General information, not legal or compliance advice. This post explains the NIST AI risk management framework, which is voluntary and does not certify compliance with any law.
What the NIST AI risk management framework is
The AI Risk Management Framework 1.0 (NIST AI 100-1, January 2023) comes from the U.S. National Institute of Standards and Technology. NIST says it is “intended to be voluntary, rights-preserving, non-sector-specific, and use-case agnostic.” Organizations choose which parts to use based on their resources and capabilities. It was written for people who design, develop, deploy, evaluate or use AI systems. You can read it in full on NIST’s site (PDF).
Is there a newer version of the NIST AI risk management framework?
Official source: As of October 12, 2026, NIST’s AI RMF overview page still presents AI RMF 1.0 as the framework and says: “The AI RMF 1.0 is being revised as part of the White House AI Action Plan.” NIST’s FAQ says the July 23, 2025 AI Action Plan tasked it with revising the framework, calls AI RMF 1.0 a “living document,” and gives no deadline or new version name. NIST’s Playbook page says the Playbook “will be updated after the AI RMF is revised.”
What we could not confirm: Some third-party websites discuss an “AI RMF 2.0.” This post does not rely on them, and we found no official NIST release. Check NIST’s pages for the current status before you act on this.
The four core functions of the NIST AI risk management framework
NIST’s document organizes the core into four functions: Govern, Map, Measure and Manage.
Govern
NIST says “GOVERN is a cross-cutting function that is infused throughout AI risk management.” It covers the culture, policies and processes for anticipating and managing AI risk.
Map
“The MAP function establishes the context to frame risks related to an AI system.” Its results inform Measure and Manage.
Measure
Measure uses quantitative, qualitative or mixed methods “to analyze, assess, benchmark, and monitor AI risk and related impacts.”
Manage
“The MANAGE function entails allocating risk resources to mapped and measured risks” on a regular basis, including responses and recovery.
Profiles and the Playbook
NIST publishes companion resources. The Generative AI Profile (NIST AI 600-1), released July 26, 2024, is described as a cross-sectoral profile of and companion resource for AI RMF 1.0 for generative AI, “intended for voluntary use.” If you are new to the topic, our explainer What Is Generative AI? is a good starting point.
NIST also lists a profile for critical infrastructure. It is an ongoing project: NIST released a concept note on April 7, 2026, and no finished profile is confirmed here. The Playbook offers suggested actions for the framework’s outcomes. NIST says it is “neither a checklist nor set of steps to be followed in its entirety.”
Borrowing the ideas as a small team (author’s interpretation)
Author’s opinion, not NIST guidance. The framework is not written as a small-business toolkit, so this is our adaptation of its four ideas.
- Govern: name one person who is accountable for AI use. Write a one-page rule sheet: approved tools, data you never paste in, and who reviews client-facing output.
- Map: list where AI touches your work (drafts, customer replies, images, analysis) and who could be affected by a mistake.
- Measure: review a sample of outputs on a schedule and note the errors.
- Manage: act on the notes. Change prompts, add human review, limit a use, or stop using a tool for a task.
Hypothetical illustration: a freelance writer lists three AI uses: outlines, first drafts and image alt text. Because drafts and alt text reach clients, she adds a fact-check step and keeps confidential client files out of chat tools. For prompt habits that help, see How to Write AI Prompts.
Limits
The framework is voluntary. It does not certify legal compliance and does not give tool-specific instructions. This post is general information, not legal or compliance advice.
FAQs
Is the NIST AI RMF mandatory? NIST describes it as voluntary.
Has NIST released AI RMF 2.0? Not on the official NIST pages reviewed on October 12, 2026. NIST says AI RMF 1.0 is being revised.
Is there a profile for generative AI? Yes: NIST AI 600-1, released July 26, 2024, according to NIST’s publication page.
Does a small business need all four functions? NIST says organizations can choose which parts to apply. How much is sensible for a small team is a judgment call.
Conclusion
You do not need a compliance department to use the core idea: decide who is accountable, know where AI is used, check results, and act on what you find. Watch NIST’s pages for the revision.
Sources
- NIST AI 100-1, AI Risk Management Framework 1.0 (January 2023)
- NIST, AI Risk Management Framework overview (page modified August 13, 2026)
- NIST, AI RMF FAQs (updated August 13, 2026)
- NIST AIRC, AI RMF Playbook
- NIST AI 600-1, Generative AI Profile (July 26, 2024)
- NIST, concept note: AI RMF Profile on Trustworthy AI in Critical Infrastructure (April 7, 2026)
