NIST releases AI Risk Management Framework 1.0

The National Institute of Standards and Technology (NIST) released version 1.0 of its Artificial Intelligence Risk Management Framework on 26 January 2023. The AI RMF is voluntary guidance meant to help any organization that designs, builds, deploys or uses AI systems manage the risks those systems create.

What it is

Congress directed NIST to produce the framework, and the agency wrote it jointly with industry and government stakeholders. NIST reported that comments on its drafts came from more than 240 different organizations.

The document has two parts. Part one explains how to frame AI risk and lists the traits of trustworthy AI; part two, the core, defines four functions (govern, map, measure and manage) that apply at any stage of an AI system's life cycle.

The framework is not frozen. NIST's program page states that AI RMF 1.0 is under revision as part of the White House AI Action Plan, and on 7 April 2026 NIST issued a concept note for a companion profile aimed at critical infrastructure operators.

What it requires

Nothing in the framework is mandatory. NIST presents it as a voluntary tool for building trustworthiness into how AI products, services and systems are designed, developed, used and evaluated.

What it offers instead of rules is a repeatable method. NIST described the process as flexible, structured and measurable, so organizations of different sizes can adapt it to their own risk tolerance.

What security leaders should do

• Use the four functions as the spine of an AI risk register: name an owner under govern, record system context under map, set test metrics under measure and log treatment decisions under manage.
• Map existing security controls to the framework before writing new ones, so AI risk work extends the current program instead of duplicating it.
• Diary a gap review for when the revised version tied to the AI Action Plan appears.
• If you operate or supply critical infrastructure, follow the concept note closely, because that profile is written for your sector.