Official name: Artificial Intelligence Risk Management Framework, version 1.0
Citation: Version 1.0, released 26 January 2023
Year / status: Voluntary framework; under revision
What it does
The U.S. National Institute of Standards and Technology (NIST), a federal agency within the Department of Commerce, released version 1.0 of this framework on 26 January 2023, after a public request for information, several drafts and public workshops. Congress directed the work in the National Artificial Intelligence Initiative Act of 2020. The institute describes the framework as voluntary, rights-preserving, open to every sector and suited to any use of artificial intelligence (AI), for organisations of all sizes.
Where it applies / status
The framework is built around four functions. Govern creates a culture of risk management and runs through the other three. Map sets out the context and identifies the risks of a system. Measure uses quantitative and qualitative methods to analyse, assess and monitor those risks. Manage directs resources to the risks that have been mapped and measured, and plans how to respond to incidents. On 26 July 2024 the institute added a profile for generative AI, and on 7 April 2026 it released a concept note for a profile on trustworthy AI in critical infrastructure.
Documented benefits or intended effects
The framework gives organisations that design, develop, deploy or use AI systems a shared vocabulary for AI risk. Seven characteristics describe trustworthy AI: valid and reliable; safe; secure and resilient; accountable and transparent; explainable and interpretable; privacy-enhanced; and fair, with harmful bias managed. The institute supports it with companion material, including a practical guide, a roadmap and comparisons with other standards, and on 30 March 2023 it launched the Trustworthy and Responsible AI Resource Center to help organisations put the framework into practice.
Caveats
Using the framework is voluntary, and it creates no legal duties on its own. The institute states that version 1.0 is being revised as part of the White House AI Action Plan, so parts of it may change. The framework describes outcomes to aim for and leaves each organisation to choose its own methods, so two organisations can apply it very differently.
Sources
The framework page, version 1.0, and the generative profile.
- U.S. National Institute of Standards and Technology: AI Risk Management Framework
- U.S. National Institute of Standards and Technology: Artificial Intelligence Risk Management Framework, version 1.0 (NIST AI 100-1)
- U.S. National Institute of Standards and Technology: Generative Artificial Intelligence Profile (NIST AI 600-1)
- Wikimedia Commons: NIST Gaithersburg Newton Apple Tree (photo)
