What is the NIST AI Risk Management Framework?

Definition

The NIST AI Risk Management Framework (AI RMF 1.0, January 2023) is a voluntary framework from the U.S. National Institute of Standards and Technology for identifying and managing risks from AI systems. In July 2024 NIST added a Generative AI Profile (NIST AI 600-1) focused on risks specific to generative AI.

It's not a regulation and doesn't apply to firms by force of law.

Why it matters for advisors

FINRA lists the AI RMF among its AI resources, and it gives smaller firms a ready-made structure for AI governance: map where AI is used, measure risks, manage them and govern the process. It's a useful checklist when writing an AI policy or reviewing a vendor.

Vendors sometimes say they're "aligned with NIST." Ask what that means in practice, since there's no NIST certification for the AI RMF.

The framework's four functions are Govern, Map, Measure and Manage. Even a five-person firm can use them as a simple outline: who owns AI decisions, where AI is used, how you check it works and what you do when it doesn't.

Example

A firm uses the Generative AI Profile's list of risks (such as confabulation, data privacy and information security) as headings in its AI tool review form.

Watch out for

Following a voluntary framework doesn't replace meeting SEC and FINRA obligations. Use it to organize the work, not as proof of compliance.