Skip to main content
3 days

Colorado ADMT rules: hearing and last day for written comments · Oct 26, 2026 · See what changes

US Federal·In Effect·Effective January 26, 2023

NIST AI Risk Management Framework 1.0

Dates and status re-checked against primary sources on October 11, 2026. How we verify

A voluntary framework from the National Institute of Standards and Technology helping organizations manage AI risks. Organized around four functions: Govern, Map, Measure, and Manage. Released January 26, 2023; NIST added a Generative AI Profile (NIST-AI-600-1) on July 26, 2024, and says AI RMF 1.0 is being revised as part of the White House AI Action Plan. Texas TRAIGA says a defendant may not be found liable for a violation it discovers through an internal review process while substantially complying with the most recent NIST Generative AI Profile or another nationally or internationally recognized risk management framework.

What this means for your team

The NIST AI RMF is voluntary — there is no legal penalty for not following it. But it provides the most practical, detailed guidance available for building an AI governance program from scratch. Its four-function structure (Govern, Map, Measure, Manage) maps well to the governance activities small teams can actually implement: documenting AI use, assessing risks, tracking incidents, and improving over time. Texas TRAIGA protects defendants that substantially comply with NIST's Generative AI Profile or another recognized framework, so following it can also help you answer an enforcement action there.

Key requirements

  • Govern: establish organizational policies, roles, and culture for AI risk management
  • Map: identify and categorize AI risks in context of deployment
  • Measure: analyze and track identified AI risks
  • Manage: implement risk response actions and monitor effectiveness
  • Profiles: apply the framework to a specific use case, sector or technology, such as the Generative AI Profile
← All regulations