Using the NIST AI RMF without a large compliance team

NIST published the AI Risk Management Framework (AI RMF 1.0, NIST AI 100-1) on January 26, 2023. It is voluntary guidance, not law, and there is no NIST certification attached to it. On July 26, 2024 NIST added a Generative AI Profile (NIST AI 600-1) that applies the framework to generative AI and lists twelve risks specific to it, from confabulation to information security and value-chain integration.

For a mid-sized company the framework can look like a program for a bank. It does not have to be. Applied to one AI system at a time, its four functions turn into a short set of documents and checks that a security reviewer or a customer will recognize.

Govern: name an owner and write down the rules

Govern is about accountability. For one system, that means a named business owner, a short policy on what the system may and may not do, and an inventory entry: what it is, which model and provider it uses, and what data it touches.

Map: describe the context before you build

Map covers the context of the system and its impacts. Write down the decision the system supports, who is affected, what a wrong output would cost, and which of the Generative AI Profile risks apply. Confabulation and data privacy apply to almost every assistant; others, such as intellectual property, depend on the use case.

Measure: test against thresholds agreed in advance

Measure is evaluation. Build a test set from real, representative cases, including awkward ones, and agree pass thresholds with the business owner before the build starts. Run the same tests after every change to the model, the prompts or the data it retrieves.

Manage: monitor, respond and review suppliers

Manage covers what happens once the system is live, including risks from third parties such as the model provider. Monitor quality and cost, decide in advance what triggers a rollback, keep a person on consequential actions, and review the provider’s terms on retention and training.

• An owner and a one-page policy (Govern)
• A context note listing the risks that apply (Map)
• A test set, thresholds and results for each release (Measure)
• Monitoring, a rollback trigger and a supplier review (Manage)

Where to start

Pick the AI system closest to production and produce the four items above for it. That gives a reviewer something concrete to read, and gives the team a template for the next system.

Which version to cite

As of November 2026, AI RMF 1.0 is still the current version. NIST says it is being revised as part of the White House AI Action Plan of July 2025 and has not published a successor or a date. In policies and customer answers, name the version you align to, for example “aligned with NIST AI RMF 1.0 (NIST AI 100-1) and the Generative AI Profile (NIST AI 600-1)”, and check nist.gov when you review the policy.

Common questions