SECAI Core · phase 8 of 15 · noun

NIST AI Risk Management Framework (AI RMF)

A voluntary, structured guideline created to help organizations understand, evaluate, and manage risks associated with artificial intelligence systems

The Explain card

Plain English
The NIST AI RMF is a voluntary, structured guideline that helps organisations understand, evaluate and manage the risks that come with AI systems.
Example
A healthcare provider adopting a diagnostic model uses the framework's core functions (Govern, Map, Measure, Manage) to assign accountability, map where the model could cause harm, measure its accuracy and bias, and put mitigations and monitoring in place before go-live.
Why it matters
It gives defenders a common vocabulary and a repeatable process for AI risk, which makes it easier to justify controls, compare systems, and show regulators a recognised approach.
Hook
Govern, Map, Measure, Manage: the four verbs of AI risk.

Word knowledge

How the word is built, where it came from, and what it sits beside in memory.

In a sentence

The hospital's go-live checklist for a diagnostic model requires NIST AI Risk Management Framework Map and Measure records before the system reaches the ward.

Why these words
  • NIST English initialism, 1988, for National Institute of Standards and Technology, the renamed National Bureau of Standards (1901) names the issuing house, so the title belongs to a US standards body rather than to a statute
  • AI English initialism of artificial intelligence, coined by John McCarthy in 1955 from Latin artificialis, of art, and intelligentia, understanding narrows the work to machine systems that act as if they think
  • Risk French risque, from Italian rischio, of uncertain further origin supplies the hazard noun, so the work is about chance of harm
  • Management Italian maneggiare, to handle a horse, from Latin manus, hand names the handling, so those hazards are steered rather than only listed
  • Framework English frame plus work; frame from Old English framian, to be of use, work from Old English weorc, labor supplies the head noun, the scaffold the handling sits in
Where it came from
Origin
English institutional title, from the 1988 initialism NIST (National Institute of Standards and Technology), the 1955 coinage AI, and the older English collocation risk management framework
Entered the language
2021
What changed
Risk had meant a maritime or trade hazard. Management had meant handling a horse, then running a concern. The pair risk management named a mid-century corporate practice. Framework had meant a timber skeleton, then any supporting structure. NIST used Risk Management Framework in 2010 for federal information systems and Cybersecurity Framework in 2014 for a policy scaffold. In 2021 it attached AI to that scaffold; version 1.0 in 2023 made the five-word title the ordinary name of that playbook and of the short form AI RMF.
How it is spelled
Pattern
NIST and AI stay all-caps as initialisms, even mid-sentence
Pattern
framework is a closed compound of two free English stems
Pattern
-ment turns a verb into a noun of result
Breaks the pattern
NIST is said as a word, while AI is spelled letter by letter
Breaks the pattern
the catalog short form is AI RMF with spaces, not a jammed NAIRMF
Breaks the pattern
the five-word title stays unhyphenated; only AI RMF sits in parentheses after it

Spelled like

  • ISO
  • OECD
  • network
  • assessment
Broken into chunks
  • risk
    • risky
    • riskless
    • at-risk
  • manage
    • manager
    • mismanage
    • unmanageable
  • ment
    • assessment
    • treatment
    • document
  • frame
    • framer
    • framed
    • framework
  • work
    • network
    • workshop
    • homework
What it sits beside

Same subject

Same shape

  • NIST Cybersecurity Framework
  • NIST Privacy Framework
  • NIST Risk Management Framework

NIST framework titles

  • NIST Cybersecurity Framework
  • NIST Privacy Framework
  • NIST Risk Management Framework

AI governance instruments

Short forms of this title

  • AI RMF
  • AI RMF 1.0

Where it sits in the deck

Phase 8: Governance, Risk, and Compliance Frameworks

Individual controls need a governance envelope — introduce the risk and compliance structures, standards bodies, and regulations that frame AI accountability at scale.

Neighbours in this phase