NIST AI RMF: What It Is and How Purplecop Helps
The NIST AI Risk Management Framework (AI RMF 1.0) is a voluntary framework from the US National Institute of Standards and Technology to help organizations manage the risks of AI systems. NIST released it on January 26, 2023. Its core has four functions, Govern, Map, Measure and Manage, and the framework text defines no certification scheme.
What is the NIST AI Risk Management Framework?
The NIST AI RMF is a framework, published as NIST AI 100-1, that helps organizations manage the risks of AI systems and promote trustworthy and responsible development and use of AI. NIST says it is intended to be voluntary, rights-preserving, non-sector-specific and use-case agnostic, so it can be used by organizations of all sizes and in all sectors.
It is written for the people NIST calls AI actors: organizations and individuals who design, develop, deploy or use AI systems. In the framework, risk is the composite measure of an event's probability of occurring and the magnitude of its consequences.
Is the NIST AI RMF mandatory, and is it a certification?
The AI RMF is not mandatory. NIST's FAQ answers the question directly: "No. NIST has produced the AI RMF as a voluntary Framework."
The framework text also describes no certification or accreditation scheme for organizations. The text uses the word "certifications" only in MAP 3.4, which says processes for operator and practitioner proficiency, "and relevant technical standards and certifications," are defined, assessed and documented, and in an Appendix C passage that repeats it. Neither describes a certification scheme for organizations. The framework also says its actions "do not constitute a checklist." If a vendor offers an "AI RMF certificate," ask who issues it and against which criteria, because NIST's framework does not define one.
What are the four functions of the NIST AI RMF?
The four functions are Govern, Map, Measure and Manage:
- Govern cultivates a culture of risk management and sets the processes, documents and organizational structures for managing AI risk. NIST calls it a cross-cutting function that is infused through the other three.
- Map establishes the context to frame risks related to an AI system. After Map, organizations should have enough context to inform an initial go or no-go decision on whether to design, develop or deploy a system.
- Measure uses quantitative, qualitative or mixed-method tools to analyze, assess, benchmark and monitor AI risk and related impacts.
- Manage allocates risk resources to mapped and measured risks on a regular basis, including plans to respond to, recover from and communicate about incidents.
NIST says functions may be performed in any order across the AI lifecycle once a governance structure is in place, although most users would start with Map after instituting Govern. The process should be iterative.
What makes an AI system trustworthy under the AI RMF?
NIST names seven characteristics of trustworthy AI systems:
- valid and reliable
- safe
- secure and resilient
- accountable and transparent
- explainable and interpretable
- privacy-enhanced
- fair, with harmful bias managed
NIST describes valid and reliable as a necessary condition of trustworthiness, and accountable and transparent as relating to all the others. Its FAQ also warns that addressing the characteristics individually will not ensure trustworthiness: tradeoffs are often involved, and some characteristics matter more than others in a given setting.
What are the AI RMF Playbook and profiles?
The Playbook is a companion resource that suggests tactical actions for achieving the framework's outcomes. NIST describes it as voluntary: organizations can borrow as many or as few suggestions as suit them.
Profiles apply the framework to a specific situation. The framework describes use-case profiles (for example, a hiring profile), temporal profiles that compare a current state with a target state to reveal gaps, and cross-sectoral profiles for things such as large language models.
NIST has also published two profile-related items. On July 26, 2024 it released NIST-AI-600-1, the Generative Artificial Intelligence Profile. On April 7, 2026 it released a concept note for an AI RMF Profile on Trustworthy AI in Critical Infrastructure.
Is the AI RMF being updated?
Yes. NIST's AI RMF page, read on October 24, 2026, says "The AI RMF 1.0 is being revised as part of the White House AI Action Plan." The page still links to AI RMF 1.0 for download, so AI RMF 1.0 is the framework document to cite until NIST publishes a revision.
The framework calls itself a living document. It says NIST expects a review with formal input from the AI community no later than 2028, and that major and minor versions will be tracked in a version control table.
How is the NIST AI RMF different from ISO/IEC 42001?
The AI RMF is a voluntary NIST framework of outcomes and actions. ISO/IEC 42001 is an international standard, published in December 2023 as Edition 1, that specifies requirements for establishing, implementing, maintaining and continually improving an AI management system within an organization.
NIST says it will continue to align the AI RMF with applicable international standards. NIST's AI Resource Center lists a crosswalk titled "NIST AI RMF to ISO/IEC FDIS 42001 AI Management system Crosswalk." The Resource Center says listed crosswalks are submitted by the AI RMF user community and that inclusion does not imply NIST endorsement or that either resource comprehensively covers the other. This one maps to the final draft of ISO/IEC 42001, so check any mapping against the published 2023 text. For the cybersecurity side, see our NIST CSF 2.0 page.
Does Purplecop help with the NIST AI RMF?
Yes, at the product level. The Purplecop AIMS page says the product is mapped to ISO 42001, the NIST AI RMF and the EU AI Act. It lists an AI Frameworks module for those three, "mapped like any other framework," alongside modules for a model inventory, an AI risk register, AI controls and AI policies.
The AI RMF is voluntary and its text describes no certification scheme, so mapping a product to it is not a certification or a compliance status. Purplecop AIMS is a Purplecop product, not a NIST program, and its product page does not claim NIST endorsement.
What is the NIST AI RMF?
The NIST AI Risk Management Framework (AI RMF 1.0) is a voluntary framework, released by the US National Institute of Standards and Technology on January 26, 2023, to help organizations manage the risks of AI systems. Its core has four functions: Govern, Map, Measure and Manage.
Is the NIST AI RMF mandatory?
No. NIST states that it produced the AI RMF as a voluntary framework and that organizations are not required to use it.
What are the four core functions of the AI RMF?
Govern, Map, Measure and Manage. Govern is a cross-cutting function that applies across the organization. Map, Measure and Manage can be applied to specific AI systems and stages of the AI lifecycle.
What are the characteristics of trustworthy AI in the AI RMF?
NIST lists seven: valid and reliable; safe; secure and resilient; accountable and transparent; explainable and interpretable; privacy-enhanced; and fair with harmful bias managed.
Is there an AI RMF profile for generative AI?
Yes. NIST released NIST-AI-600-1, the Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile, on July 26, 2024. NIST says it can help organizations identify unique risks posed by generative AI.
Does Purplecop AIMS map to the NIST AI RMF?
The Purplecop AIMS product page says it is mapped to ISO 42001, the NIST AI RMF and the EU AI Act. The AI RMF itself is voluntary and its text describes no certification scheme, so mapping to it is not a certification or a compliance status.
Talk to a practitioner
Tell us the obligation you are trying to meet and who is asking for it. The first call is with a practitioner.