Subjects and lessons to explore.

Law

Data Science & AI Literacy · Foundations

NIST AI Risk Concepts

9 min read 5 practice questions
10 key termsSourcesReport an error
Want it in plain words first? Jump to Eli explains — the same idea, no jargon.
On this page 9 sections
  1. In 30 seconds
  2. Why this matters
  3. The college version
  4. Eli explains
  5. Worked example
  6. Key takeaway
  7. Quick check
  8. Study tools
  9. Sources & references

In 30 seconds

The NIST is a framework from the U.S. National Institute of Standards and Technology for managing the risks that come with artificial intelligence. It organizes work into four functions: , , , and . The framework defines risk as the combination of how likely a harmful event is and how much harm it would cause. It gives organizations that build or use AI a shared vocabulary for risk: a guide to structured thinking, not a guarantee of safety.

Why this matters

AI systems already shape real decisions: which loan applications get approved, which patients are flagged for follow-up, what news people see. Each of those systems can carry risks to people, organizations, and even ecosystems, yet the harms often stay invisible until something fails. The AI RMF exists because risk thinking needs structure. Learning it gives you a vocabulary that works across companies, classrooms, and policy debates, so when someone says 'govern' or 'measure' in an AI conversation, you know what they mean. It also teaches an honest habit: name risks, check them, and act on them, instead of hoping a system is safe.

The college version

What the NIST AI Risk Management Framework is

The NIST AI Risk Management Framework, usually called the AI RMF, is a framework for managing the risks associated with artificial intelligence. NIST, the National Institute of Standards and Technology, is a U.S. government agency, and it published version 1.0 of the framework in January 2023 after a consensus-driven process that included public comment periods and workshops. NIST's stated purpose is to help organizations manage risks to individuals, organizations, and society that come with AI, and to improve their ability to build trustworthiness into the design, development, use, and evaluation of AI products, services, and systems. One word in NIST's own description matters most: voluntary. The AI RMF is guidance, not a law. No agency requires organizations to adopt it, and completing it does not certify a system. Organizations choose to use it because thinking about AI risk in a structured way is hard to do well without some kind of map.

The four functions: GOVERN, MAP, MEASURE, MANAGE

The heart of the AI RMF is a set of four functions: GOVERN, MAP, MEASURE, and MANAGE. NIST describes them as high-level organizers for AI risk management activities, broken down into categories and subcategories of specific actions and outcomes. GOVERN means building a risk-management culture: setting roles, policies, and processes so the organization knows who is responsible and how decisions get made. MAP means establishing the context: understanding the system, where it will be used, and what risks arise in that setting. MEASURE means analyzing and tracking the risks that were mapped, using quantitative methods such as test scores, qualitative methods such as expert review, or a mix of both. MANAGE means acting: allocating resources to the risks that matter most and planning how to respond to, recover from, and communicate about incidents. Governance is designed to run through all four functions, and NIST stresses that risk management should be continuous and performed throughout the AI system's lifecycle, not squeezed into a single stage.

What counts as an AI risk

NIST's framework defines risk the way modern risk management does: as a function of two things, the negative , or magnitude of harm, that would arise if a harmful event occurs, and the that it occurs. Neither number alone is the risk. A failure that is very unlikely but catastrophic still matters, and so does a small harm that happens constantly. The framework is equally explicit about who can be harmed. It names individuals, groups, communities, organizations, society, the environment, and the planet, which its own figure captions summarize as people, organizations, and ecosystems. A loan model that systematically rejects qualified applicants harms people. The lender that built it can lose customers and face scrutiny, which harms the organization. A system whose data use or energy footprint affects the surrounding environment reaches ecosystems. NIST's point is that AI risk is broader than the model makes mistakes: it includes how systems touch the world around them.

Who it is for, and why frameworks matter

The AI RMF is written for organizations that design, develop, deploy, evaluate, or acquire AI systems, which covers nearly everyone who builds or buys AI, from a startup training a recommendation model to a hospital evaluating a vendor's triage tool. Understanding it is also useful for people who never build AI, because the framework gives the field a shared vocabulary. When two companies, a regulator, and a community group all use words like map and measure to mean the same activities, discussions about AI risk become sharper and less vague. A framework also forces structure: instead of reacting to disasters one at a time, an organization asks the same questions in the same order for every system, and it writes down what it found. That documentation is what makes risk work reviewable, comparable across systems, and improvable over time.

What the framework cannot do

Honesty about limits is part of the framework itself. NIST says its actions do not constitute a checklist, and they are not necessarily an ordered set of steps. The framework also does not prescribe risk tolerance: it can help an organization prioritize risks, but each organization must decide how much risk it is willing to accept. Most importantly, the framework does not guarantee that a system is trustworthy or safe. It is a guide for thinking and acting, and a guide only works if people actually use it well, in context, and keep using it as the system, the data, and the world change. Voluntary guidance also sits alongside other rules: some sectors have binding legal requirements about AI, and the framework complements those rules rather than replacing them.

Eli, the EliExplains learning guide

Eli explains

The same idea, in plain words

Explain it like I’m 10

The NIST AI Risk Management Framework is a guide from a U.S. government agency that helps organizations think about AI risks in an organized way. Instead of worrying about risks in a jumble, it gives you four jobs to do. GOVERN means setting up who is responsible and what the rules are. MAP means figuring out the situation and what could go wrong. MEASURE means checking how big and how likely those risks really are. MANAGE means deciding what to do about them and keeping watch. The framework is voluntary, so nobody is forced to use it, and using it does not mean a system is automatically safe.

