Is NIST AI RMF mandatory?

No. It is a voluntary framework. It is widely used as the reference control set for US AI governance programs, and customers and regulators often ask how an organization aligns to it.

Can we be certified against NIST AI RMF?

There is no certification for the AI RMF. If you need a certifiable standard, look at ISO/IEC 42001; the two are compatible, and our comparison explains how.

Is there an AI RMF 2.0?

NIST has signalled that a revision is under way, but no successor version has been published. Reports of a 2.0 draft could not be verified against NIST sources.

NIST AI RMF, as work you can assign. Govern, Map, Measure, Manage.

The NIST AI Risk Management Framework is voluntary, and it is the reference most US AI governance programs are built on. GhostAudit turns its four functions into records, assessments and a gap analysis.

Start 14-day trial

NIST AI Risk Management Framework · AI RMF 1.0

12 requirements

GOVERN 1	Policies and processes Policies, processes and practices for mapping, measuring and managing AI risk are in place and transparent.
GOVERN 2	Accountability structures Roles, responsibilities and lines of communication for AI risk are documented and staff are trained.
GOVERN 4	Risk-aware culture Teams consider and communicate AI risk; critical thinking and safety-first mindset are fostered.
GOVERN 6	Third-party risk Policies address risks from third-party software, data and AI supply chain.
MAP 1	Context is established Intended purpose, context of use, users and potential impacts are understood and documented.
MAP 3	Capabilities and benefits AI capabilities, targeted usage, goals and expected benefits and costs are understood.
MAP 5	Impacts characterised Likelihood and magnitude of impacts on individuals, groups and society are characterised.
MEASURE 1	Metrics identified Appropriate methods and metrics for the identified risks are selected and applied.
MEASURE 2	Trustworthiness evaluated The system is evaluated for validity, reliability, safety, security, fairness, privacy and explainability.
MEASURE 3	Risks tracked over time Mechanisms track identified risks and emergent risks during operation.
MANAGE 1	Risks prioritised and treated Risks are prioritised and responded to based on impact and likelihood.
MANAGE 4	Response and recovery Risk treatments, incident response, recovery and communication plans are documented and monitored.

Document: NIST AI 100-1
Released: 26 January 2023
Generative AI Profile: NIST AI 600-1, July 2024
Status: Voluntary framework

01The framework

Four functions that describe a complete program.

AI RMF 1.0 organizes AI risk management into four functions:

Govern: establish AI risk policies, roles and accountability.
Map: inventory AI systems and document their context, intended use and impacts.
Measure: assess and track AI risks, including validity, bias, security and privacy.
Manage: prioritize and treat risks, and monitor deployed systems.

The Generative AI Profile, NIST AI 600-1, adds risk actions specific to generative AI, covering confabulation, information integrity, intellectual property and data privacy.

The framework is voluntary and applies to any organization that designs, develops, deploys or uses AI. NIST has signalled that a revision is under way, but no successor version has been published; AI RMF 1.0 remains the current text.

02Map

Map starts with an inventory you can trust.

Map asks you to know your AI systems and their context. The hard part is completeness: the systems nobody registered are the ones that carry unexamined risk.

GhostAudit fills the inventory from discovery across code, SSO, browsers and desktops, then records for each system its purpose, usage context, data sensitivity, the people it affects and its owner. Real usage from the sensors sits next to what was declared, which is a useful check on both.

Example workspace. Names and figures are illustrative.

AI inventory

38 systems · 21 vendors

System	Owner	Data	Risk tier	Status
Candidate screening HireVue	People operations	Restricted	High	Sanctioned
ChatGPT Enterprise OpenAI	IT	Confidential	Limited	Sanctioned
Support assistant Intercom	Customer support	Confidential	Limited	Sanctioned
Claude Anthropic	Engineering	Internal	Limited	Under review
Cursor Anysphere	Unassigned	Confidential	Limited	Unsanctioned
Grammarly Grammarly	Marketing	Internal	Minimal	Sanctioned

03Measure and manage

Assess each system, then treat what you find.

