The AI Risk Management Framework was published by the US National Institute of Standards and Technology in January 2023. It is voluntary. It has nevertheless become one of the most widely used reference points for AI governance, including by organisations outside the US.
The four functions
Govern. Policies, roles, accountability and culture. This runs through everything else.
Map. Understand the context: what the system is for, who it affects, what could go wrong.
Measure. Test and evaluate: accuracy, robustness, bias, security, and whether the system does what it is meant to.
Manage. Act on what you found: mitigate, monitor, respond to incidents, and retire systems.
The framework also describes the characteristics of trustworthy AI, including validity, safety, security, accountability, transparency, explainability, privacy and fairness.
Profiles
NIST adds profiles for particular uses. A Generative AI Profile followed in July 2024, and a concept note on AI in critical infrastructure in April 2026. NIST says the core framework is being revised as part of the US AI Action Plan, but no new version had been published at the time of writing.
How it relates to other rules
The framework is not law and does not make anyone compliant with the EU AI Act. But it overlaps heavily with what the Act and ISO/IEC 42001 ask for. Organisations that operate in several jurisdictions often use it as the internal structure and map the legal duties onto it.
Regulators rarely ask whether you used NIST. They ask whether you can show what you did. NIST is a good way to organise the answer.
What to do
If you have no AI governance structure yet, the four functions are a sensible starting point. Record which function each of your controls belongs to.
This article is general information on the law as at November 2026. It is not legal advice and has not been updated since that date. See the terms of use.