Everyone References the NIST AI RMF. Few Have Implemented It

The NIST AI Risk Management Framework (AI RMF) is a voluntary US framework, published in January 2023 as NIST AI 100-1, that sorts the work of managing AI risk into four functions, 19 categories and 72 subcategories. NIST says its actions “do not constitute a checklist”, so implementing it means running a chosen set of its subcategories on the AI systems you actually operate.

Nearly every AI governance proposal I read cites the framework. Far fewer can say which of its subcategories are working on which systems, and that second question is what I mean by implemented. My argument is that most programs stall because they treat 72 subcategories as a 72-row compliance project. The better start is the dozen that let you find a system, judge it and stop it, with more added before launch for high-risk systems and the rest brought in over the following months, highest-risk systems first. This reference is for whoever has been told to “align with NIST”, usually a head of risk, compliance or AI governance at a company with US customers.

What Is in the NIST AI RMF?

The core sits in four tables in NIST AI 100-1. GOVERN sets the policies, roles and culture, and NIST calls it “a cross-cutting function” that runs through the other three. MAP establishes what a system is for and whom it could affect. MEASURE assesses and monitors the risks MAP found. MANAGE decides what to do about them, including whether to deploy at all.

Two sentences in the document matter more than the counts. The first: “Actions do not constitute a checklist, nor are they necessarily an ordered set of steps.” The second: “Some organizations may choose to select from among the categories and subcategories; others may choose and have the capacity to apply all categories and subcategories.” Once governance is in place, NIST says the other functions “may be performed in any order”, and that most users “would start with the MAP function and continue to MEASURE or MANAGE.”

Seven characteristics of trustworthy AI run through all four functions, from valid and reliable to fair, with harmful bias managed. NIST says “tradeoffs are usually involved”, so record which one you favored for each system, and why.

The Documents Around It

The AI RMF Playbook gives suggested actions for the framework’s outcomes and says it is “neither a checklist nor set of steps to be followed in its entirety”. NIST AI 600-1, the Generative AI Profile of July 2024, names 12 risks that generative AI creates or makes worse, from confabulation to information security, and lists more than 200 suggested actions keyed to the subcategories. NIST also publishes crosswalks to other standards, among them a map from each subcategory to clauses of the final draft of ISO/IEC 42001.

The text is due to change. America’s AI Action Plan, released by the White House in July 2025, told NIST to revise the framework “to eliminate references to misinformation, Diversity, Equity, and Inclusion, and climate change.” When I read NIST’s framework page on 6 October 2026, it said version 1.0 “is being revised” and listed no new version. My guess is that GOVERN 3, whose title begins “Workforce diversity, equity, inclusion, and accessibility”, will change most. Until a revision is published, map to the 1.0 identifiers and plan to check them again.

Why Do So Few Organizations Get Past Citing It?

Nobody publishes a reliable count of organizations that have implemented the AI RMF, so the headline above is my judgment. The best evidence I found measures the practices the framework asks for. Pacific AI’s 2025 governance survey, fielded by Gradient Flow between 14 February and 29 May 2025, drew 351 responses, mostly recruited through the two firms’ newsletters; 91 percent came from organizations with operations in the US. Policies were far more common than the work behind them.

A usage policy answers part of GOVERN 1. Monitoring a system in production is MEASURE 2.4, and following a process to track and recover from incidents is MANAGE 4.3. On these figures, 52 percent of respondents did not monitor production AI and 46 percent had no AI incident playbook. Monitoring is how you learn a live system has gone wrong, and the playbook is how you respond. The same survey found only 30 percent had generative AI in production, so part of that gap is organizations with little live to watch yet.

In my experience the stall has three causes. Teams read 72 subcategories as 72 requirements, so the first deliverable is a mapping spreadsheet that takes months and governs nothing. The mapping is done against documents instead of systems, so it shows what policy covers but not which model in production is monitored. And timelines get quoted with no evidence: an earlier version of this page said a full implementation takes 18 months, citing two vendor guides that, re-read in October 2026, gave no timeline at all.

Which Subcategories Should You Implement First?

Start with the ones that let you find a system, judge it and stop it. Minimum Viable Governance (MVG), the 90-day method I use, produces ten documents that answer 12 named subcategories. The table lists them. The last column is the layer each document grows into after day 90.

MVG runs for 13 weeks with a team of three: a governance owner, a business stakeholder and a technical lead. GOVERN comes first, in weeks 1 and 2, then MAP, MEASURE and MANAGE, the order NIST says most users follow. On day 90 the first system goes through the deployment gate. Those 13 weeks cover a first system; a large portfolio takes longer, and I know of no published benchmark for it. The week-by-week plan is in the MVG article.

The 12 are the floor for every system. NIST says policies and resources “should be prioritized based on the assessed risk level and potential impact of an AI system”, so a system that makes or shapes decisions about people, such as hiring, credit or insurance, needs more before its day-90 gate: the legal requirements that apply to it (GOVERN 1.1), fairness testing (MEASURE 2.11), a way for affected people to report problems and appeal (MEASURE 3.3) and, if a vendor supplies it, the third-party subcategories (GOVERN 6 and MANAGE 3). Third-party AI is often the larger exposure, and The AI That Hurts You Is Not the AI You Own covers it.

For lower-risk systems, some subcategories stay out of the first 90 days on purpose, and a program should write down which: diverse teams in risk decisions (GOVERN 3.1) and feedback from people outside the team (GOVERN 5) are the usual ones. Three of the 12 already reach the people a system affects. MAP 5.1 records the impacts on them, and MANAGE 4.1 and 4.3 give them appeal, override and notice of incidents.

