12 questions
About 4 minutes
No sign-up to see your score
NIST AI RMF readiness check
Twelve questions drawn from NIST AI RMF subcategories, three per function. Answer for the AI system that worries you most. Your score updates as you go. Leave your email at the end and I'll send a written gap report with the three fixes I'd make first.
Answer the questions above to see your profile
Get your written gap report
I read every submission and reply personally within two working days with the three changes I'd make first for your situation. No newsletter sign-up unless you ask.
NIST AI RMF basics
Common questions about the NIST AI RMF
Is the NIST AI RMF mandatory?
No. NIST publishes the AI Risk Management Framework for voluntary use. It becomes binding only where a contract, a procurement rule or a law references it.
Can my organisation be certified against the NIST AI RMF?
No. NIST does not offer certification for the AI RMF. If you need a certifiable AI management system, ISO/IEC 42001 is the standard that supports third-party certification. Many organisations use both and crosswalk the controls.
How is the NIST AI RMF structured?
AI RMF 1.0 (NIST AI 100-1, January 2023) has four functions: Govern, Map, Measure and Manage. They contain 19 categories and 72 subcategories. The Generative AI Profile (NIST AI 600-1, July 2024) adds twelve risks specific to generative AI.
Is the NIST AI RMF being updated?
Yes. NIST states that AI RMF 1.0 is being revised as part of the White House AI Action Plan, and in April 2026 it published a concept note for an AI RMF profile on critical infrastructure. Citing the exact version you follow keeps your documentation accurate through the change. More on where the framework stands.
How does the NIST AI RMF relate to the EU AI Act?
The EU AI Act is law for systems placed on the EU market; the AI RMF is voluntary guidance. Many AI RMF subcategories map to AI Act obligations, for example MANAGE 2.4 to human oversight in Article 14 and MANAGE 4.3 to serious incident reporting in Article 73, so one control register can serve both.
What does this check not cover?
It samples 12 of the 72 subcategories, chosen because they are the ones most often missing in practice. A full profile covers every subcategory against the systems you actually run, with evidence for each.