NIST AI RMF implementation
Turn the NIST AI RMF into governance that runs
Many companies can name the NIST AI RMF. Fewer can show who owns each AI system, which decisions need approval, and what evidence proves the controls ran.
Sentient translates the framework's four functions into ownership, risk records, controls, decision rights, and review that operate inside your existing work.
01
- Govern
- Map
- Measure
- Manage
What the NIST AI RMF asks for
A voluntary framework built on four functions.
The NIST AI Risk Management Framework (AI RMF 1.0, published as NIST AI 100-1 in January 2023) helps organizations manage the risks of designing, developing, deploying, and using AI systems. NIST publishes it for voluntary use.
Its core has four functions. Govern sets the policies, culture, and accountability for AI risk and runs across the other three. Map establishes context and identifies risks. Measure assesses, analyzes, and tracks them. Manage prioritizes them and acts.
NIST also publishes a companion Playbook of suggested actions and, since July 2024, a Generative AI Profile (NIST AI 600-1). NIST states that AI RMF 1.0 is being revised, so an implementation should absorb updates without a rebuild.
Sources
- NIST AI 100-1, AI RMF 1.0. January 2023.
- NIST AI RMF Playbook. First complete version March 2023.
- NIST AI 600-1, Generative AI Profile. July 2024.
- NIST AI RMF overview page and revision notice. Checked October 2026.
02
- Mapping
- Proof
Where alignment stalls
A crosswalk is not an operating model.
Many NIST AI RMF programs stop at a mapping spreadsheet. The gap appears the first time someone asks for proof.
What the mapping says
What operating governance shows
What the mapping says
Roles and responsibilities for AI risk are documented.
What operating governance shows
A named owner for each AI system, recorded in the AI system inventory and reassigned when people change roles.
What the mapping says
AI risks are identified.
What operating governance shows
A risk record per system: intended use, context, impacts, likelihood, treatment, and the date of the last review.
What the mapping says
Systems are tested and monitored.
What operating governance shows
Agreed measures with thresholds, monitoring results kept as evidence, and an owner who acts when a threshold is crossed.
What the mapping says
Humans review consequential decisions.
What operating governance shows
Approval points with named reviewers, recorded decisions, and the authority to stop or reverse the outcome.
What the mapping says
Risks are managed over time.
What operating governance shows
Change management that triggers review when a model, prompt, vendor, data source, or permission changes.
Those records are what AI governance questionnaires, vendor due diligence, and insurer AI questionnaires ask to see.
03
- Govern
- Map
- Measure
- Manage
From functions to operating records
What each function becomes in practice.
The RMF describes outcomes. Implementation decides which record, control, and owner produces each one.
01
Govern
Policy, ownership, decision rights
An AI acceptable-use policy, a stated risk tolerance, named owners, and authority boundaries that say who can approve, deploy, change, or retire an AI system. Board reporting draws from these records.
- AI policy
- Ownership register
- Decision rights
- Board reporting
02
Map
Context and AI system inventory
An inventory of systems and dependencies, with intended use, users, affected parties, third-party components, and known limits recorded before deployment.
- AI system inventory
- Use-case context
- Third-party dependencies
- Impact notes
03
Measure
Testing, metrics, monitoring
Agreed measures for performance, reliability, bias, security, and privacy, with test results and monitoring output kept as evidence rather than scattered across inboxes.
- Test records
- Metrics and thresholds
- Monitoring logs
04
Manage
Treatment, escalation, response
Risk treatment decisions, escalation paths, incident response, and the conditions under which a system is paused, rolled back, or retired.
- Risk treatment
- Escalation paths
- Incident records
- Retirement criteria
04
- Own
- Decide
- Review
- Change
The operating model
Ownership, review, and change that hold over time.
Six mechanisms keep a NIST AI RMF program current after the first assessment.
Sentient builds them into the tools, workflows, and processes your teams already use, so controls, approvals, evidence, and review are produced by doing the work instead of by extra tasks.
01
Ownership
Every system, risk, and control has a named owner with the authority to act on it.
Accountable owners
02
Decision authority
Clear thresholds for who approves deployment, material changes, new vendors, and exceptions.
Decision rights
03
Human review
Review points placed where a person can still change the outcome, with each decision recorded.
Human oversight
04
Monitoring
Scheduled checks against agreed measures, with results routed to the owner instead of filed away.
Ongoing measurement
05
Escalation
Defined triggers that move an issue to the right person, and a record of what happened next.
Escalation paths
06
Change management
Model, prompt, data, vendor, and permission changes trigger review before they reach production.
AI change management
Sentient defines the governance architecture around runtime enforcement. Your platforms enforce the controls. Sentient is not the enforcement platform or an identity and access management vendor.
05
- Scope
- Profile
- Build
- Run
How Sentient implements it
From framework requirements to operating structure.
Sentient works with your team in four stages, starting from where your program is today.
01
Scope and inventory
AI system inventory
Identify the AI systems, agents, automations, and vendors in use, and record their owners, purposes, and dependencies.
02
Set the target profile
Current and target profiles
Choose which RMF outcomes matter for your systems and risk tolerance, and record where you stand today. AI RMF 1.0 describes this use of current and target profiles.
03
Build records and controls
Governance implementation
Design the risk records, approval points, review cadence, and evidence capture, then put them into operation with the teams that own each system.
04
Run and evidence
Audit evidence
Operate the cadence, keep records current, and prepare the evidence customers, insurers, boards, and independent reviewers ask for.
06
- Question
- Answer
Questions, answered
NIST AI RMF questions buyers ask.
How do you implement the NIST AI RMF?
Start with an inventory of AI systems and their owners, then decide which RMF outcomes apply and record your current and target profiles. Build the risk records, controls, decision rights, human review, and monitoring that produce those outcomes, and run them on a set cadence.
Start with AI governance consultingIs the NIST AI RMF mandatory?
No. NIST publishes the AI RMF for voluntary use. Companies adopt it because customers, insurers, and enterprise procurement teams often ask how their AI governance aligns to a recognized framework. Whether a specific law or contract references it is a question for your counsel.
How does the NIST AI RMF relate to ISO/IEC 42001?
The AI RMF is a voluntary risk framework with no certification. ISO/IEC 42001 is a certifiable management system standard. NIST's AI Resource Center publishes a crosswalk between the two, and one set of operating records can support both.
ISO/IEC 42001 readinessDoes the NIST AI RMF cover generative AI?
Yes. In July 2024 NIST published the Generative AI Profile (NIST AI 600-1) as a companion to AI RMF 1.0. It describes risks that generative AI creates or makes worse and suggests actions under each of the four functions.
Can Sentient certify NIST AI RMF compliance?
No. NIST does not run a certification program for the AI RMF, and Sentient does not audit, certify, or manufacture assurance. Sentient builds the operating structure and the evidence an independent reviewer can examine.
AI diligence and assurance readiness
07
- Discuss
- Design
- Implement
- Operate
Be ready before they ask
Build the operating structure before the next customer, investor, insurer, partner, or buyer demands proof.
Sentient builds the governance structure companies need to show how AI is owned, controlled, reviewed, evidenced, and operated. Talk to Sentient about what your customers, investors, insurers, partners, or buyers will expect to see.