NIST releases the second draft of its AI Risk Management Framework for comment

The second draft of the NIST AI Risk Management Framework (AI RMF) was the penultimate public version of the voluntary US framework for managing AI risk, and NIST released it for comment on 18 August 2022. It followed an initial draft published on 17 March 2022 and came with a draft of the companion AI RMF Playbook.

What it is

NIST described the AI RMF as intended for voluntary use in addressing risks in the design, development, use and evaluation of AI products, services and systems. The second draft reflected discussions at NIST's second AI RMF workshop and feedback on the March draft. Comments were due by 29 September 2022, a third workshop was set for 18 and 19 October 2022, and NIST said it planned to publish AI RMF 1.0 in January 2023.

What it requires

The draft imposed no obligations; its purpose was to gather input. The draft Playbook offered suggested actions, references and supplementary guidance for two of the four proposed functions, Govern and Map, with material for Measure and Manage to follow later. NIST released the final framework on 26 January 2023 and, according to its framework page, is revising AI RMF 1.0 as part of the White House AI Action Plan.

What security leaders should do

This milestone matters mainly as history: it shows the Govern, Map, Measure and Manage structure was settled before 1.0 shipped, which is why programmes built on the drafts carried over cleanly. With NIST revising 1.0, keep your AI risk programme mapped to the four functions rather than to specific subcategory numbers, and watch the NIST framework page for the revision so you can plan a mapping update instead of a rebuild.