The NIST AI Risk Management Framework is a voluntary framework published by the US National Institute of Standards and Technology in January 2023 as NIST AI 100-1, written to help organisations identify and manage the risks of the AI systems they build, deploy or buy. Its Core is four functions, govern, map, measure and manage, broken into 19 categories and 72 subcategories and pointed at seven named characteristics of trustworthy AI. The framework is voluntary and does not itself create legal or regulatory obligations. The framework can be applied through profiles, including the Generative AI Profile released in July 2024.<\/p>\n\n
Profiles help organisations translate the framework’s general guidance into a specific use case or operating context.<\/p>\n
NIST developed the framework following direction provided by the National Artificial Intelligence Initiative Act of 2020. The National Artificial Intelligence Initiative Act of 2020<\/a> (P.L. 116-283) directed the agency to produce it, and the drafting ran through two public comment drafts and a series of workshops before version 1.0 was released on 26 January 2023. The framework describes itself as voluntary, rights-preserving, non-sector-specific and use-case agnostic.<\/p>\n Although the framework is voluntary, organisations may encounter it through procurement requirements, vendor assessments and internal AI governance policies. Enterprise vendor questionnaires, client security reviews and internal AI policies cite it constantly, which means an Indian services firm or a freelance consultant working with US clients tends to meet the framework across a contract rather than a regulation. That’s a different kind of pressure from the one the EU AI Act risk levels<\/a> apply, and it usually arrives sooner, because a purchase order moves faster than a compliance deadline.<\/p>\n\n
\n\n