NIST AI RMF in Practice: Govern, Map, Measure, Manage

It can fail quietly when the world around it changes, and nobody notices until someone spots the damage by chance. Nothing in the code breaks, so no error ever fires. The NIST AI RMF is a free framework for managing this kind of risk.

Picture a common setup. A small health-tech team sells a tool that reads chest X-rays at district hospitals and moves the urgent-looking ones to the top of the reading queue. The setup is made up, but the problem is real.

The tool never makes a diagnosis. A doctor still reads every X-ray, and the tool only changes the order. In the pilot, six hospitals send about 1,800 X-rays a day.

The ML (machine learning) lead tested the model on 6,000 older X-rays, and for four months everything looked fine. Then Hospital 4 replaced its X-ray machine, and the new images had slightly different contrast.

The tool's flag rate there fell from about 14 percent of scans to 5 percent. Nobody noticed for 19 days. Urgent cases sat in the normal pile and were read up to a day late.

In the same month, a hospital chain asked, before signing a contract, whether the team follows the NIST AI RMF. The compliance lead opened the framework and found four functions, 19 categories and 72 outcomes.

This guide turns that framework into a short worksheet for one feature, the urgent X-ray flag. By the end, the 19 silent days shrink to two.

The NIST AI RMF is the Artificial Intelligence Risk Management Framework, a voluntary guide for managing the risks of AI systems across their whole life. NIST released version 1.0, published as NIST AI 100-1, on 26 January 2023.

NIST is the US National Institute of Standards and Technology, a government agency that publishes standards and guidance. The framework is not a law. NIST calls it voluntary, non-sector-specific and use-case agnostic, so a hospital tool and a bank tool can both use it.

The document has two parts. Part 1 explains how to frame AI risk and what a trustworthy system looks like. Part 2 is the Core, the four functions, plus a short section on profiles.

Each function splits into categories, and each category into subcategories. A subcategory is one outcome to aim for, such as "Organizational risk tolerances are determined and documented." Version 1.0 has 19 categories and 72 subcategories.

NIST is plain that the Core's actions "do not constitute a checklist". You choose the outcomes that fit your system, its risks and your team's size.

Seven signs of a trustworthy AI system

Part 1 lists seven characteristics of trustworthy AI. Here they are, each with what it means for the X-ray flag.

• Valid and reliable: it does what it claims, consistently. It flags the X-rays that really are urgent.
• Safe: it does not put patients in danger. If it stops, doctors fall back to the normal queue.
• Secure and resilient: it resists attacks and recovers from failures.
• Accountable and transparent: people can see what it does and who answers for it.
• Explainable and interpretable: the doctor can see why a scan was flagged, such as which region of the lung raised the score.
• Privacy-enhanced: images leave the hospital without patient names.
• Fair, with harmful bias managed: it works about as well for women and men, and for older and younger adults.

NIST calls valid and reliable "a necessary condition of trustworthiness" and draws it as the base under the others. A flag that misses urgent scans cannot be made safe or fair by good paperwork.

Here is how the four functions fit together. Start at Govern and notice that it points to all three others. Then follow the loop from Manage back to Map.

NIST says that once a governance structure is in place, the functions may be performed in any order. It expects most users to start with Map after Govern, and to loop back as things change.

You need five words: risk, risk tolerance, AI actor, TEVV and profile. Most of the framework builds on them.

Risk. NIST defines risk as a composite of how likely an event is and how big its consequences would be. Example: a missed urgent flag is fairly likely after a machine change, and the harm is a delayed diagnosis.

Risk tolerance. This is your organisation's readiness to bear risk to reach its goals. NIST says the framework does not prescribe it. Example: the compliance lead writes that no hospital may run with a broken flag for more than two days.

AI actor. NIST uses the definition from the OECD, an international policy body: those who play an active role in the AI system lifecycle. Its appendix also counts affected individuals and communities. Here, the ML lead, the radiologists and the patients all count.

TEVV. TEVV stands for test, evaluation, verification and validation. It is the framework's word for all the checking you do. Example: testing the model on X-rays from every machine brand in use.

Profile. A profile applies the framework to one setting, such as one use case. A current profile shows how you manage AI risk today, and a target profile shows the outcomes you need. The gap between them is your to-do list.

