NIST AI Risk Management Framework

NIST's AI RMF (AI 100-1, January 2023) organizes AI risk work into four functions:

• Govern — the organizational layer: policies, roles, culture, accountability structures that make the rest possible. Deliberately placed first — risk processes without governance are theater.
• Map — understand the context: what the system does, who it affects, what could go wrong in this deployment. Risk lives in context, not in the model abstractly.
• Measure — assess the mapped risks: testing, metrics, evaluations, red-teaming.
• Manage — mitigate, monitor, respond: deploy controls, track residual risk, have incident procedures.

It's a risk process, not a checklist — the functions are iterative and continuous, closer to a security operations discipline than a certification exam.