NIST AI RMF

Full definition

The seven characteristics are: valid and reliable; safe; secure and resilient; accountable and transparent; explainable and interpretable; privacy-enhanced; fair with harmful bias managed. The 2024 Generative AI Profile extends the framework to GenAI-specific risks (CBRN, confabulation, data privacy, IP, obscene content, harmful bias). NIST AI RMF is the de-facto reference framework for U.S. federal AI procurement and a common baseline for enterprise AI governance globally.

Why it matters

NIST AI RMF is voluntary but increasingly contractually required — federal contractors, regulated industries, and any enterprise selling into them face it directly. It also maps cleanly to the EU AI Act, making it the most efficient single framework to anchor a global program.

Example

A SaaS company adopts NIST AI RMF as its governance backbone, mapping each control to EU AI Act Article 9 obligations — single artifact set, two regulatory regimes covered.

Next steps

• Get a free workflow map →We map one of your workflows and give you a written verdict: software, a process change or AI. No obligation.
• AI consulting cost guide →Hourly rates and project budgets by firm tier, from independents to the Big Four.

Related terms

• AI Risk Assessment
  An AI risk assessment is a structured review of an AI system's potential harms — to individuals, groups, the organization, and society — covering likelihood, severity, affected populations, and mitigation controls across safety, fairness, security, privacy, and compliance dimensions.
• AI Governance
  AI governance is the framework of policies, roles, controls, and processes an organization uses to ensure its AI systems are lawful, safe, fair, accountable, and aligned with business intent — across the full lifecycle from problem framing to retirement.
• EU AI Act
  The EU AI Act (Regulation (EU) 2024/1689) is the European Union's comprehensive, risk-tiered regulation of AI systems, the world's first horizontal AI law, with obligations phasing in from February 2025: general-purpose AI model rules from 2 August 2025 (Commission fines from 2 August 2026; models already on the market have until 2 August 2027) and, after the Digital Omnibus (Regulation (EU) 2026/1744), high-risk rules from 2 December 2027 (Annex III) and 2 August 2028 (Annex I).
• AI Audit
  An AI audit is a structured, evidence-based examination of an AI system or AI program against defined criteria — covering training data, model, deployment context, monitoring, and governance — performed by an internal team, an external firm, or a regulator.

More governance & risk terms

• Constitutional AI
  Constitutional AI (CAI) is a training technique, introduced by Anthropic in 2022, in which a model critiques and revises its own outputs against a written set of principles, then learns from those revisions instead of from human-labeled preferences alone.
• Alignment Tax
  The alignment tax is the performance cost — measured on capability benchmarks — of making a model safer, more honest, or more aligned with human values, relative to the same model trained only for capability.
• Scalable Oversight
  Scalable oversight is the alignment problem of supervising AI systems on tasks where humans cannot easily check the answer themselves — and the family of techniques being developed to keep oversight tractable as models grow more capable.