NIST AI Risk Management Framework
Sectors
Articles (65)
Understanding and Addressing Risks, Impacts, and HarmsAI System Classification — ApplicabilityChallenges for AI Risk ManagementRisk and Data Governance — GovernanceRisk MeasurementTransparency and Human Oversight — Process RequirementsRisk TolerancePost-market Monitoring — Evidence and RecordsRisk PrioritizationAuthority Cooperation — Testing and AssuranceOrganizational Integration and Management of RiskAI System Classification — ReportingAI Risks and TrustworthinessRisk and Data Governance — RemediationValid and ReliableTransparency and Human Oversight — Third-Party ControlsSafePost-market Monitoring — TrainingSecure and ResilientAuthority Cooperation — Management ReviewAccountable and TransparentExplainable and InterpretablePrivacy-EnhancedFair – with Harmful Bias ManagedAI RMF CoreLegal and Regulatory RequirementsTrustworthy AI Characteristics IntegrationRisk Management Activity Level DeterminationTransparent Risk Management ProcessOngoing Monitoring and Periodic ReviewAI System InventoryAI System DecommissioningRoles, Responsibilities, and Communication LinesAI Risk Management TrainingExecutive Leadership AccountabilityDiverse Team Decision-MakingHuman-AI Configuration Roles and OversightCritical Thinking and Safety-First MindsetRisk and Impact Documentation and CommunicationAI Testing, Incident Identification, and Information SharingExternal Feedback Collection and IntegrationAdjudicated Feedback Incorporation MechanismsThird-Party AI Risk PoliciesThird-Party Contingency ProcessesIntended Purposes and Context DocumentationInterdisciplinary AI Actor ParticipationOrganizational Mission and AI Goals DocumentationBusiness Value and Context DefinitionOrganizational Risk Tolerance DeterminationSystem Requirements and Socio-Technical DesignAI System Task and Method DefinitionKnowledge Limits and Human Oversight DocumentationScientific Integrity and TEVV ConsiderationsPotential Benefits Examination and DocumentationPotential Costs Examination and DocumentationTargeted Application Scope SpecificationOperator and Practitioner Proficiency ProcessesHuman Oversight ProcessesAI Technology and Legal Risk MappingInternal Risk Controls for AI System ComponentsImpact Likelihood and Magnitude IdentificationStakeholder Engagement and Feedback IntegrationRisk Measurement Approaches and Metrics SelectionRegular Assessment of AI Metrics and ControlsIndependent Assessment Involvement