NIST AI Risk Management Framework 1.0

• Authority: National Institute of Standards and Technology
• Parent authority: Federal government
• Jurisdiction: United States
• Collections: Editors' Picks;U.S. regulations, executive orders, and agency policies
• Most recent activity: Enacted
• Most recent activity date: 2023-01-26

Risk subdomain coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the risk subdomain are explicitly described.

• Unfair discrimination and misrepresentation
• Unequal performance across groups
• Compromise of privacy
• AI system security vulnerabilities
• Overreliance and unsafe use
• Governance failure
• AI pursuing its own goals
• Lack of capability or robustness
• Lack of transparency or interpretability

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the risk subdomain are described.

• False or misleading information
• Loss of human agency and autonomy
• Environmental harm

All other risk subdomains had no coverage in this document.

Risk Coverage Summary

The document has good coverage of approximately 15-17 subdomains, with strong focus on AI system safety failures (7.1, 7.2, 7.3, 7.4), privacy and security (2.1, 2.2), discrimination and fairness (1.1, 1.3), governance (6.5), and human-computer interaction (5.1, 5.2). Coverage is concentrated in technical AI safety, trustworthiness characteristics, and governance frameworks.

Sector coverage

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the sector are described.

• Trade, Transportation & Utilities
• Health Care & Social Assistance

All other sectors had no coverage in this document.

Sectors Summary

This framework is sector-agnostic and applies broadly across all industries. It explicitly mentions healthcare and transportation as examples of safety-critical applications, but provides governance guidance applicable to any sector deploying AI systems. The framework is designed to be adapted to different sectoral contexts.

Legislative Status

Soft Law

Legislative Status Summary

This is a voluntary framework with non-binding guidance and recommendations. The document explicitly states it is voluntary and uses predominantly voluntary language ('should', 'can', 'may') with no enforcement mechanisms or legal penalties.

Actors

Proposer

• Entity Types: AI_Governance_Actor
• Entities: National Institute of Standards and Technology (NIST)
• Summary: NIST is the authoring organization of this framework, as indicated in the document title and throughout the text. NIST is a U.S. government agency that develops standards and guidelines.

Target

• Entity Types: AI_Developer, AI_Deployer
• Summary: The framework targets organizations that design, develop, deploy, evaluate, or acquire AI systems. The document repeatedly references 'AI actors' including developers, deployers, and organizations throughout the AI lifecycle.

Enforcer

• Summary: The framework is voluntary and does not establish enforcement mechanisms or designate enforcement bodies. Organizations self-implement based on their own risk management needs.

Monitor

• Entity Types: AI_Developer, AI_Deployer
• Summary: The framework places monitoring responsibilities on the organizations themselves that develop and deploy AI systems. Internal monitoring, assessment, and review processes are described throughout, with organizations responsible for their own compliance.

AI Lifecycle Stages

Lifecycle stages covered by the documents, as defined in the OECD Framework for the Classification of AI Systems

• Plan and Design
• Collect and Process Data
• Build and Use Model
• Verify and Validate
• Deploy
• Operate and Monitor

AI Lifecycle Summary

The document comprehensively covers all AI lifecycle stages from planning through monitoring. It explicitly structures its core framework around lifecycle stages with detailed guidance for Plan and Design (MAP function), Data Collection (MAP 2.3), Model Building (MEASURE function), Verification and Validation (MEASURE 2), Deployment (MANAGE 1.1), and Operation and Monitoring (MANAGE 4.1).

Technical Scope

Terms relating to technical scope that are mentioned or implicitly referenced in the document

• AI Models
• AI Systems
• Generative AI
• Predictive AI

Technical Scope Summary

The document extensively covers AI models and AI systems as core concepts throughout. It does not explicitly mention frontier AI, general purpose AI, task-specific AI, foundation models, or compute thresholds. It implicitly covers both generative and predictive AI through references to different model types. Open-weight models are not explicitly mentioned.