NIST AI Risk Management Framework

The NIST AI Risk Management Framework is voluntary guidance, not a law, and no US business is legally required to follow it. But it's become the de facto reference point enterprise customers, insurers, and federal contracts point to when asking whether a vendor manages AI risk responsibly, which means a small business selling to bigger customers can encounter it as a practical requirement even without any legal mandate behind it.

The plain-English answer

You don't need to formally adopt the NIST AI RMF unless a specific contract, federal engagement, or customer requirement asks for it. What's useful about the framework, even for a business with no obligation to use it, is that it gives structure to questions most businesses are already asking informally, who's responsible for AI decisions, what could go wrong, and how do we check. Mapping your existing practices against the framework's four functions turns an informal, undocumented approach into something you can actually describe and evidence when asked.

Why this matters for your business

A 20-person software vendor getting an enterprise security questionnaire that mentions the NIST AI RMF by name is a genuinely common and growing scenario, larger companies increasingly use the framework's language as their own vendor-risk shorthand, even where they have no strict internal mandate to require it themselves. A vague or evasive answer on a questionnaire like this can cost a deal, not because the framework is legally required, but because it signals whether your business has thought seriously about AI risk at all.

The good news is that answering well doesn't require a large compliance program. Most of what the framework asks for maps to processes a reasonably careful small business already has some version of, the value is in documenting it in the language the questionnaire expects.

What the NIST AI RMF actually covers

Published by NIST in January 2023, the AI RMF is built around four core functions, not sequential steps but interconnected processes meant to be applied iteratively across an AI system's life. Govern covers organisational risk culture and accountability, who approves a given AI use case, how third-party AI tools get introduced, and how responsibility is assigned when something goes wrong. Map covers identifying the context an AI system operates in, who it affects, and what could realistically go wrong for those people. Measure covers actually assessing and monitoring risk using whatever quantitative or qualitative methods fit the system. Manage covers allocating resources to address the risks identified, following through on what Map and Measure surfaced.

NIST also publishes a companion AI RMF Playbook, with practical suggestions for implementing each function, useful if you want a concrete starting point rather than working from the core framework document alone.

What this looks like in practice

Picture the IT manager at the software vendor, staring at a questionnaire item asking for the company's NIST AI RMF alignment with no clear answer to give. Rather than treating this as a from-scratch project, working through the four functions against what the business already does turns up more than expected: someone already reviews new AI features before launch (a rough version of Govern), the team already knows which customer data the AI feature touches and who it affects (a rough version of Map), and there's already an informal bug-tracking process that would catch most AI-specific issues (a rough version of Measure and Manage).

Documenting these existing practices explicitly against the framework's own terms, rather than starting a new compliance program from zero, produces a genuine, honest answer to the questionnaire, current practice mapped to the framework, with a few concrete gaps identified as next steps rather than a claim of full alignment that isn't real.

What you can do about it

A practical way to engage with the NIST AI RMF without overbuilding:

• Map your existing AI-related practices against the four functions, Govern, Map, Measure, Manage, before assuming you need to build something new.
• Document who's actually accountable for AI-related decisions in your business, even if it's informal today.
• Identify what could go wrong with each AI feature you use or offer, and who it could affect, this is the core of the Map function.
• Note the honest gaps, don't overstate alignment on a questionnaire, an accurate partial answer is more credible than an inflated claim.
• Revisit this mapping whenever you adopt a new AI tool or feature, not as a one-time exercise.

If your business is also making claims about what your AI product does, check our guide on what makes an AI claim unfair or deceptive to the FTC, a related but distinct question from risk management framework alignment.

Related reading: our AI governance by region.

Free tools: AI Privacy Risk Scorer to score your current AI tool setup against data-privacy best practice | AI Compliance Checker to check whether your AI tools meet your compliance obligations.