Skip to main content
AI Governance

NIST AI RMF — Govern, Map, Measure and Manage AI Risk

The NIST AI Risk Management Framework is a voluntary framework for managing the risks of AI systems. Its four functions — Govern, Map, Measure and Manage — and the Generative AI Profile give organisations a practical structure for trustworthy, secure AI.

Mutex Systems uses the AI RMF with ISO 42001 to build AI governance that also satisfies EU AI Act expectations.

Request a ConsultationAll Frameworks & Standards
Category
Compliance Framework
Jurisdiction
United States
Issuing Body
NIST
Current Version
AI RMF 1.0 (NIST AI 100-1, January 2023) with the Generative AI Profile (NIST AI 600-1, July 2024)
Who It's For
Organisations building or using AI, especially US-facing businesses and teams that want a recognised AI risk method before or alongside ISO 42001 certification.
Read the official source
What It Covers

Core Domains

Govern — policies, accountability and culture
Map — context, intended use and impacts
Measure — testing, evaluation and metrics
Manage — prioritising and treating AI risks
Trustworthiness: valid, safe, secure, accountable, explainable, privacy-enhanced and fair
Generative AI Profile risks such as confabulation, data privacy and information security
How It Works

A Practical Compliance Path

  1. 01

    Govern

    AI policy, roles and an AI system inventory.

  2. 02

    Map

    Context and impact for each AI system.

  3. 03

    Measure

    Testing, including security testing against OWASP and MITRE ATLAS.

  4. 04

    Manage

    Treatment, monitoring and incident handling for AI risks.

Our Approach

One AI governance system, three frameworks

We map AI RMF, ISO 42001 and the EU AI Act together so one set of policies and evidence serves all three.

  • AI inventory and impact assessment
  • Security testing of AI systems
  • Crosswalk to ISO 42001 and EU AI Act
View Cybersecurity Services

Related Pages

Compliance, Continuously

AI risk next to every other risk

grComply’s AI governance area keeps AI systems, impacts and risks with the rest of your GRC programme, and maps AI RMF to ISO 42001 and the EU AI Act.

  • AI system register and impact assessments
  • AI risks in the main risk register
  • Mapping set linking AI RMF, ISO 42001, ISO 27001 and OWASP LLM risks
  • Human-oversight evidence

grComply is Mutex Systems' own multi-tenant GRC automation platform — the framework library, hybrid scanning, risk and audit workflow, and AI-assisted compliance behind every point above are live in production today.

See How grComply Works
FAQs

Common Questions About NIST AI RMF

Is the NIST AI RMF mandatory?

No, it is voluntary. It is widely used as a reference and complements certifiable standards such as ISO 42001.

What is NIST AI 600-1?

The Generative AI Profile, published in July 2024, which applies the AI RMF to risks specific to generative AI.

Should we use NIST AI RMF or ISO 42001?

Often both: AI RMF provides a practical risk method; ISO 42001 provides a certifiable management system. We map them so the work is done once.

Let's Talk

Ready to Start Your NIST AI RMF Programme?

Send us your current posture and timeline. Within two working days you will receive a written response and a proposed scoping call.

No commitment requiredResponse within 2 working daysConfidential brief handling
Request a ConsultationView Client Portfolio