NIST AI RMF
A voluntary US risk-management framework for AI from the National Institute of Standards and Technology — not certifiable.
The NIST AI Risk Management Framework (AI RMF 1.0, January 2023) is a voluntary US framework organised around four functions: Govern, Map, Measure, Manage. It is a reference model, not a certification — there is no AI RMF certificate. Enterprise buyers in the US often cite it in AI vendor questionnaires ("describe how you align with NIST AI RMF"), and it maps cleanly to ISO 42001 clauses. The companion Generative AI Profile, released July 2024, adds GenAI-specific risks.
Examples
- →An AI SaaS vendor publishes an NIST AI RMF alignment statement on its trust centre, mapping each of the four functions to specific internal controls.
- →A procurement questionnaire asks: "Which AI RMF function applies to your drift monitoring?" — answer: Manage (MG-1.3).
Common mistakes
- ✗Calling AI RMF a "certification." It is a framework, not a conformity standard — no body certifies against it.
- ✗Treating the four functions as sequential. Govern is continuous; Map / Measure / Manage are iterative.
How LowerPlane handles it
LowerPlane's AIMS evidence maps once and reports against ISO 42001 and NIST AI RMF alignment statements from the same controls.
Authoritative sources
Related terms
- ISO/IEC 42001 — International standard for an Artificial Intelligence Management System (AIMS).
- AIMS (AI Management System) — The policy, process and control stack that ISO 42001 certifies — the AI-governance analogue of an ISMS.
- AI Impact Assessment (AIIA) — A structured review of an AI system's potential harms, benefits and affected parties — required by ISO 42001 Annex A.