NIST AI Risk Management Framework (AI RMF 1.0), explained

The NIST AI Risk Management Framework (AI RMF 1.0, published as NIST AI 100-1) is a voluntary guidance document NIST released on 26 January 2023, after a direction from Congress, to "help manage the many risks of AI technologies." NIST Director Laurie E. Locascio described its goal as helping "companies and other organizations in any sector and any size to jump-start or enhance their AI risk management approaches." Unlike a regulation, the AI RMF sets out no mandatory controls or audits — it is a structure organizations can adopt, adapt, or borrow from selectively, built around four functions and seven characteristics of what NIST calls "trustworthy" AI.

The AI RMF Core: four functions

NIST's AI Resource Center describes the Core as the framework's operational component: outcomes and actions grouped into four functions, each broken into categories and further into subcategories.

Function	Categories / subcategories	What it does
Govern	6 / 18	Cross-cutting function "infused throughout AI risk management" — policies, accountability structures, and culture that the other three functions rely on
Map	5 / 13	"Establishes the context to frame risks related to an AI system" — what the system is, who it affects, what it's for
Measure	4 / 20	"Employs quantitative, qualitative, or mixed-method tools, techniques, and methodologies to analyze, assess, benchmark, and monitor AI risk and related impacts"
Manage	4 / 12	"Entails allocating risk resources to mapped and measured risks on a regular basis and as defined by the govern function"

NIST is explicit that the actions inside each function are "neither a checklist nor set of steps to be followed in its entirety" (the same language NIST uses to describe the companion Playbook, below). Governance is meant to run underneath the whole process; once it's in place, most organizations start with Map and move into Measure or Manage as the AI system's lifecycle warrants — not necessarily in a fixed order.

Seven characteristics of trustworthy AI

The AI RMF ties all four functions back to seven characteristics it defines as what "trustworthy" means for an AI system in practice:

• Valid and reliable — performs as intended, consistently, under expected conditions.
• Safe — should "not, under defined conditions, lead to a state in which human life, health, property, or the environment is endangered."
• Secure and resilient — maintains confidentiality, integrity and availability, and degrades safely under adverse events rather than failing catastrophically.
• Accountable and transparent — information about the system and its outputs is available to the people interacting with it.
• Explainable and interpretable — operators and affected people can understand how the system works and why it produced a given output.
• Privacy-enhanced — limits intrusion into individuals' autonomy, identity and data through norms and technical practice.
• Fair, with harmful bias managed — addresses harmful bias and discrimination, while recognizing fairness standards "differ across cultures and contexts."

NIST frames these as interrelated, not independent checkboxes: a decision that improves one (say, raw performance) can trade off against another (say, explainability), and weighing that trade-off throughout the AI lifecycle is explicitly part of what the Manage function is for.

Profiles: turning the Core into something concrete

A Profile is how an organization applies the Core's functions, categories and subcategories to an actual setting. NIST's AI Resource Center names three kinds: use-case Profiles for a specific sector or application, temporal Profiles contrasting a Current Profile (how AI risk is managed today) against a Target Profile (the desired state), and cross-sectoral Profiles for models or applications used across many sectors at once. The best-known published example is the Generative AI Profile (NIST AI 600-1, released 26 July 2024), built to "identify unique risks posed by generative AI" inside the same Govern/Map/Measure/Manage structure rather than inventing a parallel framework.

A companion Playbook translates the Core's subcategories into suggested, non-mandatory actions — NIST describes it as "neither a checklist nor set of steps to be followed in its entirety," meant to be borrowed from selectively rather than implemented wholesale.

Where this fits for device and firmware fleets

Products that embed an on-device model, call out to a cloud model, or expose an AI feature through firmware carry AI-specific risk on top of conventional software risk — model behavior drift, data used for inference, and explainability of an automated decision are not questions a traditional vulnerability scan answers. Teams already mapping conventional application risk against OWASP's LLM-specific list (see our OWASP Top 10 for LLM Applications guide) or securing an MCP integration (see MCP server security) can use the AI RMF's four functions as the governance layer that sits above both: Govern sets the policy, Map identifies which device features actually carry AI risk, Measure benchmarks that risk concretely, and Manage decides what to do about it.

SoftWSP's device and firmware security work can help scope where an embedded AI feature introduces its own risk surface alongside the rest of a product's firmware: see device & firmware security services.

This guide summarises a public NIST publication; it does not constitute legal or compliance advice.