A framework, not a law
The NIST AI Risk Management Framework is voluntary. Nobody is legally required to follow it. It is useful anyway, because it gives a repeatable structure for AI risk management that maps cleanly onto how AI systems actually get built and released: Govern, Map, Measure, Manage.
Govern: who owns this, and who signs off
Govern covers AI governance strategy, an AI system inventory, clear roles and responsibilities across developer, provider, deployer and user, supplier governance, and escalation routes when something looks wrong. Without this, every other function has nowhere to report to.
Map: understand the system before you test it
Map covers intended use, foreseeable misuse, who the users and affected people are, the deployment environment, and the assumptions the system depends on. A system built for one context and deployed into another is a common source of unplanned harm, and Map is where that mismatch gets caught.
Measure: test more than accuracy
Measure covers accuracy, reliability, robustness, bias, fairness, explainability, privacy and security testing, along with red teaming and adversarial testing where relevant. A model card, documenting what the system does, its known limitations and its intended use, is a natural output of this function.
Manage: decide, treat and monitor
Manage is where risk gets prioritised and treated: accept, mitigate, transfer or avoid. It covers release gates, human-in-the-loop controls, monitoring after launch, incident response and a deactivation plan if something goes wrong later. Manage does not end at launch. It continues for as long as the system is live.
Why the order matters
Each function depends on the one before it. Measuring a system you have not mapped tests the wrong things. Managing a risk you have not measured is guesswork. Governing without any of the above is a policy document with nothing behind it.
We work through NIST AI RMF function by function, against a real case study, in the AI Governance, Risk & Compliance Practitioner programme.