definitions, knowledge limits, and system scope, mapping all risks including third-party components and characterizing impacts through stakeholder engagement; and MEASURE requires objective test and evaluation processes assessing safety, security, resilience, transparency, accountability, explainability, privacy, fairness, and environmental impact. Organizations must prioritize and respond to identified risks, document risk responses and residual risks, and maintain mechanisms to monitor and supersede systems with inconsistent performance.
6 Subcategories
Post-deployment monitoring must include user feedback, appeal and override mechanisms, incident response, and change management, with regular engagement with interested parties and communication of incidents and errors to affected communities. AI actors across design, development and deployment phases collaborate with data scientists, domain experts, governance experts, community members, end users and affected individuals; TEVV tasks validate design at each lifecycle phase and Human Factors tasks integrate human-centered design and interdisciplinary expertise. AI systems present distinct challenges including scale complexity, statistical uncertainty, emergent properties, privacy and data aggregation risks, model drift, opacity, weak testing standards, environmental costs and unpredictable side effects; existing security and privacy frameworks do not comprehensively address harmful bias, generative AI risks, machine learning attacks, complex attack surfaces or third-party AI technologies.
Controls
What this policy requires, forbids, grants or penalises, one control at a time and in our own words. Each control links to the official text, which is the authority. This is not legal advice.
Drafted by the Index Drafted automatically from the official text, not yet reviewed by a person.Reviewed Checked by a person against the official text.
Themes covered 0 of 35
Choose a theme to see only its controls. About the themes
Risk and scope 0 of 4
- Risk classification, not covered
- Prohibited practices, not covered
- Risk management system, not covered
- Impact assessment, not covered
Data and privacy 0 of 4
- Data governance and quality, not covered
- Data subject rights and consent, not covered
- Cross-border data transfer, not covered
- Copyright and training data, not covered
Transparency and records 0 of 4
- Transparency and disclosure to users, not covered
- Labelling of synthetic content, not covered
- Technical documentation, not covered
- Record keeping and logging, not covered
Technical safeguards 0 of 4
- Human oversight, not covered
- Accuracy, robustness and cybersecurity, not covered
- Bias and non-discrimination, not covered
- Testing and evaluation, not covered
Assurance and lifecycle 0 of 4
- Conformity assessment and certification, not covered
- Registration and notification, not covered
- Incident and breach reporting, not covered
- Post-market monitoring and corrective action, not covered
Rights and protected groups 0 of 4
- Automated decision-making rights, not covered
- Children and vulnerable groups, not covered
- Biometric identification and surveillance, not covered
- Whistleblowing, complaints and redress, not covered
Roles and organisation 0 of 6
- Supply chain and provider-deployer duties, not covered
- General purpose and foundation models, not covered
- Accountability and governance roles, not covered
- Training and AI literacy, not covered
- Public sector use and procurement, not covered
- Innovation support and sandboxes, not covered
Enforcement and sectors 0 of 5
- Enforcement, penalties and regulators, not covered
- Sector rules: health, not covered
- Sector rules: finance and insurance, not covered
- Sector rules: employment, not covered
- Sector rules: education, not covered
The full list of controls could not be loaded, so only the first 0 are shown.
Change history
No changes recorded since we began monitoring this policy.