NIST released the AI Risk Management Framework 1.0 on January 26, 2023. It is voluntary. It is for organizations that design, develop, deploy, or use AI. The core is four functions: Govern, Map, Measure, and Manage. NIST’s AI Resource Center says a revision of 1.0 is in progress, and that the Generative AI Profile (NIST AI 600-1, July 26, 2024) is the profile for generative systems. Cite the document you actually used. Do not write “NIST compliant” on a one-pager.
The four lines
- Govern. Who may turn a tool on, and who can turn it off. One name.
- Map. What the tool is allowed to see, and what decision it is allowed to shape. Customer data, source code, and health information are separate yes-or-no lines.
- Measure. What you will count so you know it worked: cycle time, error rate, or a review sample. “People like it” is not a measure.
- Manage. What happens when the output is wrong, and how a person overrides it. If there is no override, say so in the same paragraph that approves the tool.
The page
Keep it to one page per tool, not one page for “AI.” Name the product, the owner, the data it may see, the decision it may not make alone, and the date you will look again. Link the NIST framework and, if the tool generates text or media, the generative profile, so a later reader can see you did not invent the four words.
FAQ
Is this a full implementation of the AI RMF?
No. The framework is larger than four headings, and NIST’s playbook is the place for suggested actions. This page is how a department starts without pretending it finished.
What if NIST publishes a revision?
The Resource Center already says one is in progress. Date your one-pager. When you review the tool, check whether 1.0 is still the document you mean to cite.