The GhostAudit NIST AI RMF assessment covers categories from all four functions. For each system you record whether each category is met, partially met or a gap, with evidence and a remediation plan.

The AI risk assessment template adds a per-system risk register: likelihood and impact scoring, existing controls, residual risk and a dated treatment plan. Its regulatory basis includes MAP 4, MEASURE 1 to 3 and MANAGE 1, and the Generative AI Profile.

Manage is where gaps become work. Remediation plans carry owners and dates, and can be opened as Jira tickets so they are tracked where your teams already work.

Example workspace. The same assessment view is used for every framework.

Candidate screening · EU AI Act

High risk · Annex III

3 met · 2 partial · 1 gap

Art. 9	Risk management systemRisk register v4	Risk register v4	Met
Art. 10	Data and data governanceRemediation planned	Remediation planned	Partial
Art. 12	Record-keeping and logsJira GOV-212	Jira GOV-212	Gap
Art. 13	Transparency to deployersVendor documentation	Vendor documentation	Met
Art. 14	Human oversightRecruiter review step	Recruiter review step	Met
Art. 26	Deployer obligationsRemediation planned	Remediation planned	Partial

04Govern

Policies, roles and a report for the people accountable.

Govern is about the organization, not individual systems. GhostAudit supports it with documents and access controls:

an AI acceptable use policy generated from your approved systems and data classifications;
role-based access, from owner and admin to compliance manager, member and read-only viewer, so accountability in the tool matches accountability in the organization;
a board AI risk report with posture, top risks, programme status and decisions requested;
an audit log of every change.

The NIST AI RMF gap analysis template brings it together: an evidence-based rating of all 19 categories across the four functions, with a prioritized remediation plan.

AI acceptable use policy
Governance and policy · whole organization
Organization-wide rules for selecting and using AI: approved systems, data handling, prohibited uses, risk-tier controls, training and enforcement.
Basis: EU AI Act Art. 4, 5, 50; NIST AI RMF GOVERN 1-2; ISO/IEC 42001 A.2, A.9
AI risk assessment
Risk and impact · one system
Per-system risk register with likelihood x impact scoring, existing controls, residual risk and dated treatment plan.
Basis: NIST AI RMF MAP 4, MEASURE 1-3, MANAGE 1; NIST AI 600-1; ISO/IEC 42001 6.1.2; EU AI Act Art. 26
Board AI risk report
Inventory and reporting · whole organization
Board-level summary: posture rating, key metrics, top risks, programme status, regulatory horizon, decisions requested and 90-day plan.
Basis: NIST AI RMF GOVERN 2; ISO/IEC 42001 cl. 5, 9.3; EU AI Act timeline; Colorado SB 26-189; CCPA ADMT
NIST AI RMF gap analysis
Framework alignment · whole organization
Evidence-based rating of all 19 NIST AI RMF categories across GOVERN, MAP, MEASURE and MANAGE with a prioritised remediation plan.
Basis: NIST AI 100-1; NIST AI 600-1

Sources

Read the official texts

NIST AI RMF: official textnist.gov
NIST AI 600-1 (PDF)nvlpubs.nist.gov

Dates and statuses on this page were last checked against these sources on 10 November 2026. This is orientation, not legal advice.

FAQ

Questions

Is NIST AI RMF mandatory?: No. It is a voluntary framework. It is widely used as the reference control set for US AI governance programs, and customers and regulators often ask how an organization aligns to it.
Can we be certified against NIST AI RMF?: There is no certification for the AI RMF. If you need a certifiable standard, look at ISO/IEC 42001; the two are compatible, and our comparison explains how.
Is there an AI RMF 2.0?: NIST has signalled that a revision is under way, but no successor version has been published. Reports of a 2.0 draft could not be verified against NIST sources.

See what is in use before you decide anything.

Start a 14-day trial with every Govern feature, connect one discovery source and enroll a handful of devices. No card is needed to start, and nobody is asked to change how they work.

Start 14-day trial Talk to us See pricing