Using the NIST AI RMF in a smaller business
Aranv’s short answer: the NIST AI Risk Management Framework is a voluntary guide, released January 26, 2023, for spotting and handling the risks of AI systems. It sorts the work under Govern, Map, Measure and Manage, and suits any business that wants a shared method without a certification to chase.
NIST published AI RMF 1.0 for voluntary use by any organization that designs, builds, deploys or uses AI. Nobody certifies against it. It describes outcomes rather than controls, and it frames trustworthy AI around accuracy and reliability, safety, security, accountability, explainability, privacy and fairness. The NIST AI RMF page links the framework, its Playbook and its profiles, and the core section explains the four functions in detail.
For generative AI, NIST added a Generative AI Profile on July 26, 2024, numbered NIST-AI-600-1. It names risks that apply to generative models, such as confabulated answers, data privacy and information security, and suggests actions under each function. NIST also says version 1.0 is under revision in line with the White House AI Action Plan, so check for a newer version before building a program around it.
The four functions at the core of the NIST AI RMF
Govern, Map, Measure, Manage
- 01 Govern Set roles, policies and accountability for AI risk across the business.
- 02 Map Describe each system’s purpose, users, data and who could be harmed.
- 03 Measure Test and track the mapped risks with methods you can repeat.
- 04 Manage Rank the risks, act on them and plan responses for failures.
Govern runs through the other three functions instead of happening once at the start.
The four functions of AI risk management
Each function is a set of outcomes to keep working on, not a checklist to finish once.
Govern: who owns risk
Name an owner for each AI system, write the policy staff follow, and decide who can approve a new tool or stop one that misbehaves.
Map: context per system
Record what the system is for, who uses it, which data it reads, who could be harmed and what happens when it gets something wrong.
Measure: repeatable tests
Check accuracy, bias, security and reliability with test sets and metrics you can rerun after every model or prompt change.
Manage: act and respond
Fix or formally accept each risk, monitor the system in use, and keep a rollback and incident plan for when outputs go wrong.
Applying the framework to one AI system
Take a support chatbot. Govern names the support manager as owner. Map lists the knowledge sources, customer data and failure cases. Measure tracks wrong answers and leaks on a fixed test set. Manage sets the rule for passing a chat to a person and for pulling the bot offline.
What we do
- One-page system profile
- Named owner and approver
- Fixed test set with pass marks
- Escalation and rollback rules
- Quarterly review notes
The Generative AI Profile in brief
NIST-AI-600-1 adapts the framework to generative models. It covers risks that matter for text and image tools, from made-up answers and leaked personal data to security weaknesses and copyrighted material, and maps suggested actions to each function so teams can pick what fits.
What we do
- Accuracy and confabulation checks
- Privacy and data leakage tests
- Prompt injection and security tests
- Intellectual property review
- Content provenance where needed
How we approach a project
A small firm does not need a committee to use the framework. Pick one AI system, such as a support chatbot or an invoice reader, and write its map. Then add tests through LLM evaluation and testing, adversarial checks from AI red teaming and a staff policy based on our AI acceptable use policy guide.
The framework also gives a shared vocabulary for laws. The EU AI Act guide and Colorado AI Act guide show where legal duties go further, and our AI governance consulting turns the four functions into owners, tests and records. Treat this guide as general background; it is not legal or compliance advice for your situation.
How we work
- Voluntary and adaptable to each use
- Start with one system
- Evidence over policy binders
Our Process
-
Choose a first system
Pick one AI tool in daily use where a wrong output would affect customers, staff or money.
-
Write its map
Document purpose, users, data sources, vendors, known limits and the people who could be affected.
-
Agree tests and thresholds
Decide which checks it must pass, how often they run and which result triggers a fix or a pause.
-
Review and repeat
Hold a short quarterly review, update the map after changes and add the next system once the first runs well.
How Aranv helps apply the framework
Starts from systems you run
We begin with the AI tools already in use and write their profiles, rather than drafting a policy library nobody reads.
Tests tied to real failures
Test sets come from your own documents, tickets and edge cases, so Measure reflects the mistakes that would actually hurt your business.
Controls built into the product
Escalation, logging and rollback are features of the software we build, which gives Manage something concrete to rely on.
Records your reviewers can read
Maps, test results and review notes are kept as plain documents that customers, insurers or regulators can follow.
Ready to act on this guide?
Ask our team in a 30-minute conversation.
Or see how we build it: Explore all services
NIST AI RMF questions
-
Is the NIST AI RMF mandatory?
No. NIST describes it as intended for voluntary use. Customers, contracts or regulators may point to it, and some state laws have referred to recognized risk frameworks, but the framework itself places no legal duty on a business.
-
Can a company be certified against the NIST AI RMF?
NIST does not certify organizations against the AI RMF. An auditor may assess your practices against it, but that is their opinion, not a NIST certificate. ISO/IEC 42001 is a separate management system standard that can be certified if you need a certificate.
-
What are the four functions of the AI RMF?
Govern, Map, Measure and Manage. Govern sets culture, roles and policies and runs through the rest. Map frames the context and risks of a specific system, Measure analyzes and tracks them, and Manage prioritizes and acts on them.
-
How does the NIST AI RMF apply to chatbots and generative AI?
Use the Generative AI Profile, NIST-AI-600-1, alongside the framework. For a chatbot that means tests for wrong answers, data exposure and prompt injection before launch, monitoring afterwards and a clear rule for handing a conversation to a person.
-
Is the AI RMF being updated?
Yes. NIST’s framework page says version 1.0 is going through a revision tied to the federal AI Action Plan. Until a new version appears, version 1.0, its Playbook and the Generative AI Profile remain the references to use.
Let’s talk about your next step
Contact Aranv to discuss your workflow, current tools, and goals. Meet with our team or send an inquiry.
Book a meeting with our team
Choose an available date and time for a 30-minute conversation about your project.
Tell us about your project
Share a few details so we can discuss a useful next step.
Prefer email? sales@aranv.com