NIST AI RMF Explained Simply: Managing AI Risk Like a Restaurant

 The NIST AI Risk Management Framework (AI RMF) is a voluntary playbook for building and running AI responsibly, organized into four functions: Govern, Map, Measure and Manage. This post explains each one with a restaurant analogy, so you can use the framework without reading the full document.

The big idea: a health inspection for AI

Imagine you are opening a restaurant. Before serving a single plate, you would ask: is the kitchen safe, could anyone get food poisoning, and who answers if something goes wrong? The AI RMF asks the same questions about AI systems.

A risk framework is a shared language and process for answering three things: what could go wrong, how bad would it be, and what do we do about it? NIST, the US standards body behind it, published AI RMF 1.0 in January 2023 so that organizations of any size can talk about AI risk in the same terms.

Two things to know up front. It is voluntary, so no one can be "NIST AI RMF certified". And it is not a checklist you finish once: it is a cycle you keep running as your AI, your data and your users change.

The four functions at a glance

The framework's core is four functions. Govern sets the rules and runs underneath everything; Map, Measure and Manage are repeated as your AI changes. The example column follows one case through all four: a hospital using AI to read X-rays.

Govern: the restaurant owner

Govern answers "who is in charge here?" before anything else. It covers the culture, policies and accountability that decide how AI gets built and used, and NIST treats it as cross-cutting: it applies to the other three functions rather than coming first and ending.

Questions to ask:

• Who is accountable when an AI decision goes wrong?
• Which written policies guide how we build and buy AI?
• How do we make responsible AI the normal way of working, not an extra step?

Example: a bank adopts a rule that every AI loan decision must be explainable to the customer and audited each quarter. That one sentence assigns ownership, sets a standard and creates a check.

Map: the health inspector's survey

Map is about context. Before you build or buy, write down what the AI is supposed to do, who it touches and where it could hurt someone. Most AI incidents come from a gap here: a system used on people, or in conditions, its builders never considered.

Questions to ask:

• What is this system for, and what is it explicitly not for?
• Who are the affected users and communities, including people who never chose to use it?
• What could go wrong in this specific setting?

Example: a hospital notes that its X-ray AI will read scans of elderly patients, that a missed finding can delay cancer treatment, and that the model was trained mostly on data from one population. That is a map: a list of risks to test next.

Measure: the kitchen thermometer

Measure turns the worries from Map into numbers. A cook does not guess whether the chicken is cooked; they check the temperature. Likewise, test your AI for accuracy, bias, robustness and failure modes, and write down the results.

Questions to ask:

• How does performance differ across groups of people?
• How does it behave on unusual or adversarial inputs?
• How does it fail, and how often?

Example: the hospital finds its model is 94% accurate overall but only 78% accurate for patients over 75. The overall number hid the problem; the breakdown exposed it, and now there is a figure to act on.

Manage: the safety protocol board

Manage decides what to do about the risks you measured. For each one you can reduce it, accept it knowingly, transfer it, or stop the project. Then you keep watching, because the AI, its data and its users will drift.

Questions to ask:

• Which risks are highest priority, and what is the fix for each?
• Who monitors the system after launch, and what do they look for?
• What is our plan when something goes wrong?

Example: the hospital requires a radiologist to review every scan for patients over 70 until accuracy for that group passes 90%. It also assigns someone to track the numbers monthly, and writes down who can switch the system off.

The goal: seven traits of trustworthy AI

The four functions exist to help you build AI that has seven characteristics. These are NIST's own terms, shown here with a plain-English reading and a restaurant version.

Generative AI and what is changing in 2026

AI RMF 1.0 is still the current version, and NIST says it is being revised as part of the White House AI Action Plan, with no date given. Until the revision lands, cite 1.0 and check NIST's page before you publish anything that depends on the version.

Two companion pieces matter now:

• Generative AI Profile (NIST AI 600-1), published July 26, 2024. It maps suggested actions for generative AI back to Govern, Map, Measure and Manage, and names twelve risks that are unique to or made worse by generative AI. Confabulation (what most people call hallucination) and data privacy are two of them.
• Critical infrastructure profile: on April 7, 2026 NIST released a concept note for an AI RMF profile on trustworthy AI in critical infrastructure. It is a concept note, not a finished profile.

If you build with large language models, the practical move is to run the four functions on your system, then use the Generative AI Profile as the risk list for the Map and Measure steps.

Where to start: a first-month checklist

Start small: one AI system, four weeks, one action per function. Pick the system that could do the most harm if it failed.

• Govern: list every AI system and AI-powered vendor tool in use, and name one accountable owner for each.
• Map: write a one-page profile of your riskiest system covering its purpose, who it affects and the worst realistic failure.
• Measure: choose two or three measures, such as accuracy for each user group and the count of harmful outputs, and run the first test.
• Manage: decide when a human must review the output, who monitors it after launch, and who can switch it off.
• Review: put a 90-day re-check on the calendar, because the cycle only works if it repeats.

Sources

• NIST AI Risk Management Framework: release dates, revision notice and the critical infrastructure concept note.
• NIST AI 600-1, Generative AI Profile: the generative AI companion to the framework.