This guide is not legal advice.
What it is
The current NIST AI Risk Management Framework is AI RMF 1.0, released on January 26, 2023. It is a voluntary framework that helps organizations identify and manage risks from designing, developing, buying and using AI systems. NIST also released NIST-AI-600-1, Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile, on July 26, 2024. As checked on October 5, 2026, NIST says AI RMF 1.0 is being revised as part of the White House AI Action Plan.
The framework is organized around four functions:
| Function | What it asks |
|---|---|
| Govern | Set policies, roles and accountability for AI across the organization. |
| Map | Understand the context: what the AI system is used for, by whom, and what could go wrong. |
| Measure | Assess and track risks, including accuracy, reliability, privacy and security. |
| Manage | Prioritize and act on risks, and keep monitoring them over time. |
What it asks for, for AI and data
- Clear ownership of each AI system and its decisions
- Knowing where data goes and who can access it
- Measuring whether outputs are accurate enough for the use
- Keeping records that let you review what the system did
- A way to respond when something goes wrong
- For generative AI, considering risks such as confabulation, data privacy, harmful or biased output, misuse and information integrity, using the NIST-AI-600-1 profile where it fits the use case
How Matrix helps
| Function | How Matrix helps |
|---|---|
| Govern | Your team holds every account and sets who uses which apps and files. |
| Map | Each workflow starts with a defined task, output and reviewer, agreed in writing before work starts. |
| Measure | Accuracy is measured against your own standard. Workflows report confidence and flag uncertain items for review. |
| Manage | Local audit logs support review and export. Models and software change only through updates you approve. |
| Data and privacy | Matrix runs at your site, offline by default, and reaches an outside service only if your IT team approves it, which narrows where data can go. |
Local deployment does not certify an AI system against the AI RMF. The framework still has to be applied by the organization, use case by use case.
What stays with you
- Your organization's AI policy, risk tolerance and governance roles
- Deciding which uses of AI are acceptable
- Reviewing outputs and audit records against your requirements
- Training staff
- Applying the framework to every AI system you use, not only Matrix
- Tracking NIST's AI RMF revision and deciding when to update your internal controls
Questions to ask any AI vendor
- Where is our data processed and stored, and who can access it?
- How is accuracy measured for our specific task?
- What happens when the system is uncertain?
- What records does the system keep, and who holds them?
- How do models and software change over time, and who approves the change?