The NIST AI Risk Management Framework: Govern, Map, Measure, Manage in Practice

A year before most AI rules, NIST published a voluntary framework that has become the common vocabulary for trustworthy AI. What its four functions ask of a deploying organisation.

Dwayne ThompsonEngineering, standards & trade editor · Kingston

March 7, 2023 · 7 min read

A close-up of a processor, illustrating the NIST AI Risk Management Framework. · Image: Girder Group

The NIST AI Risk Management Framework is voluntary, and it has quietly become the reference everyone else points at. Released on 26 January 2023, it predates most binding AI rules and gives them a shared vocabulary: Govern, Map, Measure, Manage (NIST AI RMF). For an organisation deploying AI, its value is not compliance; it is a defensible structure for decisions you will have to explain anyway.

Key takeaways

The AI RMF is organised around four functions: Govern, Map, Measure, and Manage.
It is voluntary but has become the common language linking the FCA's principles, ISO 42001, and internal policy.
Govern and Map front-load the work: know your AI use cases, their context, and who owns them.
It pairs naturally with CSF 2.0 and ISO/IEC 42001 as an evidence-producing management approach.

The four functions, in practice

Govern establishes the culture, roles, and accountability for AI risk, the owner and the policy. Map builds context: what AI systems exist, what they are used for, and what could go wrong for whom. Measure assesses and tracks the risks with methods and metrics. Manage acts on them and documents the decisions (NIST AI 100-1). The order matters: most failed AI governance skips Map and discovers, too late, that it never knew its own inventory.

The framework’s reach comes from being neutral ground. A firm can use it to satisfy the FCA’s principles-based expectations, to structure an ISO/IEC 42001 management system, and to answer an internal board question, with one vocabulary. That interoperability is why it spread.

Its limitation is honest and stated: it produces trustworthiness through process, not a certificate. The output is a defensible record of how you governed, mapped, measured, and managed, which is exactly what a regulator or customer asks to see.

“Its value is not compliance; it is a defensible structure for decisions you will have to explain anyway.”

How AI could address the gap

The AI RMF is an evidence engine: an inventory, a risk record, a decision log. Keeping those current as models change is the standing work that manual governance loses.

Model-governance tooling can maintain the AI inventory the Map function requires, record Measure and Manage activity against each system, and generate the explanations Govern implies. The accountability stays human; the framework’s record stays current. It is the same conclusion we reach on the FCA’s AI expectations.

Building the platforms, portals, and systems that make these obligations provable is what Girder Group does.

Sources

1.AI Risk Management Framework (AI RMF 1.0).National Institute of Standards and Technology
2.NIST AI 100-1, Artificial Intelligence Risk Management Framework, January 2023.National Institute of Standards and Technology

Dwayne Thompson

Engineering, standards & trade editor · Girder Group · Kingston

Dwayne Thompson writes on compliance engineering, standards (NIST), and trade and logistics regulation (CBP, DOT, FMC), from Girder Group's Kingston desk.

Meet the desk