NIST AI RMF Update 2026: What Changed and What Your Business Must Do Now

Updated October 2026. This article replaces our earlier NIST AI RMF guide for SMEs.

Last year, you heard one clear message: align with NIST and you get a legal shield in Colorado. That advice is now out of date. The NIST AI RMF update cycle sped up in 2026, and the laws that pointed to it changed too.

NIST now states that the AI RMF 1.0 is being revised, and it released a concept note for a critical infrastructure profile on April 7, 2026. Colorado went further. Its legislature passed SB 26-189, which repealed and replaced the original AI Act framework. nistpandectes

If your AI governance plan still runs on 2025 assumptions, you are working from an old map.

Below, you'll see what changed, what stayed the same, and the five moves to make before January 2027.

Why Your 2025 NIST Playbook Is Already Out of Date

Most SMEs built their AI governance around one date: June 30, 2026. You wrote policies, assigned owners, and maybe paid for gap assessments. Then the target moved.

The new Colorado law takes effect January 1, 2027, not the June 30, 2026 date some sources still cite. Its focus shifted too. That means some of your controls may now cover the wrong risks. petronellatech

Meanwhile, the questions from clients got sharper. Enterprise buyers now ask how you secure AI tools, not just whether you have a policy. A one-page AI policy from 2025 rarely answers that.

You are not behind because you were careless. You are behind because the ground moved. The good news: your core NIST work still counts. You just need to update the layers around it.

Is There a NIST AI RMF 2.0? The Honest Answer

No. Not yet. The framework remains at version 1.0, released January 26, 2023, with the final Generative AI Profile in place since July 26, 2024. vorplabs

The revision is real, though. America's AI Action Plan directed NIST to revise AI RMF 1.0 in July 2025. As of July 2026, NIST had published no public draft, successor ID, or schedule. vorplabs

Treat any "AI RMF 2.0" label from a vendor as marketing, not fact. The same goes for certification claims. No NIST certification or accredited assessor scheme exists; assessments against the framework are private engagements. vorplabs

Here's what stays the same:

• Govern: policies, roles, and accountability for AI

• Map: context and impact of each AI system

• Measure: testing, metrics, and monitoring

• Manage: controls, response, and documentation

If you built around these four functions, your foundation still holds.

The New NIST Profiles You Need to Know

NIST's 2026 work shifts from "what good looks like" to "which controls to switch on." Four releases matter most for SMEs.

1. The Cyber AI Profile (NIST IR 8596). NIST released this preliminary draft on December 16, 2025. It builds on two foundations: CSF 2.0 and the AI RMF. It covers three focus areas: securing AI system components, using AI for cyber defense, and thwarting AI-enabled attacks. NIST plans to release an initial public draft in 2026. nist issues preliminary draft of cyber ai profile a framework poised to alter security operations in the ai driven threat landscape +2

2. Control Overlays for Securing AI Systems (COSAiS). These turn the profile into specific security controls. NIST IR 8605A covers using and fine-tuning predictive AI. Volumes on generative AI, foundation models, and AI agents are expected later in 2026. epicit

3. The Critical Infrastructure Profile. NIST released its concept note on April 7, 2026. If you sell into energy, health, or utilities, watch this one closely. nist

4. NIST SP 1353. NIST released this initial public draft on August 19, 2026, with comments due October 15, 2026. It shows how teams can use generative AI to speed up CSF 2.0 analysis and planning. cloudsecurityalliance

Example: Say your team uses an AI chatbot connected to your CRM. The AI RMF tells you to assess the risk. The Cyber AI Profile tells you to protect against prompt injection and data leakage in that tool.

Colorado Rewrote Its AI Law: What It Means for Your NIST AI RMF Update

This is the biggest change from our earlier guide. SB 26-189 shifts away from the prescriptive approach and toward transparency, disclosure, and consumer rights. jdsupra

The new law covers automated decision-making technology, or ADMT. In plain terms, that means tools that process personal data to produce predictions, rankings, or scores used in decisions about a person. jdsupra

Your new obligations include:

• Pre-use notice: tell consumers before you use the technology pandectes

• Human review and reconsideration for affected individuals lawandtheworkplace

• Record retention: keep compliance records for at least three years after each consequential decision jdsupra

Don't assume your old NIST safe harbor plan carries over. SB 26-189 removes the original law's internal governance mandates. Confirm your position with counsel. Also note that ongoing litigation could affect the January 1, 2027 date. pandectesmonitaur

Your NIST work still pays off. A solid Map function gives you the ADMT inventory the new law expects.

5 Moves to Make Before January 2027

1. Refresh your AI inventory. Flag every tool that scores, ranks, or recommends anything about a person.

2. Keep the four NIST functions as your spine. Govern, Map, Measure, and Manage still anchor everything else.

3. Add an AI security layer. Use the Cyber AI Profile draft to check prompt injection, data leaks, and vendor access.

4. Set up three-year record retention. Log every AI-assisted decision about customers, applicants, or employees.

5. Name one owner to track NIST changes. Review updates every quarter, so the next revision doesn't surprise you.

Scenario: A 40-person recruiting agency uses an AI resume screener. Step 1 flags it as ADMT. Step 4 sets up decision logs. Step 3 locks down candidate data in the vendor's system. Total time: about two weeks.

What This Looks Like in Practice

Here's an illustrative before and after from a typical SME engagement.

Before: A 60-person fintech had a 2025 AI policy, a risk register, and a plan built for Colorado's June 2026 deadline. It had no AI security controls and no decision logs.

After eight weeks: The team mapped 14 AI tools and flagged three as ADMT. They added Cyber AI Profile security checks and set up three-year logging. When a bank client sent a vendor AI questionnaire, they answered it in two days instead of three weeks.

The bigger lesson comes from the Cloud Security Alliance. Its June 2026 research note found that the AI RMF does not recognize a stable compliance state for an AI system. Governance is a cycle, not a certificate. cloudsecurityalliance

Conclusion

The NIST AI RMF update is not a rewrite of your foundation. It adds security controls on top, while state laws like Colorado's shift toward transparency.

You don't need to start over. You need to refresh your inventory, add the security layer, and log your AI decisions.

Ready to see exactly where your AI governance stands after the 2026 changes? Book your free NIST AI RMF update review today. It takes less than 2 minutes to schedule.