About This Framework
Official Name: NIST AI Risk Management Framework (AI RMF 1.0), NIST AI 100-1
Published By: National Institute of Standards and Technology (NIST), US Department of Commerce
Published: January 26, 2023
Authorising Law: National Artificial Intelligence Initiative Act of 2020 (P.L. 116-283)
Binding?: Voluntary. Not law. However, provides affirmative legal defense in Colorado AI Act (June 30, 2026) and Texas TRAIGA (January 1, 2026). Required in US federal government AI procurement.
Global Adoption: Referenced in EU AI Act compliance, ISO/IEC 42001, Singapore AI Verify, Australia AI6 framework, UK DSIT guidance, and enterprise vendor questionnaires worldwide.
Core Structure: Four functions: GOVERN, MAP, MEASURE, MANAGE. Nine trustworthy AI characteristics.
Cost: Free. Full framework, Playbook, and Generative AI Profile available at airc.nist.gov.
Latest Version: AI RMF 1.0 (Jan 2023). Generative AI Profile (NIST AI 600-1) published July 2024.
Introduction
The NIST AI Risk Management Framework (AI RMF 1.0) is a voluntary AI governance framework published by the US National Institute of Standards and Technology on January 26, 2023. It was built under the National Artificial Intelligence Initiative Act of 2020, developed over 18 months through a consensus process involving more than 240 organisations from industry, academia, civil society, and government. It is free, flexible, and designed for organisations of any size and sector.
In 2026, the NIST AI RMF is referenced as an affirmative legal defence in Colorado’s AI Act and Texas TRAIGA, incorporated into ISO/IEC 42001, and used as the evaluation framework in Singapore’s AI Verify toolkit. Enterprise procurement teams across financial services, healthcare, and government are adding NIST AI RMF alignment to vendor questionnaires.
Most SMEs adopt AI tools faster than they build governance around them. If something goes wrong and you cannot show a documented, defensible process for identifying, measuring, and managing AI risk, you are exposed both legally and commercially. The NIST AI RMF fixes that gap with minimal overhead.
This guide walks you through the four core functions in plain language, with practical steps you can implement this week, no dedicated compliance team required.
Why SMEs Cannot Afford to Ignore AI Governance in 2026
AI systems fail in ways that traditional software does not. A biased training dataset can produce discriminatory hiring outcomes at scale. A hallucinating AI assistant can give customers inaccurate information that creates legal liability. A poorly monitored model can drift over time, quietly degrading decisions in ways no human reviewer notices.
For SMEs, the consequences of these failures are disproportionately severe. A single AI-related discrimination claim, a regulatory investigation, or a high-profile customer harm can consume operational resources that a large enterprise would absorb as a rounding error.
Critically, 2026 is the year US state AI laws start imposing real compliance burdens. Colorado’s AI Act (effective June 30, 2026) and Texas TRAIGA (effective January 1, 2026) both reference NIST AI RMF alignment as an affirmative defence or safe harbor. Implementing the framework is now both good governance and a legal shield.
The 4 Core Functions: Govern, Map, Measure, Manage
The NIST AI RMF organises AI risk management into four interconnected functions that work across the AI lifecycle.
- GOVERN: Establish the policies, roles, and culture that make AI risk management possible. Define who owns AI risk, what values guide AI use, and how decisions get made. For an SME, this might be a one-page AI use policy, a named AI risk owner, and a clear escalation path.
- MAP: Understand the context and potential impacts of each AI system before it goes live. Who uses the system? What decisions does it influence? What could go wrong, and who bears the consequences? MAP turns abstract risk into documented, specific assessments.
- MEASURE: Quantify the risks you have identified. This includes testing for bias, evaluating accuracy under different conditions, assessing robustness against adversarial inputs, and monitoring performance over time.
- MANAGE: Respond to the risks you have measured. Prioritise mitigation efforts, implement controls, communicate risk information to stakeholders, and document your decisions.
GOVERN applies continuously across all stages. MAP, MEASURE, and MANAGE apply sequentially as each AI system moves through its lifecycle. The Generative AI Profile (NIST AI 600-1, July 2024) extends the framework to LLMs and foundation model deployments.