Govern asks who is in charge of AI risk, what rules they follow, and how much risk the organisation accepts. NIST calls it a cross-cutting function, because it runs through the other three.

Think of a blood donation camp in a community hall. A medical officer is in charge for the day, and written rules say who may donate. The camp maps onto the four functions like this.

• The medical officer and the written rules are Govern.
• Screening each donor before they give blood is Map: it decides whether to go ahead at all.
• Lab-testing every unit of blood is Measure.
• The plan for a donor who feels faint, or a unit that fails its test, is Manage.

Where the picture breaks: a blood unit is tested once and then used. An AI model keeps running after launch while the world around it changes, so Measure never really ends.

For the X-ray team, Govern came down to six decisions. Each one points to a NIST subcategory or category.

• Who owns AI risk: the compliance lead owns the worksheet, and the founder signs every go-live. GOVERN 2.3 asks executive leadership to take responsibility for AI risk decisions.
• How much risk is acceptable: a written risk tolerance, such as the two-day limit for a broken flag. GOVERN 1.3 sizes the risk work to it, and MAP 1.5 records it for this feature.
• What is running where: a list of every model version at every hospital, which GOVERN 1.6 calls an inventory.
• Who listens to outsiders: radiologists get a one-tap way to report a wrong flag. GOVERN 5.1 asks for ways to collect and use feedback about the system's impacts from people outside the team that built it.
• Which outside parts carry risk: the pre-trained image model the team started from (a model already trained on general images), and an open-source image library. GOVERN 6 covers risks from third-party software and data.
• How a model is retired: old versions are switched off safely and their records kept, as GOVERN 1.7 asks.

You map a feature by writing down what it is for, who uses it, who it affects, where it stops working and what could go wrong. NIST says this should give you enough context for a first go or no-go decision.

Map is the camp's donor screening, done for an AI feature. Here is what the team wrote for the urgent flag.

• Purpose: reorder the reading queue so likely urgent chest X-rays are read first. It is not a diagnosis tool. (MAP 1.1)
• Users and affected people: radiologists and duty doctors use it. Patients are affected, though they never see it. (MAP 1.1)
• Knowledge limits: trained on adult X-rays from two machine brands. Not tested on patients under 18 or on portable bedside machines. (MAP 2.2)
• Human oversight: a doctor reads every image, flagged or not. (MAP 3.5)
• Outside parts: a pre-trained image model and an open-source image library, each with its own risks. (MAP 4.1)
• Harms: each one gets a rough likelihood and size. (MAP 5.1)

The knowledge limits line mattered most. The model had been tested on two machine brands only. Hospital 4's new machine was a third brand, outside anything the model had seen.

Then the team listed the harms. A missed urgent flag: medium likelihood, high harm. A false flag: high likelihood, low harm, since a doctor simply reads a normal X-ray a little earlier.

The diagram below shows the feature's parts. Look for the scope gate and the flag-rate monitor. Both were added after the map, and each traces back to one line in it.

You measure AI risk by testing each mapped risk with a chosen method, before launch and again in production. NIST asks for results in conditions similar to the deployment, and for a note on what you cannot measure.

Before launch

The ML lead's main number is sensitivity: the share of truly urgent X-rays that the tool flags. If 100 X-rays are truly urgent and the tool flags 91 of them, sensitivity is 91 percent.

They did not. One brand scored 93 percent and the other 86 percent (made up). Most urgent test scans came from the stronger brand, so the average leaned its way and hid the weaker one.

This is why MEASURE 2.3 asks for performance to be shown for conditions similar to the deployment setting. Here is what the team tested before launch.

• Results per hospital and per machine brand, not only overall. (MEASURE 2.3)
• Results for women and men, and for each adult age band, to check fairness. (MEASURE 2.11)
• A check that images leave the hospital without names or ID numbers. (MEASURE 2.10)
• A review by a radiologist who did not help build the model or label its training data, so the test is independent. (MEASURE 1.3)

After launch

Production is where Hospital 4 went wrong. MEASURE 2.4 asks that the system's functionality and behaviour are monitored in production. The team had tested carefully before launch but watched nothing afterwards.

You often cannot measure the real goal live. Nobody knows which X-rays were truly urgent until a doctor reads them. So the team watches a proxy, a cheap number that tends to move when the real one does: the share of scans flagged each day.

