What it is

The NIST AI Risk Management Framework (AI RMF 1.0) was released on 26 January 2023 after an open, consensus-driven process. It is a voluntary framework, not a regulation. It organizes AI risk management into four functions:

FunctionPurpose
GovernCulture, policies, accountability
MapContext and risk identification
MeasureAnalysis, assessment, tracking
ManagePrioritizing and acting on risks

Companion resources include the AI RMF Playbook, Roadmap, Crosswalks, and Perspectives, hosted in the Trustworthy and Responsible AI Resource Center (launched 30 March 2023).

The key point: the AI RMF is not a legal obligation. Some laws refer to it, though. For example, Colorado’s 2024 AI Act offered an affirmative defense for following a recognized framework such as the AI RMF (that law has since been replaced; see the Colorado article).

Revision under way

  • America’s AI Action Plan (23 July 2025) assigned NIST many tasks.
  • NIST’s AI RMF page now states: “The AI RMF 1.0 is being revised as part of the White House AI Action Plan.”
  • NIST’s March 2026 update says the revision will “eliminate references to misinformation, Diversity, Equity, and Inclusion, and climate change”, and lists the revised framework as upcoming with no date.
  • On 7 April 2026 NIST released a concept note for an AI RMF Profile on Trustworthy AI in Critical Infrastructure.

We found no published revised framework as of 26 October 2026.

Reuse terms

Under 17 U.S.C. 105, works of the US Government are not protected by copyright. NIST says information on its sites is public unless marked as copyrighted, and asks for credit on bylines, photos, and images. Some material carries its own disclaimers, and third-party content keeps its rights.

Using the AI RMF in AI and RAG

  1. Index AI RMF 1.0 with its date and add a status note: “revision under way”.
  2. Index the Playbook separately, tagged by function and subcategory.
  3. Plan to re-index when the revised framework is published, and keep 1.0 for audits.
  4. Keep framework text apart from legal requirements so answers never present it as mandatory.
  5. Credit NIST and check any third-party figures.

Common mistakes

  • Describing the AI RMF as a federal requirement.
  • Assuming the revision is final.
  • Mixing Playbook suggestions with core framework outcomes.
  • Reusing third-party images from NIST documents without checking rights.

Checklist

  • AI RMF 1.0 indexed with date and status
  • Playbook tagged by function
  • Re-index plan for the revision
  • Framework separated from legal layer
  • Credit and third-party checks

How AskDona helps

AskDona maps your AI policies, model cards, and risk registers to the four AI RMF functions and shows the evidence for each outcome, ready to re-run when the revised framework lands.

Run a sample AI RMF gap check

AskDona shows the evidence; your AI risk team decides.

Editor’s note. This article is general information, not legal advice. The “conditions to check” rating comes from our source list and is a first-pass judgment, not a legal opinion.

FAQ

Is the NIST AI RMF mandatory? No. It is voluntary.

Is NIST revising the AI RMF? Yes. NIST says it is being revised under the AI Action Plan; no revised version had been published as of October 2026.

What are the four functions? Govern, Map, Measure, and Manage.

Can I put the AI RMF into a commercial AI tool? Generally yes, as a US Government work, with NIST credit and checks for third-party content.

References

All pages opened and checked by October 26, 2026.

SourceWhat it supports
NIST: AI Risk Management FrameworkRelease date, functions, revision statement, concept note
NIST: AI update, March 2026 (PDF)Revision plans
NIST: Copyrights and disclaimersReuse terms
17 U.S.C. 105 (LII)No copyright in US Government works