Picture it like this

Think of the AI RMF like the pre-flight routine of a flight crew. The crew does not check the plane once and call it safe; they work through the same checks on every flight, because conditions change. The routine does not fly the plane, but it makes sure the crew looks at the right things in a sensible order and does not skip a step because they are busy.

Where the picture stops working

The comparison has limits. A flight routine is required by aviation rules, while the AI RMF is voluntary. A plane is also a machine that engineers understand almost completely, whereas an AI system keeps changing and can harm people in ways its builders never imagined, so even a thorough routine cannot guarantee the outcome.

Worked example

Coastal Transit, a fictional regional bus agency, wants an AI system that predicts which routes will run late so it can warn riders. The team works through the four RMF functions. Under GOVERN, the board names a manager responsible for the system and writes a short policy on how predictions may be used. Under MAP, the team studies the context: riders, drivers, weather data, and the fact that a prediction could make riders miss their connections. Under MEASURE, they test the model against a month of archived schedules, checking accuracy route by route rather than overall. Under MANAGE, they decide to show warnings only when confidence is high, set up a way to track complaints, and schedule a re-check every quarter. Six months later, a route's pattern shifts and the re-check catches it, because the risk work continues.

Key takeaway

The NIST AI Risk Management Framework gives organizations that build or use AI a voluntary, structured way to think about risk through four functions (GOVERN, MAP, MEASURE, and MANAGE), but a framework guides risk work; it never guarantees a risk-free system.

Quick check

3 questions here, of 5 in this lesson’s practice set. Answers stay hidden until you check.

Question 1 of 3foundational

Which set names the four functions of the NIST AI Risk Management Framework?

Choose an answer, then check it.
Question 2 of 3intermediate

According to the NIST AI RMF, risk is best understood as a combination of which two elements?

Choose an answer, then check it.
Question 3 of 3intermediate

Which statement best describes the legal status of the NIST AI Risk Management Framework?

Choose an answer, then check it.
Practice all 5

Keep learning

You’ve reached the end of this subject. Return to the outline to choose what to explore next.

Practice this lesson
Study tools & related lessonsYou’ll learn to · Common mistakes · Easily confused · Key vocabulary · Related

You’ll learn to

  • Define the NIST AI Risk Management Framework and explain why it is voluntary guidance rather than a law.
  • Name the four RMF functions (GOVERN, MAP, MEASURE, MANAGE) and describe what each asks an organization to do.
  • Explain the framework's definition of risk as the combination of likelihood and impact.
  • Apply the four functions to a scenario involving an AI system.
  • Analyze what a voluntary framework can and cannot do for an organization's AI risk work.

Common mistakes

  • Treating the AI RMF as a law that AI systems must pass.

    The framework is voluntary guidance. NIST states it is intended for voluntary use, so no one is required to adopt it, though following it does not replace any binding legal requirements that apply to a sector.

  • Thinking that completing the functions once makes a system safe forever.

    NIST presents risk management as continuous work across the AI lifecycle. Systems, data, and circumstances change, so the functions must be repeated and re-checked.

  • Treating the four functions as a strict one-two-three checklist.

    NIST says the actions do not constitute a checklist and are not necessarily an ordered set of steps, and governance is designed to run through the other three functions.

  • Confusing risk with harm alone.

    Risk combines likelihood and impact. A rare but catastrophic failure and a frequent small harm are both risks, and neither can be judged by impact alone.

  • Believing that a framework guarantees a trustworthy system.

    A framework guides thinking and action; it does not guarantee outcomes. NIST also notes it does not prescribe risk tolerance, which each organization must set for itself.

Easily confused

The NIST AI RMF, voluntary guidance vs. A safety regulation, a binding rule

The RMF is a framework organizations choose to adopt, while a regulation carries legal penalties for noncompliance. The RMF can inform how an organization meets regulatory expectations, but it is not itself a law.

A risk framework vs. A guarantee of safety

A framework structures how an organization thinks about and acts on risk, while a guarantee promises an outcome. The RMF explicitly does not guarantee outcomes; it helps organizations manage risk, not eliminate it.

Key vocabulary

AI Risk Management Framework (AI RMF)
A voluntary framework from the U.S. National Institute of Standards and Technology that organizes how organizations manage risks associated with artificial intelligence.
risk
In the AI RMF, the combination of how likely a harmful event is to occur and how much harm it would cause if it does.
likelihood
How probable it is that a harmful event or failure involving an AI system will happen.
impact
The magnitude of harm that would result if a harmful event involving an AI system occurs.
GOVERN
The RMF function that builds a risk-management culture and sets up the roles, policies, and processes for handling AI risk.
MAP
The RMF function that establishes the context for an AI system and frames the risks that come with that context.
MEASURE
The RMF function that analyzes, assesses, benchmarks, and monitors AI risks using quantitative or qualitative methods.
MANAGE
The RMF function that allocates resources to mapped and measured risks and plans how to respond to and recover from incidents.
voluntary
Describing guidance that organizations choose to follow rather than something that the law requires.
trustworthy AI
AI systems that are valid and reliable, safe, secure and resilient, accountable and transparent, explainable, privacy-enhanced, and fair with harmful bias managed.

Sources & references

  1. AI Risk Management Framework (AI RMF) — National Institute of Standards and Technology (NIST)
  2. Artificial Intelligence Risk Management Framework (AI RMF 1.0), NIST AI 100-1 — National Institute of Standards and Technology (NIST)

EliExplains lessons are original prose written from the open, credible references above. See Copyright & Licensing.

Researched 2026-08-21

Educational content only. It is not medical, legal or professional advice. Found an error? Tell us.