International standards · Standard
NIST AI Risk Management Framework (AI RMF 1.0) Voluntary standard NIST AI RMF
Reference information based on the sources as of November 2, 2026; the official text prevails.
Summary A free, voluntary US government framework with four functions: Govern, Map, Measure and Manage. It is not certifiable, but it is the reference US customers ask for and it provides a legal defense in Texas (TRAIGA). NIST is revising it and publishing additional profiles.
Who it applies to Any organization that designs, develops, deploys or uses AI.
Penalties The rule has no penalty regime of its own, or it does not apply.
Official name NIST AI 100-1, Artificial Intelligence Risk Management Framework (AI RMF 1.0)
Official reference NIST AI 100-1, 26 de enero de 2023
Regulator US National Institute of Standards and Technology (NIST) Key dates January 26, 2023 AI RMF 1.0 published April 7, 2026 Concept note for a critical infrastructure profile Obligations and dates Obligations table Obligation Article or citation Status Date Who it applies to Verification Govern: policies, roles, culture and vendors NIST AI 100-1, función GOVERN Voluntary standard Already applicable Recommended for any organization that uses or develops AI. Verified in the official source on November 2, 2026 Map: context, inventory and impacts NIST AI 100-1, función MAP Voluntary standard Already applicable Recommended for any organization that uses or develops AI. Verified in the official source on November 2, 2026 Measure: testing, bias, robustness and monitoring NIST AI 100-1, función MEASURE Voluntary standard Already applicable Recommended for any organization that uses or develops AI. Verified in the official source on November 2, 2026 Manage: risk treatment, incidents and decommissioning NIST AI 100-1, función MANAGE Voluntary standard Already applicable Recommended for any organization that uses or develops AI. Verified in the official source on November 2, 2026
Govern: policies, roles, culture and vendors NIST AI 100-1, función GOVERN Voluntary standard
When it relates Recommended for any organization that uses or develops AI. What the rule provides Approve AI policies and assign responsibilities. Train staff and manage third-party risks. Typical evidence Policy, committee, training plan and vendor policy
Verification Verified in the official source on November 2, 2026 Date, voluntary nature and functions checked on nist.gov on Nov 2, 2026. Map: context, inventory and impacts NIST AI 100-1, función MAP Voluntary standard
When it relates Recommended for any organization that uses or develops AI. What the rule provides Record each use case with its context, users and potential impacts. Classify systems by risk level. Typical evidence Use-case portfolio and system inventory
Verification Verified in the official source on November 2, 2026 Functions checked on nist.gov. Measure: testing, bias, robustness and monitoring NIST AI 100-1, función MEASURE Voluntary standard
When it relates Recommended for any organization that uses or develops AI. What the rule provides Test systems before and after deployment (accuracy, bias, security, robustness). Document metrics and limitations. Typical evidence Test reports and model cards
Verification Verified in the official source on November 2, 2026 Functions checked on nist.gov. Manage: risk treatment, incidents and decommissioning NIST AI 100-1, función MANAGE Voluntary standard
When it relates Recommended for any organization that uses or develops AI. What the rule provides Prioritize and treat risks, with owners and deadlines. Respond to incidents and be able to disable or roll back a system. Typical evidence Risk register with treatment, incident plan and rollback protocol
Verification Verified in the official source on November 2, 2026 Functions checked on nist.gov. Regulatory change alerts by country Pick the countries you care about and we will email you when we change a rule or an application date for those countries in our registry.
It is a free, informational notice, not a legal monitoring service: it does not necessarily catch every change or within a set time.
Find out what applies to you (free)