Explainer
The NIST AI Risk Management Framework is the most widely used voluntary guide to managing AI risk. Here is how it is structured, what the generative AI profile adds, and how it fits with ISO 42001 and the EU AI Act.
By Christopher Fagan, Managing Partner, PEF Consulting Partners
Published by the US National Institute of Standards and Technology on 26 January 2023, the AI Risk Management Framework, AI RMF 1.0, is voluntary guidance for managing the risks of designing, developing, deploying and using AI. It is not law in the UK or the US, but many organisations use it because it is practical, free and widely recognised.
| Function | What it covers |
|---|---|
| Govern | A culture of risk management: policies, accountability, roles and oversight. It runs across the other three. |
| Map | Context: what the system is for, who it affects and what could go wrong |
| Measure | Assessing, analysing and tracking the risks identified |
| Manage | Prioritising and acting on the risks that have been mapped and measured, and responding to incidents |
In July 2024 NIST published the Generative AI Profile, NIST AI 600-1, which applies the framework to generative AI. It describes twelve risks that are unique to or made worse by generative AI, such as confabulation, information integrity, data privacy and intellectual property, and suggests just over 200 actions to manage them.
The AI RMF Playbook gives suggested actions for each outcome, and NIST is clear it is neither a checklist nor a set of steps. NIST has said the framework is being revised following the US government’s 2025 AI Action Plan, and it has been developing further profiles, including one for critical infrastructure, so check for the latest version before you build on it.
| Framework | Nature | Use it for |
|---|---|---|
| NIST AI RMF | Voluntary guidance | Structuring how you identify and manage AI risks |
| ISO/IEC 42001 | A certifiable management system standard | Showing customers a governed AI management system |
| EU AI Act | Law, for organisations in scope | Meeting legal obligations based on the risk category of each system |
Aligning with the NIST framework is good evidence of responsible practice, but on its own it does not prove compliance with the EU AI Act. NIST publishes a crosswalk to ISO/IEC 42001, which helps if you are aiming for certification.
Related reading: a practical AI governance framework, ISO 42001 explained, the EU AI Act for UK companies, the AI policy template.
No. It is voluntary guidance in both the US and the UK, although some customers and regulators refer to it as good practice.
Govern, map, measure and manage. Govern sets the culture and accountability; map, measure and manage identify, assess and treat the risks of each AI system.
The Generative AI Profile, published in July 2024, which applies the AI RMF to generative AI and sets out twelve specific risks and over 200 suggested actions.
Many use both: the NIST framework to structure risk management, and ISO/IEC 42001 if they want a certifiable management system to show customers.
If you need an AI governance approach that is proportionate and auditable, the NIST framework is a good backbone. We can help you apply it to your own systems.