AI Risk Management Framework

18 OCT 2022
a

To promote U.S. innovation and industrial competitiveness by advancing 

measurement science, standards, and technology in ways that 

enhance economic security and improve our quality of life

NIST's Mission
Artificial Intelligence (AI) is rapidly transforming our world. New AI-enabled systems 

are revolutionizing and benefitting nearly all aspects of our society and economy –

everything from commerce and healthcare to transportation and agriculture. But its 

development and use are not without challenges and risks. 

3
NIST AI Program

CONDUCT FOUNDATIONAL 

RESEARCH TO ADVANCE 

TRUSTWORTHY AI TECHNOLOGIES

ADVANCE AI RESEARCH AND 

INNOVATION ACROSS NIST’S

LABORATORY PROGRAMS

PARTICIPATE AND LEAD IN 

DEVELOPING STANDARDS TO 

ADVANCE AI INNOVATION 

CONTRIBUTE NIST’S TECHNICAL 

EXPERTISE TO DISCUSSIONS AND 

DEVELOPMENT OF POLICIES

ENSURE NIST HAS RESOURCES 

AND EXPERTISE TO CARRY OUT 

ITS AI PROGRAMS

ESTABLISH BENCHMARKS AND 

DEVELOP METRICS TO EVALUATE 

AI TECHNOLOGIES 

4
Key NIST Roles for the Federal Government

NIST AI RISK MANAGEMENT 

FRAMEWORK

NATIONAL AI ADVISORY 

COMMITTEE

FEDERAL AI STANDARDS 

COORDINATOR

INTERAGENCY COORDINATION

WH OSTP/NSTC, TTC, QUAD

STAKEHOLDER OUTREACH

AI RESEARCH RESOURCE TASK 

FORCE

5
Trustworthy and Responsible AI @ NIST

Cultivate trust in the design, 

development, use and governance 

of artificial intelligence 

technologies and systems. 

Development of AI Risk 

Management

Establishing National AI 

Advisory Committee 

AI Research, Standards and 

Evaluation

6
AI RMF: 

Managing Risk Through Trustworthy and Responsible AI

What

- Address risks to individuals, communities, 

organizations, and society

- Congressionally mandated, living 

document for voluntary use 

- Maximize positive impacts, minimize 

potential negative impacts

- Rights-preserving, aims to operationalize 

values

- Law and regulation agnostic

How

- Developed in an open, transparent, 

collaborative process (ongoing)

- Outcome based

- Across context and use cases

- Trustworthy characteristics

- Responsible practices and culture 

(consideration of impacts)

- Inclusive and equitable 

7
Jul 29, 2021

RFI seeking input 

Oct 19-21, 2021

NIST AI RMF workshop #1

• Comments until Sept 15, 2021

• 106 sets of input 

• Analysis of responses released 

on Oct 15, 2021.

8

Dec 13, 2021

AI RMF Concept Paper

Mar 17, 2022

AI RMF 1st Draft

• Comments until Jan 25, 2022

• 60 sets of input 

• Listening sessions

• Comments until Apr 29, 2022

• 95 sets of input 

• Bias in AI paper released Mar 14, 

2022

Mar 29-31, 2022

NIST AI RMF workshop #2

Aug 18, 2022

AI RMF 2nd Draft

• Comments on AI RMF and Playbook 

until Sept 29, 2022

• Call for contributions towards Profiles 

• 77 sets of input

Oct 18-19, 2022

NIST AI RMF workshop #3

Jan 2023

AI RMF 1.0

AI RMF Timeline and Engagements

• Explainable AI paper 

released Sept 29, 2021

8
Transforming Culture – Socio-technical Systems Approach

Broaden 

Perspectives

Organization

al Buy-in & 

Governance

Scientific 

Integrity

Limitation

⎻ Manage risk within/connected to specific 

operational context

• utilize broader set of perspectives and expertise

• apply human-centered design to AI systems

⎻ Apply the scientific method to AI systems

⎻ Set up governance structures for the people who 

build and maintain AI systems

⎻ Consideration of limitations from an impact and 

values-based perspective

Takes into consideration the larger social context in which AI 

operates, its purpose and potential impacts

9
At A Glance

10
Maximize Positive Impacts 

Minimize Potential Negative Impacts 

Risk refers to the composite measure of 

an event’s probability of occurring and 

the consequences of the corresponding 

events. The impacts, or consequences, of 

AI systems can be positive, negative, or

both and can result in opportunities or 

threats. 

(Adapted from: ISO 31000:2018).

