Organisations selling into the US
Federal procurement and many enterprise buyers ask how AI risk is managed in NIST terms; a profile is the answer they recognise.
WHO IT APPLIES TO
Who adopts NIST AI RMF
Nobody has to adopt it. These are the organisations already being asked the question it answers.
Teams that need a risk vocabulary
Map and Measure give you a shared way to name purpose, context, impacts and metrics before you build a management system.
Providers of high-risk AI in the EU
Art. 9 asks for a risk management system across the lifecycle. The framework organises it; nothing in it replaces the Act's own duties.
KEY DATES · STATUS
The dates that matter
Nobody certifies the NIST AI RMF: no scheme exists, and Veritome never implies one. The output is a profile document.
| Date | Event | What it means |
|---|---|---|
| 26.01.2023 | AI RMF 1.0 released | NIST AI 100-1, with the companion Playbook. Voluntary from the first page. |
| 26.07.2024 | Generative AI Profile | NIST AI 600-1 applies the same four functions to generative AI risks. |
| 02.12.2027 | EU AI Act Annex III | Most Annex III high-risk duties apply. The framework organises Art. 9 risk management but gives no presumption of conformity. |
WHAT IT ASKS
72 requirements, in the shape the framework gives them
The Core is four functions, split into categories and subcategories. NIST publications are public domain, so Veritome paraphrases every subcategory and each step names the ranges it closes.
- Govern: policies, roles, culture and third-party handling.
- Map: context, purpose, capabilities and impacts.
- Measure: metrics and trustworthiness evaluation.
- Manage: prioritise, respond and learn.
19
Govern subcategories
18
Map subcategories
22
Measure subcategories
13
Manage subcategories
- GOVERN6 categories19
- MAP5 categories18
- MEASURE4 categories22
- MANAGE4 categories13
HOW VERITOME RUNS IT
12 steps, 4 phases, one record each
4 phases, one per function, gate-locked in order: 12 steps in all.
- 4 steps (the Map steps and the trustworthiness evaluation) are answered per AI system; the rest once for the organisation.
- They reuse what the EU AI Act journey already recorded about purpose, context and risk.
- The last step assembles the AI RMF profile, the framework's own output, as a generated PDF.
WHERE IT OVERLAPS
Credited in both, or only related
No NIST step is credited against another framework: it sets outcomes, not clauses. Related links to the EU AI Act and ISO/IEC 42001 are shown in the drawer, never counted.
NIST AI RMFGovernGOVERN 1.1–1.7
Policies, accountability and risk toleranceDone
Credited in no other programme: every link below is shown, never counted.
Across the programme
23 related
21 related
7 related
4 related
Related work, shown and never counted
Illustrative progress · the steps and counts are the product’s
ISO/IEC 42001, ISO/IEC 27001 and NIST AI RMF cross-mapping lands with the full launch, planned for late November 2026.
12 of the 12 steps carry a related link to an EU AI Act article. A related link was not checked against source text by the owner's verified matrix, so it is shown and never counted. Credit shows in three places only:
- “Also counts toward” on a record
- “Credited by work already on file” on a step that is Done
- one figure on each programme card
See all three on the frameworks page, and the EU AI Act article by article at /eu-ai-act.
| With | Records credited in both | Related only: shown, never credited | Page |
|---|---|---|---|
| EU AI Act | 0 | 21 | EU AI Act → |
| GDPR | 0 | 4 | GDPR → |
| ISO 42001 | 0 | 23 | ISO 42001 → |
| ISO 27001 | 0 | 7 | ISO 27001 → |
QUESTIONS PEOPLE ASK
NIST AI RMF, answered plainly
The same answers, word for word, that the page marks up for search engines and AI assistants.
What is the NIST AI RMF?
A voluntary framework for managing the risks of AI systems, published by the US National Institute of Standards and Technology in January 2023. Its Core has four functions (Govern, Map, Measure, Manage) with categories and subcategories describing outcomes; a companion Playbook suggests how to reach them.
Is there a NIST AI RMF certification?
No. No certification scheme exists and NIST does not accredit one; a 'NIST AI RMF certificate' is someone's own badge. The framework's output is a profile: how your organisation applies the functions to its AI. Veritome generates that profile and never calls it a certificate.
Does the NIST AI RMF satisfy the EU AI Act?
No. It is a voluntary US framework the Act does not refer to; it is not a harmonised standard and gives no presumption of conformity. The overlap is real: Art. 9 risk management, Art. 10 data governance and Art. 72 post-market monitoring cover the ground of Map, Measure and Manage. Veritome shows those as related links, never credit.
What is an AI RMF profile?
A description of how an organisation implements the functions for a given context: its current state, its target and the gap. NIST publishes companion profiles such as the Generative AI Profile (NIST AI 600-1). In Veritome the profile is the programme's last step, assembled from the 12 records into a PDF.
How is the NIST AI RMF different from ISO/IEC 42001?
ISO/IEC 42001 is a certifiable management-system standard with auditable clauses; the NIST AI RMF is a voluntary framework of outcomes with no certification. Many organisations use the RMF's vocabulary inside an ISO/IEC 42001 system: Map and Measure read naturally as the AI risk and impact assessments the standard requires.
How does Veritome run the NIST AI RMF?
As 12 steps across the four functions, 4 of them per AI system and the rest once for the organisation, closing all 72 subcategories. It ends in a generated profile PDF. Programmes come with a workspace; the free check first shows which EU AI Act and GDPR duties a system carries.
The other four