After Day 90

The other 60 subcategories come in the Align stage, which starts in month 3, when each MVG document becomes the first entry in one of five layers: Policy, Process, Tooling, People and Assurance. Show Me the Last Time Your AI Principles Changed a Decision assigns each of the 60 to a layer. Within Align, take first the subcategories that bear on your high-tier systems. Assure is ongoing. Each system comes back for review on its risk tier’s cadence, monthly for high, quarterly for medium and yearly for low, and the first reviews fall due while Align is still under way.

The NIST crosswalk matrix puts this mapping on printable pages, along with the other frameworks I use set against the four functions.

Does Implementing It Protect You Legally?

Not by itself, and in most places it gives no formal protection. No federal law makes the framework a safe harbor. Texas is the clearest exception I know of. Its Responsible Artificial Intelligence Governance Act (HB 149), in force since 1 January 2026, says a defendant may not be found liable for a violation it discovers through an internal review process while it substantially complies with NIST’s Generative AI Profile or another recognized AI risk framework (Business and Commerce Code, section 552.105). Only the attorney general can bring those actions, and the statute points to “the most recent version” of the profile, so NIST’s revision will move the target. Colorado’s 2024 AI Act included a similar shelter for organizations following the NIST framework or ISO/IEC 42001. SB 26-189, signed on 14 May 2026, replaces that law from 1 January 2027 and drops the safe harbor along with the risk management duties it was attached to.

Outside the US the framework counts for less. The EU AI Act does not mention it. The Act’s high-risk duties for the uses in Annex III, such as hiring and credit scoring, apply from 2 December 2027 after the Digital Omnibus moved the date from 2 August 2026. For providers they include a risk management system under Article 9 and design for human oversight under Article 14. Deployers have their own duties under Article 26, among them assigning human oversight and monitoring the system in use. A program running the subcategories holds much of the evidence, re-cut to the Act’s own articles. Under the Act, a presumption of conformity comes from harmonised standards published in the Official Journal and from common specifications (Articles 40 and 41), and the NIST framework is neither. Where customers ask for certification, the crosswalk to ISO/IEC 42001 is the shorter step.

Where Does the Framework Fall Short on AI Agents?

NIST AI 100-1 was published in January 2023 and never uses the word “agent”. The Generative AI Profile mentions autonomous agents once, as one security threat in a list under MEASURE 2.7. Neither deals with a system that plans, calls tools and acts across other systems with credentials of its own, and the framework page listed no agent profile on 6 October 2026.

NIST has started that work. Its Center for AI Standards and Innovation launched the AI Agent Standards Initiative on 17 February 2026, with three pillars: industry-led standards, open-source protocols for agents, and research on agent security and identity. NIST’s National Cybersecurity Center of Excellence published a concept paper on agent identity and authorization on 5 February 2026; its summary of comments reports more than 600 responses. Neither gave a date for finished standards.

Until they arrive, the existing subcategories cover more of an agent than most programs use. GOVERN 3.2 asks for defined roles for human-AI configurations and oversight. MAP 3.5 asks for documented processes for human oversight. MAP 4 asks for the risks of every component, including third-party software, which for an agent means each tool it can call. MANAGE 2.4 asks for someone with the authority and the means to deactivate the system. Only MANAGE 2.4 is among the first 12, so a company already running agents should add GOVERN 3.2, MAP 3.5 and MAP 4 to its first 90 days. What the framework leaves open is the agent’s identity: whom it acts for, what it may touch, and how each action traces back to a person who allowed it. Give every agent its own identity and permissions instead of a borrowed human or service account, a point many of the NCCoE commenters made. The A7 framework and the five levels of AI autonomy cover how much autonomy to hand over.

Download the Crosswalk Matrix

The matrix sets each framework against the four functions and lists the 12 MVG subcategories, ready to print or save as a PDF.

Sources and Changes

• NIST, AI Risk Management Framework 1.0 (NIST AI 100-1), January 2023, Tables 1 to 4.
• NIST, Generative AI Profile (NIST AI 600-1), July 2024.
• NIST, AI Risk Management Framework page and AI RMF Playbook, read 6 October 2026.
• NIST, AI RMF to ISO/IEC FDIS 42001 crosswalk, from the crosswalks page.
• The White House, America’s AI Action Plan, July 2025.
• Pacific AI, 2025 AI Governance Survey release, 17 June 2025; Gradient Flow, 2025 AI Governance Survey, 351 respondents, 14 February to 29 May 2025.
• Texas HB 149 (89th Legislature), enrolled text, section 552.105; Colorado SB 26-189, signed 14 May 2026.
• Regulation (EU) 2024/1689 (AI Act), Articles 9, 14, 26, 40 and 41 and Annex III; Regulation (EU) 2026/1744, OJ L, 24 July 2026.
• NIST CAISI, AI Agent Standards Initiative, 17 February 2026; NCCoE, concept paper on software and AI agent identity and authorization, 5 February 2026, and summary of comments.

Updated 6 October 2026. Rewritten and cut from about 4,300 words. The headline and format changed, and the per-framework crosswalk lists moved into the matrix. Removed claims I could not trace to a primary source: the 18-month implementation figure, a 36 percent framework adoption figure, the 60 to 70 percent EU AI Act overlap, a projected agent standards date of 2027, and the four agent threats attributed to NIST. Added the framework’s revision under the AI Action Plan, the Texas defense and the agent identity work. Corrections: tell me.