AI Governance
Available nowNIST AI Risk Management Framework · 1.0
The NIST AI Risk Management Framework (AI RMF 1.0) is a voluntary, public-domain framework for managing AI risk, organized around its functions: Govern, Map, Measure, and Manage. It is the common US reference for building trustworthy AI.
50+
requirements tracked
Core plans
Access
Add-on from $19/mo
The publication
What AI RMF 1.0 is, and where to get it
The NIST AI Risk Management Framework is published as NIST AI 100-1 and was released on January 26, 2023. It is voluntary and certifies nobody, and as a work of the US Government it carries no copyright in the United States, so the PDF is free to download and free to quote.
Its Core is organized around the GOVERN, MAP, MEASURE and MANAGE functions, which break down into categories and then into the subcategories Keel scores.
NIST’s AI Risk Management Framework pageNIST AI 100-1 (doi.org/10.6028/NIST.AI.100-1)
Scope
How much of the standard Keel models
Keel authors every leaf requirement in the scope declared below, with nothing inside that scope left out. A test fails the build if the authored count and the declared count ever diverge, so this framework cannot quietly lose requirements after the fact.
- Authored in Keel
- 50+ requirements
- In Keel’s scored scope
- 50+ leaf requirements
Keel publishes this for every framework it ships, complete or not, so a readiness percentage can be read against a denominator you can see. Compare every framework
Who it is for
Who needs NIST AI Risk Management Framework?
- US organizations and federal contractors standing up AI governance
- Teams that want a voluntary, flexible framework rather than a certification
- Risk and security leaders aligning AI risk with their existing programs
What Keel does
How Keel helps with NIST AI Risk Management Framework
- The Govern, Map, Measure, and Manage functions as a trackable control set
- Evidence shared with your other frameworks so you are not duplicating work
- A live readiness view across every function
Collect once, comply everywhere
NIST AI Risk Management Framework shares canonical controls with ISO/IEC 42001, AI Governance Essentials and EU AI Act and others in the catalog. Implement one of those controls and it counts toward every framework it satisfies, so adding NIST AI Risk Management Framework rarely means starting from scratch.
- ISO/IEC 27001 shares canonical controls
- CIS Critical Security Controls no shared canonical controls
- PCI DSS no shared canonical controls
- SOC 2 no shared canonical controls
- SOX (Sarbanes-Oxley) Section 404 no shared canonical controls
- NIST Cybersecurity Framework shares canonical controls
- NIST SP 800-53 shares canonical controls
- FedRAMP Rev5 Class B shares canonical controls
- FedRAMP Rev5 Class C shares canonical controls
- FedRAMP Rev5 Class D shares canonical controls
- FedRAMP 20x shares canonical controls
- FedRAMP Consolidated Rules no shared canonical controls
- NIST SP 800-171 no shared canonical controls
- HIPAA no shared canonical controls
- GDPR shares canonical controls
- COPPA no shared canonical controls
- Google Play Families no shared canonical controls
- Amazon Appstore Child-Directed Apps no shared canonical controls
- Apple App Store Kids Category no shared canonical controls
- PIPEDA no shared canonical controls
- ISO 9001 shares canonical controls
- AI Governance Essentials shares canonical controls
- ISO/IEC 42001 shares canonical controls
- EU AI Act shares canonical controls
- ESG Essentials shares canonical controls
- US Employment Law - Federal Baseline no shared canonical controls
A framework is lit when at least one canonical control satisfies both NIST AI Risk Management Framework and that framework. Unlit means none of them do, which is an absence rather than a judgment about that standard.
Questions about NIST AI Risk Management Framework in Keel
Where is the official NIST AI RMF 1.0?
NIST released the AI Risk Management Framework 1.0 on January 26, 2023 as NIST AI 100-1, and the PDF is free to download from NIST. As a work of the US Government, it is not subject to copyright in the United States. NIST also publishes the AI RMF Playbook, an online companion that suggests actions toward the framework’s outcomes, and on July 26, 2024 it released NIST AI 600-1, a Generative AI Profile. NIST’s AI RMF page says 1.0 is being revised under the White House AI Action Plan. Keel models the published 1.0 Core and does not score the Generative AI Profile separately.
How is the AI RMF Core organized?
The Core is built from the GOVERN, MAP, MEASURE and MANAGE functions. Each function breaks into categories, and each category into subcategories, which are the outcomes an organization works toward. GOVERN applies across every stage of an organization’s AI risk management, while the other functions can be applied to a specific AI system at specific stages of its lifecycle. Keel scores the subcategories, the Core’s lowest level.
What does the AI RMF mean by trustworthy AI?
AI 100-1 lists the characteristics of a trustworthy AI system: valid and reliable, safe, secure and resilient, accountable and transparent, explainable and interpretable, privacy-enhanced, and fair with harmful bias managed. It says they have to be balanced against each other for the system’s context of use, and gives examples of tradeoffs, such as interpretability against privacy.
What does Keel add to the NIST AI RMF?
Each subcategory is a scored requirement you can map controls and evidence to, with an owner and a status. The AI services register records each AI service your organization uses, with its vendor, purpose, the categories of data sent to it, an owner, a risk tier and an approval status, so the inventory GOVERN 1.6 asks for lives next to the controls. Where a control is shared with ISO/IEC 42001 and the EU AI Act in Keel’s library, the same evidence counts there too.
Crosswalks for NIST AI Risk Management Framework: NIST AI Risk Management Framework vs AI Governance Essentials crosswalk · NIST AI Risk Management Framework vs ESG Essentials crosswalk · NIST AI Risk Management Framework vs EU AI Act crosswalk · NIST AI Risk Management Framework vs FedRAMP 20x crosswalk · NIST AI Risk Management Framework vs FedRAMP Rev5 Class B crosswalk · NIST AI Risk Management Framework vs FedRAMP Rev5 Class C crosswalk · NIST AI Risk Management Framework vs FedRAMP Rev5 Class D crosswalk · NIST AI Risk Management Framework vs GDPR crosswalk · NIST AI Risk Management Framework vs ISO 9001 crosswalk · NIST AI Risk Management Framework vs ISO/IEC 27001 crosswalk · NIST AI Risk Management Framework vs ISO/IEC 42001 crosswalk · NIST AI Risk Management Framework vs NIST Cybersecurity Framework crosswalk · NIST AI Risk Management Framework vs NIST SP 800-53 crosswalk
Other frameworks: ISO/IEC 27001 · CIS Critical Security Controls · PCI DSS · SOC 2 · SOX (Sarbanes-Oxley) Section 404 · NIST Cybersecurity Framework · All frameworks