Article FR-1. Understanding and Addressing Risks, Impacts, and Harms

3 obligations

NIST-RMF-FR-1-01 Risk Management

Understand and manage AI system risks

Organizations must understand and manage the risks of AI systems to enhance trustworthiness and cultivate public trust t

NIST-RMF-FR-1-02 Risk Management

Manage AI risks across system lifecycle

Organizations must manage AI risks that can emerge at design and development, deployment, or in ongoing use and maintena

NIST-RMF-FR-1-03 Risk Management

Address AI risks at multiple organizational levels

Organizations must address AI risks that can emerge at individual, organizational, or societal levels to prevent negativ

Article GV-1. Policies, Processes, Procedures, and Practices

2 obligations

NIST-RMF-GV-1-03 Risk Management

Establish processes to determine risk management activity levels

Organizations must establish processes, procedures, and practices to determine the appropriate level of risk management

NIST-RMF-GV-1-08 Risk Management

Implement comprehensive AI risk governance framework

Organizations must establish and effectively implement transparent policies, processes, procedures, and practices across

Article GV-3. Workforce Diversity, Equity, Inclusion, and Accessibility

1 obligation

NIST-RMF-GV-3-01 Risk Management

Diverse Team Decision-Making for AI Risk Management

Organizations must ensure that decision-making processes related to mapping, measuring, and managing AI risks throughout

Article GV-4. Organizational Culture of AI Risk

1 obligation

NIST-RMF-GV-4-01 Risk Management

Establish AI Risk-Aware Organizational Culture Policies

Organizations must establish and maintain policies and practices that foster a critical thinking and safety-first mindse

Article GV-6. Third-Party AI Risks and Supply Chain

3 obligations

NIST-RMF-GV-6-01 Risk Management

Third-Party AI Risk Management Policies

Organizations must establish and maintain policies and procedures specifically designed to address AI risks and benefits

NIST-RMF-GV-6-02 Risk Management

Third-Party Intellectual Property Risk Policies

Organizations must implement policies and procedures that specifically address AI risks associated with third-party enti

NIST-RMF-GV-6-03 Risk Management

High-Risk Third-Party AI System Contingency Processes

Organizations must establish contingency processes specifically designed to handle failures or incidents that occur in t

Article MP-3. AI Capabilities, Usage, Goals, Benefits, and Costs

1 obligation

NIST-RMF-MP-3-02 Risk Management

Document potential costs including non-monetary costs from AI errors

Organizations must examine and document potential costs, including non-monetary costs, which result from expected or rea

Article MP-4. Third-Party Component Risks and Benefits

4 obligations

NIST-RMF-MP-4-01 Risk Management

Map risks and benefits of all AI system components including third-party elements

Organizations must comprehensively map and document the risks and benefits associated with all components of their AI sy

NIST-RMF-MP-4-02 Risk Management

Implement approaches for mapping AI technology and legal risks of components

Organizations must establish, implement, follow, and document specific approaches and methodologies for mapping AI techn

NIST-RMF-MP-4-03 Risk Management

Map and document third-party intellectual property infringement risks

Organizations must identify, assess, and document risks of infringing third parties' intellectual property rights or oth

NIST-RMF-MP-4-04 Risk Management

Identify internal risk controls for AI system components

Organizations must identify and establish internal risk control mechanisms specifically designed to manage risks associa

Article MS-1. Appropriate Methods and Metrics

2 obligations

NIST-RMF-MS-1-01 Risk Management

Select and implement measurement approaches for AI risks starting with most significant

Organizations must identify and select appropriate approaches and metrics for measuring AI risks that were enumerated du

NIST-RMF-MS-1-05 Risk Management

Consider potential impacts on affected communities in assessments

Organizations must include consideration of potential impacts on affected communities when regularly assessing the appro

Article MS-2. Trustworthy Characteristics Evaluation

2 obligations

NIST-RMF-MS-2-08 Risk Management

Regularly Evaluate AI System for Safety Risks

Organizations must evaluate the AI system regularly for safety risks as identified in the MAP function.

NIST-RMF-MS-2-13 Risk Management

Examine Transparency and Accountability Risks

Organizations must examine risks associated with transparency and accountability as identified in the MAP function.

Article MS-3. Risk Tracking Mechanisms

3 obligations

NIST-RMF-MS-3-01 Risk Management

Establish AI Risk Tracking Mechanisms

Organizations must implement and maintain mechanisms for tracking identified AI risks over time, ensuring continuous mon

NIST-RMF-MS-3-02 Risk Management

Implement Regular AI Risk Identification and Tracking

Organizations must establish approaches, assign personnel, and maintain documentation to regularly identify and track ex

NIST-RMF-MS-3-03 Risk Management

Consider Risk Tracking for Difficult-to-Assess Settings

Organizations must consider and implement risk tracking approaches specifically for settings where AI risks are difficul

Article MS-4. Measurement Efficacy Feedback

1 obligation

NIST-RMF-MS-4-01 Risk Management

Connect AI Risk Measurement to Deployment Context with Expert Consultation

Organizations must connect their measurement approaches for identifying AI risks to the specific deployment context(s) a

Article MG-1. Risk Prioritization and Response

3 obligations

NIST-RMF-MG-1-01 Risk Management

Determination of AI System Purpose Achievement and Deployment Decision

Organizations must determine whether their AI system achieves its intended purposes and stated objectives, and decide wh

NIST-RMF-MG-1-02 Risk Management

AI Risk Treatment Prioritization

Organizations must prioritize the treatment of documented AI risks based on their impact, likelihood, and available reso

NIST-RMF-MG-1-03 Risk Management

High Priority Risk Response Development and Documentation

Organizations must develop, plan, and document responses to AI risks identified as high priority by the MAP function. Ri

Article MG-2. Strategies for Benefits and Impact Management

2 obligations

NIST-RMF-MG-2-02 Risk Management

Account for AI Risk Management Resources and Alternative Systems

Organizations must take into account the resources required to manage AI risks and consider viable non-AI alternative sy

NIST-RMF-MG-2-04 Risk Management

Establish Procedures for Unknown Risk Response and Recovery

Organizations must follow established procedures to respond to and recover from previously unknown risks when they are i

Article MG-3. Third-Party AI Risk Management

1 obligation

NIST-RMF-MG-3-01 Risk Management

Monitor and control third-party AI risks and benefits

Organizations must regularly monitor AI risks and benefits from third-party resources, apply appropriate risk controls,