NIST AI Risk Management Framework 1.0Supported in OneClickComply

Put NIST AI RMF into practice with governed, evidenced AI risk

NIST AI RMF is the US National Institute of Standards and Technology's voluntary framework for identifying, assessing and managing risks from artificial intelligence. Published on 26 January 2023 as NIST AI 100-1, it sets out four functions, Govern, Map, Measure and Manage, broken into 19 categories and 72 subcategories. Its aim is AI that is valid and reliable, safe, secure and resilient, accountable and transparent, explainable, privacy-enhanced and fair.

See the NIST AI RMF requirements

NIST AI RMF Aligned

Automated Evidence

OneClickFix Enabled

Continuous Monitoring

In-House Audit Team

Who needs NIST AI RMF

Is NIST AI RMF right for your organisation?

Any organisation building, buying or deploying AI can adopt the NIST AI RMF, whatever its size, sector or country. It is not a law, but customers, US federal buyers and investors increasingly expect AI suppliers to show they follow it. Teams usually adopt it when launching AI features, answering AI due diligence questionnaires or preparing for regulation such as the EU AI Act.

Adopting it is voluntary, though customers and auditors often expect it.

Issued by: National Institute of Standards and Technology (NIST), US Department of Commerce
Published: 26 January 2023 as NIST AI 100-1
Latest version: AI RMF 1.0, with a Generative AI Profile (NIST AI 600-1) published in July 2024
Requirement: Voluntary, not a law or certification scheme
Structure: 4 functions, 19 categories, 72 subcategories
Companion resources: NIST AI RMF Playbook with suggested actions for each subcategory
Assessment route: Self-assessment or independent review; no official NIST certification exists
Type: Framework (voluntary)
Region: United States, US
In OneClickComply: Supported today

How we help

OneClickComply makes it simple

The NIST AI RMF is mapped in OneClickComply's control library and available on request. We link its Govern, Map, Measure and Manage outcomes to controls you may already run for ISO 27001, ISO 42001 or SOC 2, so evidence collected once counts towards each. Policies, the AI system inventory, risk register and third-party AI vendor reviews then sit in one place, with our auditors on hand to help.

Requirements covered

4 functions, 19 categories and 72 subcategories, with Govern applying across the organisation and Map, Measure and Manage applied to each AI system.

Already working towards another framework?

ISO 2700137% of NIST AI RMF overlaps
SOC 271% of NIST AI RMF overlaps
NIST CSF64% of NIST AI RMF overlaps
GDPR23% of NIST AI RMF overlaps

Evidence you collect once counts towards every framework it applies to.

Read the official NIST AI RMF source

Manual NIST AI RMF vs. OneClickComply

Manual NIST AI RMF

Interpreting 72 outcome-based subcategories with no prescribed controls
Tracking AI systems, owners and risk tolerances in scattered spreadsheets
Rebuilding evidence already gathered for ISO 27001 or SOC 2
Chasing third-party AI vendors for model and data assurances
Answering AI due diligence questionnaires from scratch each time

With OneClickComply

Subcategories linked to concrete controls, with expert guidance on what good looks like
One AI inventory and risk register with clear owners and documented tolerances
Evidence collected once and reused across every mapped framework
Vendor risk workflows that capture third-party AI assurances in one place
Security questionnaire automation and a trust centre to share your AI governance

Capabilities

Everything you need for NIST AI RMF

NIST AI RMF subcategories mapped to your existing ISO 27001, ISO 42001 and SOC 2 controls

AutoComplete AI governance policies built from your real environment

AI system inventory and risk register for Map and Manage outcomes

Vendor risk reviews for third-party AI models, data and tools

Continuous monitoring with alerts when supporting controls drift

Ask an Auditor guidance on interpreting Govern, Map, Measure and Manage

How it works

Three steps to NIST AI RMF compliance

Connect & scan

Connect your cloud, identity and SaaS tools. OneClickComply checks them against NIST AI RMF and shows you exactly where you stand.

Fix & generate

OneClickFix remediates technical gaps in one click, and AutoComplete generates NIST AI RMF-aligned policies from your real environment.

Monitor & evidence

Continuous monitoring keeps you compliant, and our in-house audit team is on hand when you need expert guidance.

Requirements

NIST AI Risk Management Framework 1.0 requirements

All 19 categories and 72 subcategories of the four AI RMF Core functions; titles are short summaries of each outcome.