Trustworthy AI: The 9 Characteristics the Framework Targets
The NIST AI RMF defines trustworthy AI through nine characteristics. These are measurable properties, not aspirational values.
- Valid and Reliable: The system performs consistently and accurately for its intended purpose.
- Safe: The system does not cause unintended physical, psychological, financial, or societal harm.
- Secure and Resilient: The system resists adversarial attacks and recovers from disruptions.
- Explainable and Interpretable: Decisions can be understood by users and stakeholders.
- Privacy-Enhanced: The system respects data privacy throughout its lifecycle.
- Fair with Bias Managed: The system does not produce discriminatory outcomes across groups.
- Accountable and Transparent: Clear ownership of decisions exists, and system behaviour can be audited.
For an SME starting from scratch, focus first on Valid and Reliable and Accountable and Transparent. These form the foundation for everything else and are the characteristics regulators, clients, and courts are most likely to ask about first.
Want a free assessment of where your AI systems stand against the NIST AI RMF criteria, and whether your documentation would satisfy Colorado’s AI Act or Texas TRAIGA affirmative defence requirements? Book a 30-minute consultation and we will walk you through the gaps.
Implementing the NIST AI RMF Without a Dedicated Team
- Build your AI inventory: You cannot govern what you cannot see. List every AI system in use across your organisation, including third-party SaaS tools that make or influence decisions.
- Assign an AI risk owner: Designate one person accountable for reviewing new AI deployments and monitoring existing ones. This does not need to be a full-time role.
- Build simple risk cards: For each AI system, create a one-page document covering its purpose, data inputs, decision outputs, potential harms, and current controls.
- Set a monitoring cadence: Commit to quarterly performance metric reviews for each AI system. Check for accuracy drift, demographic disparities, and user complaints. Log these reviews.
- Use the NIST Generative AI Profile for LLMs: If you use any large language model (ChatGPT, Claude, Gemini, Copilot) in business operations, apply NIST AI 600-1 to assess hallucination risk and data provenance.
Why the AI RMF Is Now a Commercial Requirement
Colorado’s AI Act (effective June 30, 2026) provides an affirmative defence to organisations complying with a nationally or internationally recognised AI risk management framework. The NIST AI RMF is the primary framework cited. Texas TRAIGA similarly recognises substantial compliance with the NIST AI RMF as a liability shield.
ISO/IEC 42001, the international AI management system standard that is rapidly becoming the ISO 9001 of AI, builds on NIST AI RMF principles. Companies that implement the AI RMF now are typically ISO 42001 certification-ready with minimal incremental work.
Frequently Asked Questions
Is the NIST AI RMF mandatory in the United States?
No. The NIST AI RMF is voluntary. However, it is referenced as an affirmative defence in Colorado’s AI Act and Texas TRAIGA, required in US federal government AI procurement, and increasingly demanded by enterprise clients as a condition of vendor approval.
How does the Generative AI Profile (NIST AI 600-1) differ from the AI RMF 1.0?
The AI RMF 1.0 is the foundational framework for all AI systems. NIST AI 600-1, published July 2024, extends the framework specifically to generative AI and large language models, addressing hallucination, data provenance, and intellectual property risks.
How long does it take an SME to implement the NIST AI RMF?
A basic implementation covering all four core functions can be completed in 4 to 8 weeks for a small organisation with a handful of AI systems. Ongoing maintenance requires roughly 2 to 4 hours per month.
Where can I download the NIST AI RMF?
The full AI RMF 1.0, the Playbook, NIST AI 600-1, and all supporting resources are available free at airc.nist.gov.
Conclusion
The NIST AI Risk Management Framework is the most practical AI governance tool available to SMEs today. In 2026, it is also a legal shield under US state AI laws and a commercial requirement for enterprise vendor relationships. The combination of free availability, legal benefit, and commercial necessity makes implementation an easy decision.
Start this week. Build your AI inventory. Assign an AI risk owner. Create your first risk card. The entire AI RMF implementation flows from those three actions.
Ready to build a defensible AI governance programme that works as a legal shield under Colorado and Texas law? Book your free NIST AI RMF alignment session today. We will assess your current AI use, map it to the four core functions, and give you a 90-day implementation roadmap.
