> ## Content Index
> Fetch the complete content index at: https://www.aigl.blog/llms.txt
> Use this file to discover other available public pages before exploring further.

# Artificial Intelligence Risk Management Framework (AI RMF 1.0)
- URL: https://www.aigl.blog/artificial-intelligence-risk-management-framework-ai-rmf-1-0-2/
- Published: 2026-09-18T19:03:36.000Z
- Updated: 2026-09-18T19:03:36.000Z
- Description: A voluntary, use-case-agnostic framework for organisations managing risks from the design, development, deployment and use of AI systems. It sets out trustworthiness characteristics and four functions—GOVERN, MAP, MEASURE and MANAGE—for continuous AI risk management.
- Author: Jakub Szarmach
- Tags: Framework, AI Governance, Risk Management, Responsible AI, Model Evaluation, Technical Controls, #aigl-library

## ⚡ Quick Summary

Published by the National Institute of Standards and Technology, this framework provides voluntary, rights-preserving, non-sector-specific and use-case-agnostic approaches for organisations that design, develop, deploy or use AI systems. Its purpose is to help AI actors manage AI risks and support trustworthy and responsible AI across the system lifecycle. It treats risk as a combination of an event’s likelihood and the magnitude of its consequences, including impacts on individuals, communities, organisations, society, the environment and the planet.

The framework identifies seven characteristics of trustworthy AI: valid and reliable; safe; secure and resilient; accountable and transparent; explainable and interpretable; privacy-enhanced; and fair with harmful bias managed. Its Core organises outcomes and actions under four functions: GOVERN, MAP, MEASURE and MANAGE. GOVERN is cross-cutting, while the other functions establish context, assess risks through quantitative, qualitative or mixed methods, and prioritise and treat those risks. It also introduces use-case, temporal and cross-sectoral profiles for tailoring implementation to a setting, risk tolerance and available resources.

## 🧩 What’s Covered

The document progresses from foundational risk concepts to an operational Core and supporting appendices.

- **Risk framing and measurement challenges:** Defines AI risk, impacts and harm, and explains difficulties in measurement, including third-party dependencies, emergent risks, unreliable metrics, lifecycle changes, real-world deployment, inscrutability and the challenge of selecting human baselines.
- **Risk tolerance and organisational integration:** States that the framework does not prescribe risk tolerance, instead directing organisations to applicable requirements or to define reasonable tolerances. It calls for AI risk management to be integrated with enterprise practices, including cybersecurity and privacy.
- **Audience and lifecycle actors:** Maps AI work across application context, data and input, AI model, and task and output dimensions. It identifies AI actors across planning, development, deployment, operation, monitoring and test, evaluation, verification and validation (TEVV), alongside affected communities and other interested parties.
- **Trustworthiness characteristics:** Explains the seven characteristics and the trade-offs between them, such as interpretability and privacy or predictive accuracy. It describes safety practices, security concerns including adversarial examples and data poisoning, transparency, explainability, privacy-enhancing technologies, and systemic, computational/statistical and human-cognitive bias.
- **GOVERN and MAP:** Sets categories and subcategories for organisational policies, accountable roles, workforce diversity, external engagement and third-party risk. MAP requires documented context, system categorisation, intended benefits and costs, human oversight, component risks and likely impacts.
- **MEASURE and MANAGE:** Requires documented TEVV methods, test sets, metrics, monitoring, independent or non-front-line review where appropriate, and tracking of emergent risk. MANAGE covers go/no-go decisions, risk treatment, residual-risk documentation, incident response, recovery, deactivation and continual improvement.
- **Profiles and appendices:** Describes Current and Target Profiles for identifying gaps, plus cross-sectoral profiles. Appendices detail actor tasks, differences from traditional software risks, human-AI interaction issues, and the framework’s stated attributes, including being outcome-focused and non-prescriptive.

## 💡 Why it matters?

The framework gives governance, technical, compliance and assurance teams a shared structure for turning broad AI trustworthiness concerns into lifecycle activities. It connects organisational accountability, system context, documentation, testing and post-deployment response rather than treating model performance as the sole risk question. In particular, the MAP and MEASURE functions support explicit assessment of intended use, affected groups, limitations, third-party components and trade-offs; MANAGE then links those assessments to prioritisation, treatment and monitoring. The document also makes clear that AI risks should be considered alongside broader enterprise security and privacy risk practices.

## ❓ What’s Missing

The framework deliberately does not prescribe acceptable risk tolerances, a fixed sequence of implementation steps, profile templates or one-size-fits-all controls. It leaves organisations to set context-specific thresholds, select categories and subcategories according to their resources, and resolve trade-offs among trustworthiness characteristics. Although it calls for rigorous, documented TEVV, it does not supply a universal metric set or detailed testing procedures; it acknowledges a lack of consensus on robust and verifiable measures for risk and trustworthiness. Effectiveness measures for the framework itself are also reserved for future NIST activities. The companion Playbook is referenced for suggested tactical actions but is not included in this publication.

## 👥 Best For

AI governance leads, risk managers, product teams, evaluators, auditors and senior leaders establishing lifecycle controls for AI systems. It is particularly useful for teams that need to document system context and residual risk, define responsibilities and human oversight, develop TEVV processes, assess third-party dependencies, or plan post-deployment monitoring and incident response.

## 📄 Source Details

*Artificial Intelligence Risk Management Framework (AI RMF 1.0)* is NIST AI 100-1, published by the National Institute of Standards and Technology in January 2023\. No individual authors are named. The supplied complete PDF comprises 48 pages and identifies version 1.0\. The document URL is [https://doi.org/10.6028/NIST.AI.100-1](https://doi.org/10.6028/NIST.AI.100-1?ref=aigl.blog).