Reference	Requirement
GOVERN 1	Policies, processes and procedures for AI risk management
GOVERN 1.1	Legal and regulatory requirements involving AI
GOVERN 1.2	Trustworthy AI characteristics in organisational policies
GOVERN 1.3	Risk management level based on risk tolerance
GOVERN 1.4	Transparent risk management process and outcomes
GOVERN 1.5	Ongoing monitoring and periodic review of risk management
GOVERN 1.6	Inventory of AI systems
GOVERN 1.7	Safe decommissioning and phase-out of AI systems
GOVERN 2	Accountability structures for AI risk
GOVERN 2.1	Documented roles, responsibilities and lines of communication
GOVERN 2.2	AI risk management training for personnel and partners
GOVERN 2.3	Executive leadership responsibility for AI risk decisions
GOVERN 3	Workforce diversity, equity, inclusion and accessibility
GOVERN 3.1	Decision-making informed by a diverse team
GOVERN 3.2	Roles for human-AI configurations and oversight
GOVERN 4	Culture that considers and communicates AI risk
GOVERN 4.1	Critical thinking and safety-first mindset
GOVERN 4.2	Documenting and communicating AI risks and impacts
GOVERN 4.3	AI testing, incident identification and information sharing
GOVERN 5	Engagement with relevant AI actors
GOVERN 5.1	Collecting and integrating external feedback on impacts
GOVERN 5.2	Incorporating adjudicated feedback into system design
GOVERN 6	Third-party software, data and supply chain risks
GOVERN 6.1	Third-party risk policies, including intellectual property
GOVERN 6.2	Contingency processes for third-party failures and incidents
MAP 1	Context is established and understood
MAP 1.1	Intended purposes, uses and context-specific laws documented
MAP 1.2	Interdisciplinary AI actors and diverse competencies
MAP 1.3	Organisational mission and goals for the AI system
MAP 1.4	Business value or context of business use defined
MAP 1.5	Organisational risk tolerances determined and documented
MAP 1.6	System requirements elicited from relevant AI actors
MAP 2	Categorisation of the AI system
MAP 2.1	Tasks and methods the AI system will support
MAP 2.2	Knowledge limits and human oversight of outputs
MAP 2.3	Scientific integrity and TEVV considerations
MAP 3	Capabilities, usage, goals, benefits and costs understood
MAP 3.1	Potential benefits of intended functionality
MAP 3.2	Potential costs, including non-monetary costs
MAP 3.3	Targeted application scope
MAP 3.4	Operator and practitioner proficiency
MAP 3.5	Human oversight processes
MAP 4	Risks and benefits mapped for all components
MAP 4.1	Legal risks of components, including third-party data and software
MAP 4.2	Internal risk controls for AI system components
MAP 5	Impacts on individuals, groups, communities and society
MAP 5.1	Likelihood and magnitude of identified impacts
MAP 5.2	Regular engagement with AI actors on impacts
MEASURE 1	Appropriate methods and metrics identified and applied
MEASURE 1.1	Selecting approaches and metrics for AI risks
MEASURE 1.2	Reassessing metrics and control effectiveness
MEASURE 1.3	Independent internal or external assessors
MEASURE 2	Evaluation for trustworthy characteristics
MEASURE 2.1	Documented test sets, metrics and TEVV tools
MEASURE 2.2	Evaluations involving human subjects
MEASURE 2.3	Performance demonstrated in deployment-like conditions
MEASURE 2.4	Monitoring functionality and behaviour in production
MEASURE 2.5	Validity and reliability demonstrated
MEASURE 2.6	Safety risk evaluation
MEASURE 2.7	Security and resilience evaluation
MEASURE 2.8	Transparency and accountability risks
MEASURE 2.9	Explainability and interpretability of the model
MEASURE 2.10	Privacy risk examination
MEASURE 2.11	Fairness and bias evaluation
MEASURE 2.12	Environmental impact and sustainability
MEASURE 2.13	Effectiveness of TEVV metrics and processes
MEASURE 3	Tracking identified AI risks over time
MEASURE 3.1	Identifying and tracking existing and emergent risks
MEASURE 3.2	Risk tracking where risks are hard to assess
MEASURE 3.3	End user feedback, problem reporting and appeals
MEASURE 4	Feedback on measurement efficacy
MEASURE 4.1	Measurement approaches informed by domain experts
MEASURE 4.2	Trustworthiness results validated in deployment context
MEASURE 4.3	Documented performance improvements or declines
MANAGE 1	Prioritising and responding to mapped and measured risks
MANAGE 1.1	Go or no-go decision on development or deployment
MANAGE 1.2	Prioritised treatment of documented risks
MANAGE 1.3	Responses to high-priority risks
MANAGE 1.4	Documented negative residual risks
MANAGE 2	Maximising benefits and minimising negative impacts
MANAGE 2.1	Resources and viable non-AI alternatives
MANAGE 2.2	Sustaining the value of deployed AI systems
MANAGE 2.3	Responding to and recovering from unknown risks
MANAGE 2.4	Superseding, disengaging or deactivating AI systems
MANAGE 3	Managing third-party AI risks and benefits
MANAGE 3.1	Monitoring third-party risks and applying controls
MANAGE 3.2	Monitoring pre-trained models
MANAGE 4	Documented and monitored risk treatments and communication
MANAGE 4.1	Post-deployment monitoring plans
MANAGE 4.2	Continual improvement integrated into updates
MANAGE 4.3	Communicating incidents and errors

