NIST AI RMF 1.0
NIST AI Risk Management Framework, function by function
Enterprise buyers now ask how you manage the risks of the AI you build or use. NIST AI RMF gives you a structure for the answer, organised in four functions, and the programme you build on it can be mapped to ISO 42001 and SOC 2.
In short
The NIST AI Risk Management Framework (AI RMF 1.0) is a voluntary framework published by NIST to help organisations manage the risks of AI systems throughout their lifecycle. It is organised around four functions: Govern (establish accountability and culture), Map (identify and contextualise risks), Measure (assess and track risks), and Manage (treat and monitor risks). There is no certificate. What buyers, regulators and procurement teams look for is a documented programme built on it.
What the NIST AI RMF is
NIST AI RMF is a risk-management framework. There is no certificate, audit or pass mark. It gives you a structured way to identify, assess, manage and document the risks your AI systems create, so you can show buyers, partners or regulators how you do it when they ask.
The framework is organised around four functions (Govern, Map, Measure, Manage) and a set of categories and subcategories within each. You decide which subcategories apply to your AI systems and document how you address them. That documented programme is what buyers evaluate.
The four functions
Each function covers a distinct aspect of AI risk management. Govern underpins the other three and applies across all of them.
| Function | Purpose | What it covers |
|---|---|---|
| Govern | Establish accountability and culture | Policies, roles, risk tolerance, organisational commitment to responsible AI |
| Map | Identify and contextualise risks | AI system inventory, intended use, stakeholder impacts, risk identification |
| Measure | Assess and track risks | Metrics, testing, evaluation of trustworthiness characteristics (fairness, transparency, safety) |
| Manage | Treat and monitor risks | Risk response, incident management, continuous monitoring, feedback loops |
Who needs an AI RMF programme
Any company that builds, deploys or procures AI systems and sells to enterprise, government or regulated industries. Enterprise procurement teams now include AI governance questions in vendor assessments, and a documented programme based on NIST AI RMF or ISO 42001 is a common way to answer them.
The framework comes from the US but is used internationally. It crosswalks to the EU AI Act, ISO 42001 and other AI governance standards, so a programme built on AI RMF can be reused in other jurisdictions.
- AI and ML platform companies selling to enterprise or government
- SaaS companies that embed AI features (recommendations, classification, generation)
- Companies responding to AI-specific questions in vendor security assessments
- Organisations preparing for ISO 42001 certification or EU AI Act compliance
NIST AI RMF and ISO 42001
NIST AI RMF and ISO 42001 address the same problem from different angles. AI RMF provides a risk-management structure and leaves implementation flexible. ISO 42001 wraps AI-specific controls inside the ISO management-system model (scope, risk method, Statement of Applicability, internal audit, management review) and offers formal certification.
In practice they work well together. A documented AI RMF programme covers much of what ISO 42001 asks for on AI risk management, and ISO 42001 adds the management-system governance around it.
AI RMF alongside SOC 2, EU AI Act and ISO 27001
Several AI RMF categories overlap with SOC 2 and ISO 27001: access control, logging, incident response, change management and vendor risk management. If you already operate under those frameworks, much of the Govern and Manage functions is already in place.
The AI-specific additions are in Map and Measure: AI system inventories, impact assessments, fairness and bias evaluation, model performance monitoring, and transparency documentation. This is where most of the new work sits.
The path to a documented programme
There is no audit to pass. You build and document a programme, working through the four functions in order.
-
01
Govern
Establish AI governance: policies, roles, risk tolerance and organisational commitment.
Leadership and your AI governance lead; implementation support is there if you want it
-
02
Map
Inventory your AI systems. Document intended use, stakeholders, data inputs, and identify risks.
The product and engineering owners of each system
-
03
Measure
Define metrics and testing for fairness, transparency, safety and other trustworthiness characteristics.
Your data science and risk teams, in Certifyi
-
04
Manage
Implement risk responses, incident procedures and continuous monitoring for each AI system.
System owners, with incidents and reviews recorded in Certifyi
Who does what
Software, implementation support and the independent reviewer are different jobs. This is how they divide.
| Task | Your team | Certifyi | No formal assessor (voluntary framework) |
|---|---|---|---|
| Governance | Establish policies and roles | Records policies, risk tolerance and accountability | Reviews during procurement or audit |
| AI system inventory | Document each system | Holds inventory, use cases and risk assessments | Not usually involved |
| Controls | Implement and operate them | Holds controls and evidence | Evaluates during vendor assessment |
| Monitoring | Track and respond to risks | Records incidents and reviews | Not usually involved |
| The programme | Maintain it | Keeps the programme records in one workspace | Assesses programme maturity |
How Certifyi helps
Build your AI RMF programme on the same record as everything else
Certifyi is the workspace where your AI risk controls, evidence and governance documentation live alongside your other frameworks.
-
AI system inventory
Record each AI system with its use case and owner in one register.
-
Tamper-evident activity log
When a buyer asks who approved a model review and when, the evidence is on the control and the tamper-evident activity log shows every action taken on it.
-
Policies with review cycles
Write AI governance policies next to your security policies, and review each one on a set cycle.
Questions
NIST AI RMF, answered
Is NIST AI RMF a certification?
No. It is a voluntary framework. There is no formal certification, audit or pass mark. The value is in having a documented, structured AI risk-management programme that you can show to buyers, partners and regulators.
Is it mandatory?
Not directly. However, several US federal requirements and procurement standards reference it, enterprise buyers ask about it, and it crosswalks to the EU AI Act's risk-management requirements.
How does it relate to ISO 42001?
They work together. AI RMF provides the risk-management structure. ISO 42001 places AI controls inside the ISO management-system model and offers formal certification. A programme built on AI RMF covers much of ISO 42001's AI risk requirements.
How does it relate to the EU AI Act?
NIST AI RMF's four functions map to many of the EU AI Act's requirements for high-risk AI systems: risk management, data governance, transparency, human oversight and post-market monitoring. A documented AI RMF programme is good preparation for the EU AI Act.
Can we reuse SOC 2 or ISO 27001 work?
Yes, for the Govern and Manage functions especially. Access control, incident response, change management and vendor management transfer directly. The AI-specific additions (Map and Measure) are where new work is needed.
How long does it take?
It depends on how many AI systems you operate and where your governance maturity starts. Until both are known any date would be a guess, so scoping comes first.
Map your AI systems in a 30-minute call.
Bring your AI system inventory, however rough, and the AI questions buyers are sending you. We go through how a documented AI RMF programme can answer them from the same controls and evidence you keep for SOC 2 or ISO 27001.
- Each customer workspace has its own database
- Every change written to a tamper-evident activity log
- Auditors get scoped, read-only access
- AI suggestions wait for a person to accept them