Skip to content
The Tell
← AI & technology

Framework · U.S. National Institute of Standards and Technology (NIST)

NIST AI Risk Management Framework (AI RMF 1.0)

A free, voluntary framework to govern, map, measure and manage AI risks — widely used as a practical AI control baseline.

Go to the official source ↗

Our summary

NIST published the AI Risk Management Framework (NIST AI 100-1) in January 2023. It is voluntary and free to use in any country and sector.

It is built around four functions: Govern (policies, roles and culture), Map (understand the context and risks of each AI system), Measure (test and track risks such as bias, errors and security) and Manage (act on the risks and monitor them). NIST also publishes a Playbook and a profile for generative AI.

How auditors use it: Use the four functions as the structure of an AI governance audit, and as a benchmark when an organisation says it “manages AI risk”.

More in AI & technology

2026 Anti-Fraud Technology Benchmarking Report

Survey data showing how organizations use AI and other technology against fraud, and how criminals now use deepfakes and GenAI, so you can benchmark your own anti-fraud program.

Achieving Effective Internal Control Over Generative AI (GenAI)

COSO shows how to apply its Internal Control framework to generative AI, with control expectations and metrics auditors can test.

Cybersecurity Topical Requirement

Since 5 February 2026, every IIA-conforming audit of cybersecurity must cover a mandatory minimum baseline of governance, risk management and controls.