Always check the official NIST AI RMF text for the exact wording.

NIST AI RMF FAQs

What is the NIST AI RMF?

The NIST AI RMF is a voluntary framework from the US National Institute of Standards and Technology for managing risks from AI systems. Published in January 2023 as NIST AI 100-1, it organises AI risk management into four functions, Govern, Map, Measure and Manage, with 19 categories and 72 subcategories. It aims to help organisations build AI that is trustworthy: valid, reliable, safe, secure, accountable, transparent, explainable, privacy-enhanced and fair.

Is the NIST AI RMF mandatory?

No. The NIST AI RMF is voluntary and carries no fines or legal penalties of its own. However, it is widely referenced by US government bodies, customers and procurement teams, and some contracts or sector rules may point to it. Following it is a practical way to show responsible AI governance and to prepare for binding laws such as the EU AI Act.

What are the four functions of the NIST AI RMF?

The four functions are Govern, Map, Measure and Manage. Govern builds the policies, accountability and culture for AI risk across the organisation. Map establishes each AI system's context and identifies its risks and impacts. Measure analyses, tests and tracks those risks with appropriate metrics. Manage prioritises and treats risks, handles third-party AI and plans response, recovery and communication. Govern applies throughout, while the other three are applied to each AI system.

Can you get certified against the NIST AI RMF?

No. NIST does not offer certification against the AI RMF, and there is no accredited certification scheme for it. Organisations typically self-assess against the subcategories or commission an independent review. If you need a certifiable AI management system, ISO/IEC 42001 is the international standard that can be certified, and many organisations use the two together.

How does the NIST AI RMF relate to ISO 42001 and the EU AI Act?

The NIST AI RMF is a voluntary risk framework, ISO/IEC 42001 is a certifiable AI management system standard, and the EU AI Act is binding law. They overlap heavily on governance, risk assessment, data quality, transparency and human oversight. Many organisations use the AI RMF to structure their AI risk work, ISO 42001 to certify it, and both as evidence towards EU AI Act obligations.

How does the NIST AI RMF relate to ISO 27001 and SOC 2?

ISO 27001 and SOC 2 focus on information security, while the NIST AI RMF covers AI-specific risks such as bias, explainability and model validity. They share ground on governance, asset inventory, third-party risk, incident handling and monitoring. If you already hold ISO 27001 or SOC 2, much of the evidence for Govern and Manage outcomes can be reused rather than recreated.

What is the NIST Generative AI Profile?

The Generative AI Profile, published by NIST in July 2024 as NIST AI 600-1, is a companion to the AI RMF. It describes risks that are unique to or made worse by generative AI, such as confabulation, harmful content and information integrity, and suggests actions mapped to the AI RMF subcategories. Organisations building or using large language models use it alongside the core framework.

Does OneClickComply support the NIST AI RMF?

Yes, on request. The NIST AI RMF is mapped in OneClickComply's control library and is available on request rather than as a self-serve framework today. Once enabled, its subcategories link to controls you may already run for ISO 27001, ISO 42001 or SOC 2, so evidence collected once counts towards each, with policy generation, risk registers, vendor risk and auditor guidance in one place.

Related standards

All standards

Get NIST AI RMF ready, not stressed

Automate controls, gather evidence continuously and stay audit-ready, all on one platform.