Why reach for a voluntary framework
You could read the EU AI Act cover to cover and still not know how to run risk management on a Tuesday. That is the gap NIST fills. The AI Risk Management Framework (NIST AI 100-1) gives you a repeatable method - four functions, seven trustworthiness traits, and a companion profile for generative AI - that you can drive on any system regardless of jurisdiction. It carries no legal force, but it is how many teams operationalise the duties the law imposes.
Govern, Map, Measure, Manage 9 min live
The RMF has four core functions. Govern sits at the centre and runs through everything; Map, Measure, and Manage form the working loop you cycle through on a system. It is voluntary and US-origin, and it complements - it does not replace - the binding EU AI Act.
| Function | What you do |
|---|---|
| Govern | Cultivate a risk-management culture: oversight, accountability, policies, and roles across the whole AI lifecycle. It runs through the other three. |
| Map | Establish the context and identify + frame the risks in the actual setting where the system is used. |
| Measure | Analyse, assess, benchmark, and monitor the mapped risks using quantitative and qualitative metrics. |
| Manage | Prioritise and act on the mapped and measured risks - treat, respond, and recover. |
LiveGovern - the culture at the centre2 min▶
Govern is not one step in a line - it is the function that holds the other three together. It is about building a risk-management culture: who is accountable, what policies apply, how oversight works, and how roles are assigned across the AI lifecycle.
- Runs throughout: you do not "finish" Govern - it is active while you Map, Measure, and Manage.
- Where the org shows up: this is the function that connects individual system work to leadership, policy, and accountability.
LiveMap - frame the risk in context2 min▶
Map establishes the context and identifies the risks that matter in the actual setting of use. The same model can be low-risk in one deployment and dangerous in another - Map is where you pin down which one you are in.
- Context first: purpose, users, affected people, the decisions the system shapes.
- Frame, do not just list: the output is risks framed against the real use, not a generic checklist.
LiveMeasure - put numbers (and judgement) on it2 min▶
Measure analyses, assesses, benchmarks, and monitors the risks Map surfaced - using both quantitative metrics (accuracy, disparity across groups, robustness) and qualitative assessment where numbers do not reach.
- Both kinds of evidence: metrics where you can, structured judgement where you cannot.
- Ongoing: monitoring means you keep measuring after deployment, not just before.
LiveManage - act, and why it is voluntary2 min▶
- Manage: prioritise the mapped and measured risks and act on them - treat, respond, recover. This is where risk work turns into decisions and mitigations.
- Voluntary + US-origin: the RMF (NIST AI 100-1, Jan 2023) is a voluntary framework with no certification - you adopt it because it works, not because a law names it.
- Complements the EU AI Act: method vs law. NIST gives you the how; the Act gives you the binding what. Run the RMF and you generate much of the evidence the Act asks for.
The seven trustworthy-AI traits + applying it 9 min live
The RMF defines seven characteristics of trustworthy AI - the qualities you Measure against. There is also a companion GenAI Profile for generative-AI risks. Then you run the whole loop on one real system.
LiveThe seven characteristics3 min▶
NIST defines trustworthy AI through seven characteristics:
- Valid & reliable - it does what it claims, consistently.
- Safe - it does not endanger life, health, property, or the environment.
- Secure & resilient - it withstands attack and recovers from disruption.
- Accountable & transparent - responsibility is clear and the system is open to scrutiny.
- Explainable & interpretable - its outputs and mechanisms can be understood.
- Privacy-enhanced - it protects the data and identities it touches.
- Fair - with harmful bias managed - it manages harmful bias across affected groups.
LiveThe Generative AI Profile (NIST AI 600-1)2 min▶
- What it is: a companion profile (NIST AI 600-1, published 26 July 2024) that maps the RMF onto the specific risks of generative AI.
- Why you need it: generative models bring risks the core framework only sketches - confabulation, harmful content, data leakage, and more.
- How to use it: run the same four functions, but with the GenAI-specific risks and controls the profile lays out.
LiveRunning the RMF on one system2 min▶
The four functions become a pass you drive on a single system:
- Map the context and the risks in the real setting of use.
- Measure those risks against the seven traits, with metrics where you can.
- Manage the treatments - prioritise, mitigate, monitor.
- Govern the whole thing - accountability, policy, and oversight around it.
It maps onto ISO 42001 (session b6) so the work you do here feeds a certifiable management system later.
Vantage runs GMMM on its hiring tool. Map surfaces the headline risk immediately: a CV-ranking model can carry harmful bias against protected groups - a direct hit on the "fair, bias managed" trait. Measure puts numbers on it (selection-rate disparity across gender and ethnicity, plus accuracy). Manage schedules the mitigations (reweighting, human-in-the-loop review, monitoring). Govern names an accountable owner and writes the policy. The pass gives Vantage exactly the evidence its high-risk EU AI Act file needs.
Run a mini GMMM pass ★ 10 min
Take one of your own AI systems and run a one-line pass through each of the four functions.
Map (one line). Name the system, its context of use, and the single biggest risk in that setting.
Measure (one line). Pick the trait most at stake and the metric (or structured judgement) you would use to assess it.
Manage (one line). State the one treatment you would prioritise and how you would monitor it.
Govern (one line). Name the accountable owner and the policy or oversight that surrounds it.
Before session b6 ◐ 40 min total
- Run a full one-line GMMM pass on your highest-stakes AI system and write it down.
- Score that system honestly against all seven trustworthy-AI traits - which are strong, which are gaps?
- If any system is generative, note which GenAI Profile (AI 600-1) risks apply that the core framework misses.
- Read: NIST AI RMF (NIST AI 100-1) core functions, and skim the Generative AI Profile (NIST AI 600-1).
Official sources covered
Taught from the NIST publications. This page covers ~80% of the working content on the RMF.
Three questions before you go 🎯 ◐ 90 seconds
1 · Which RMF function is described as central and continuous - running through the other three?
Govern cultivates the risk-management culture - oversight, accountability, policies, roles - and runs across the whole lifecycle while Map, Measure, and Manage cycle around it.
2 · The NIST AI RMF is best described as...
The RMF (NIST AI 100-1, Jan 2023) is voluntary and US-origin, with no certificate. It complements the binding EU AI Act - method vs law - rather than replacing it.
3 · Which is NOT one of the seven trustworthy-AI characteristics?
The seven are: valid & reliable; safe; secure & resilient; accountable & transparent; explainable & interpretable; privacy-enhanced; and fair with harmful bias managed. Profit is not among them.