The NIST AI Risk Management Framework (AI RMF) is a voluntary guide from the US National Institute of Standards and Technology for managing the risks AI creates for people, organisations and society. It is not a law and not a certification. Auditors use it as a set of reference criteria for asking whether an organisation governs its AI sensibly.
Last reviewed: 17 October 2026. Facts checked. We opened NIST's AI RMF page at nist.gov. It states that AI RMF 1.0 was released on 26 January 2023, that the framework is voluntary, that NIST published a Generative AI Profile (NIST-AI-600-1) on 26 July 2024, and that the framework is being revised under the White House AI Action Plan. That page names Govern, Map, Measure and Manage only in an image caption. We did not open the framework document itself, so our one-line descriptions of the four functions are a plain-English summary, not NIST's wording. Check the document before citing it.
What it is, and what it is not
| It is | It is not |
|---|---|
| A voluntary framework | A law or regulation |
| Sector-neutral guidance | An audit standard like an SA or ISA |
| A common vocabulary for AI risk | A certification you can obtain |
| Updated over time | A fixed checklist |
Because it is voluntary, nobody "passes" the AI RMF. An organisation can say it aligns with it, and an auditor can test whether that claim is true.
The four functions in plain English
NIST organises the framework around four functions. These are our summaries.
- Govern. Set up accountability, policies, roles and a risk culture. This sits underneath everything else.
- Map. Understand each AI system's context: purpose, users, data, and who could be affected.
- Measure. Test and track the system: accuracy, bias, reliability, security, and how those change.
- Manage. Act on what you found: prioritise risks, treat them, respond to incidents and improve.
For a finance team the cycle is easy to picture. Govern says who owns the AI that reads invoices. Map lists what it reads and who relies on it. Measure checks its error rate on known samples. Manage decides what to do when the rate rises.
The Generative AI Profile
Most finance staff now meet AI through generative tools. NIST's Generative AI Profile, published on 26 July 2024, is a companion to the framework. NIST describes it as helping organisations identify risks unique to generative AI and suggesting risk management actions aligned with their goals. Useful for any team that uses chat-style tools on client or company data. We have not opened the profile itself.
How an auditor can use it
Use the framework as criteria, the way you might use a control framework for an IT review.
Step 1: Scope
Pick one AI system or use case that matters to the financial statements, to controls or to client confidentiality.
Step 2: Ask four sets of questions
| Function | Questions to ask | Evidence to request |
|---|---|---|
| Govern | Who owns it? Is there a policy? | Policy, role list, approvals |
| Map | What does it do, with which data? | System description, data flow, inventory |
| Measure | How is accuracy tested? How often? | Test results, error logs, review samples |
| Manage | What happens when it fails? | Incident log, fixes, review minutes |
Step 3: Test, do not just read
A policy is not a control. Ask to see a recent test, a logged incident, an approval. Try to reperform one AI output from its logged inputs.
Step 4: Report in your own scope
Say which parts you reviewed and what you relied on. If you are issuing an opinion on financial statements, AI governance is context for your risk assessment, not a replacement for your audit standards. If you are doing an internal audit or advisory review, the framework can structure the engagement. Our AI governance workpaper gives a starting layout.
NIST AI RMF, ISO 42001 and the EU AI Act
| NIST AI RMF | ISO/IEC 42001 | EU AI Act | |
|---|---|---|---|
| Nature | Voluntary guidance | Certifiable management system standard | Binding law in the EU |
| Who it targets | Any organisation | Any organisation | Providers and deployers in scope |
| Outcome | Alignment claim | Certificate from a certification body | Legal compliance |
They can be used together. A company might align to NIST for risk method, certify to ISO 42001 for assurance to customers, and comply with the EU Act where it sells into Europe. See our posts on ISO/IEC 42001 certification and the EU AI Act for Indian companies.
Does it apply in India?
It is a US framework, but nothing stops an Indian company or CA firm from using it. India has no law that makes it mandatory, as far as we found. Personal data rules still apply: the DPDP Rules were notified in November 2025 with an eighteen-month phase-in.
Frequently Asked Questions
What is the NIST AI RMF?
A voluntary framework from NIST, released as version 1.0 on 26 January 2023, to help organisations manage AI risks. It is guidance, not law.
Is there an NIST AI RMF certification?
We did not find one, and NIST describes the framework as voluntary. If you want a certificate, ISO/IEC 42001 is the certifiable standard.
What are the four functions?
Govern, Map, Measure and Manage. NIST's page names them in a caption; we summarise each in plain terms above.
Can auditors rely on it as audit criteria?
Yes, as a reference for review, if you state your scope and tests clearly. It does not replace the standards that govern your assurance engagement.
Is the framework being updated?
NIST's page says it is being revised as part of the White House AI Action Plan. Check the page for the current version before you cite it.
Related Articles
Statutory facts on this page are checked against their sources, and the page says where it relied on secondary reporting. How we verify · Report an error