Risk Management refers to coordinated 

activities to direct and control an 

organization with regard to risk.

(Source: ISO 31000:2018).

Risk tolerance refers to the organization’s 

or stakeholder’s readiness or appetite to 

bear the risk in order to achieve its 

objectives. Risk tolerance can be 

influenced by legal or regulatory 

requirements. While the AI RMF can be 

used to prioritize risk, it does not 

prescribe risk tolerance.

(Adapted from: ISO Guide 73).

11

Risk Measurement (quantitively or 

qualitatively) is difficult, particularly for AI 

risks and impacts that are not welldefined or adequately understood. 
Audience

AI Designers

AI Developers

AI Deployers

AI Procurers

AI Operators

Third-party Entities

Organizational Management, Senior Leadership

End Users

Affected Individuals/Communities

12
13

Trustworthy AI Characteristics 

Trustworthy AI systems should achieve a high degree of control over risk while retaining a high 

level of performance quality. Achieving this difficult goal requires a comprehensive approach to 

risk management, with tradeoffs among the trustworthiness characteristics.
AI Risk Management Framework Core

Govern

A culture of risk 

management is 

cultivated and 

present

Map

Context is 

recognized and 

risks related to 

the context are 

identified

Measure

Identified risks 

are assessed, 

analyzed, or 

tracked 

Manage

Risks are prioritized 

and acted upon 

based on a 

projected impact

14

Transforming Culture - Socio-technical approach takes into consideration the larger social 

system in which AI operates, its purpose and potential impacts
GOVERN-1: Policies, processes, procedures, and practices across the 

organization related to the mapping, measuring, and managing of AI 

risks are in place, transparent, and implemented effectively.

GOVERN-2: Accountability structures are in place so that the 

appropriate teams and individuals are empowered, responsible, and 

trained for mapping, measuring, and managing AI risks.

GOVERN-3: Workforce diversity, equity, inclusion, and accessibility 

processes are prioritized in the mapping, measuring, and managing 

of AI risks throughout the lifecycle.

GOVERN-4: Organizational teams are committed to a culture that 

considers and communicates risk.

GOVERN-5: Processes are in place for robust stakeholder 

engagement.

GOVERN-6: Policies and procedures are in place to address AI risks 

arising from third-party software and data and other supply chain 

issues.

GOVERN

Categories in AI RMF GOVERN Function
MAP

Categories in AI RMF MAP Function
MEASURE

MEASURE-1: Appropriate methods and 

metrics are identified and applied.

MEASURE-2: Systems are evaluated for 

trustworthy characteristics.

MEASURE-3: Mechanisms for tracking 

identified risks over time are in place. 

MEASURE-4: Feedback about efficacy of 

measurement is gathered and assessed.

Categories in AI RMF MEASURE Function
MANAGE

MANAGE-1: AI risks based on impact assessments and 

other analytical output from the Map and Measure 

functions are prioritized, responded to, and managed.

MANAGE-2: Strategies to maximize benefits and minimize 

negative impacts are planned, prepared, implemented, and 

documented, and informed by stakeholder input. 

MANAGE-3: Risks from third-party entities are managed.

MANAGE-4: Responses to identified and measured risks 

are documented and monitored regularly.

Categories in AI RMF MANAGE Function
19
AI RMF Profiles

Use-case profiles

• Instantiations of the AI RMF functions, 

categories, and subcategories for a 

certain application or use case based 

on the requirements, risk tolerance, 

and resources of the Framework user. 

Temporal profiles

• descriptions of either the current state or 

the desired, target state of specific AI risk 

management activities within a given 

sector, industry, organization, or 

application context

NIST welcomes contributions towards development of AI RMF use case 

profiles as well as current and target profiles.

20
Crosswalks

21
NIST AI RMF Related Resources

AI RMF 

PLAYBOOK 

AI RMF 

PROFILES 

AI RMF 

GLOSSARY

AI STANDARDS 

HUB 

AI METRICS 

HUB

...AND MORE 

22
What’s Next?

AI RMF 

Profile(s)

Work with 

SDOs on AI 

standards

AI 

evaluations 

and 

Test beds

Evaluations of 

AI RMF 

effectiveness

Trustworthy 

AI Resource 

Center 

Crosswalks to 

other 

standards, 

frameworks, 

etc.

And more ...
THANK YOU

Contact us via email at

aiframework@nist.gov

For more info on the NIST AI RMF, visit 

https://www.nist.gov/itl/ai-riskmanagement-framework

24

24