NIST AI RMF 1.0: The Four Functions and How to Apply Them

Published January 2023 as NIST AI 100-1, the AI Risk Management Framework is voluntary, rights-preserving, non-sector-specific guidance to manage AI risks across the AI lifecycle — not a certification scheme.

Related: CSF Tiers and Profiles · RMF 7 steps · NIST hub.

Core Functions

Function

Role

Govern

Cross-cutting policies, culture, accountability, and oversight — informs all other functions

Map

Establish context; frame risks related to the AI system and lifecycle actors

Measure

Analyze, assess, benchmark, and monitor AI risks with quantitative or qualitative methods

Manage

Allocate resources; prioritize and treat mapped and measured risks; support incident response and recovery

Each function breaks into categories and subcategories with suggested outcomes and actions (the AI RMF Playbook elaborates). Actions are not a rigid ordered checklist.

Trustworthiness Characteristics

Framework framing includes: valid and reliable; safe; secure and resilient; accountable and transparent; explainable and interpretable; privacy-enhanced; and fair with harmful bias managed.

How CyberSilo Helps

Where AI systems touch security monitoring or automated decisions, map Measure and Manage evidence to SIEM detection and change-control artefacts
Govern aligns with CSF-style oversight programmes already tracked in Compliance Standards Automation

Put NIST Evidence on Continuous Artefacts

Map CSF Subcategories, 800-53 families, and 800-171 requirements to living SIEM and compliance evidence.

Request a NIST Gap Scan Explore Compliance Automation

Frequently Asked Questions

Is the AI RMF mandatory?

It is voluntary unless adopted by contract or policy. NIST does not certify AI systems against the AI RMF.

Is AI RMF Govern the same as CSF Govern?

Related idea of governance as cross-cutting, but a different catalog focused on AI-specific risks.

Does NIST certify AI systems?

No. The AI RMF is guidance, not a certification scheme.

NIST hub · What Is NIST CSF 2.0? · 800-171 Rev 3 Changes · ThreatHawk SIEM

NIST AI RMF 1.0: The Four Functions and How to Apply Them

Core Functions

Trustworthiness Characteristics

How CyberSilo Helps

Put NIST Evidence on Continuous Artefacts

Frequently Asked Questions

Is the AI RMF mandatory?

Is AI RMF Govern the same as CSF Govern?

Does NIST certify AI systems?

Latest Articles

Fintech Compliance Automation: Multi-Jurisdiction Requirements (PCI, SOC 2, GDPR, MAS, SAMA)

How MSSPs Help Clients Achieve PCI DSS Compliance at Scale

The 5 Biggest Operational Mistakes MSSPs Make When Managing Multiple Client SOCs

What Is ISO 27001? A Practical 2026 Guide for Security and GRC Teams

What Is the NIST Cybersecurity Framework? CSF 2.0 Explained for 2026

How NIST Helps Cybersecurity Programs Mature in 2026

NIST AI RMF 1.0: The Four Functions and How to Apply Them

Core Functions

Trustworthiness Characteristics

How CyberSilo Helps

Put NIST Evidence on Continuous Artefacts

Frequently Asked Questions

Is the AI RMF mandatory?

Is AI RMF Govern the same as CSF Govern?

Does NIST certify AI systems?

Related NIST Resources

Latest Articles

Fintech Compliance Automation: Multi-Jurisdiction Requirements (PCI, SOC 2, GDPR, MAS, SAMA)

How MSSPs Help Clients Achieve PCI DSS Compliance at Scale

The 5 Biggest Operational Mistakes MSSPs Make When Managing Multiple Client SOCs

What Is ISO 27001? A Practical 2026 Guide for Security and GRC Teams

What Is the NIST Cybersecurity Framework? CSF 2.0 Explained for 2026

How NIST Helps Cybersecurity Programs Mature in 2026