Here is the daily check. It maps each hospital to two counts: scans flagged today and scans read today. The safe band of 8 to 20 percent comes from the worksheet's risk tolerance.

EXPECTED_LOW, EXPECTED_HIGH = 0.08, 0.20   # safe band from the worksheet

def check_flag_rates(daily_counts):
    alerts = []
    for hospital, (flagged, total) in daily_counts.items():
        if total < 50:
            continue                        # too few scans to judge
        rate = flagged / total
        if not EXPECTED_LOW <= rate <= EXPECTED_HIGH:
            alerts.append((hospital, round(rate, 3)))
    return alerts

today = {"Hospital 1": (41, 300), "Hospital 4": (14, 280), "Hospital 6": (9, 30)}
print(check_flag_rates(today))   # [('Hospital 4', 0.05)]

Save it as a file and run it with Python 3. It prints [('Hospital 4', 0.05)] and nothing else.

The band catches drops and jumps, because a sudden rise in flags is also a sign that something changed. Run on the Hospital 4 numbers, this check would have fired on day one instead of day 19.

The flag rate is a proxy, not proof. A model can flag the wrong scans at a normal rate, and this check would stay silent. So a radiologist also compares a weekly sample of flags against the final reports.

You manage AI risks by ranking them, choosing a response for each, and keeping plans ready to pause, fix and report. NIST says the response options can include mitigating, transferring, avoiding or accepting.

This is the camp's plan for a faint donor or a failed unit, written before anyone needs it. Here are the four responses for the X-ray flag.

• Mitigate means making the risk smaller. The scope gate skips scans from untested machine brands and portable bedside machines.
• Transfer means shifting part of the risk's cost to another party, such as an insurer or a contract partner. The team buys liability insurance, and the contract keeps the final read with hospital doctors.
• Avoid means not doing the risky thing at all. Patients under 18 are kept out of the feature entirely.
• Accept means living with a risk, in writing. False flags cost a little doctor time, and the compliance lead records that the team accepts this.

For this feature, the Manage outcome that matters most is the off switch. MANAGE 2.4 asks for mechanisms to supersede, disengage or deactivate a system whose outcomes are inconsistent with its intended use. It also asks that responsibilities for this are assigned.

For the X-ray flag, switching off is cheap and safe. The hospital goes back to reading scans in arrival order, which is what it did before the tool. Below is the plan for any flag-rate alert.

Here is how the Hospital 4 problem would have played out with the daily check and this plan, before the scope gate existed. The numbers are from the made-up scenario.

1. 1

   Day 1: the alert fires

   The flag rate at Hospital 4 drops to 5 percent. The ML lead looks at 20 sample scans and sees the new machine brand in their data.

2. 2

   Day 2: pause one hospital

   The rate stays low, so Hospital 4 goes back to arrival order. The other five hospitals keep the flag.

3. 3

   Day 2: report it

   The compliance lead tells the hospital what changed and logs an incident. MANAGE 4.3 asks that incidents and errors are communicated to relevant AI actors, including affected communities.

4. 4

   Days 3 to 10: fix and retest

   The ML lead collects 500 scans from the new machine, adjusts the model, and checks sensitivity on that brand alone.

5. 5

   Day 11: restart and update the map

   The compliance lead signs the restart. The new brand joins the knowledge limits list. The team also adds the scope gate, so the next untested brand keeps its normal place from day one.

The 19 silent days become two. That change came from one daily check, one written limit and one cheap fallback.

No. NIST describes the AI RMF as intended for voluntary use, and it does not replace any law. It helps you organise the work that laws, contracts and buyers already ask for.

Laws apply on their own terms, whatever framework you use. GOVERN 1.1 asks that legal and regulatory requirements involving AI are understood, managed and documented. MAP 1.1 asks you to note the context-specific laws for each system.

For the X-ray flag, that list starts with health data rules and medical device rules. In the US, for example, the FDA lists software that helps detect breast cancer on images as software as a medical device. Check your own country's regulator.

Pick one feature, choose the subcategories that matter for it, and give each one a plain question, an owner, an answer and evidence. That table is a simple use-case profile.

NIST describes use-case profiles as the framework applied to one setting. It also says it "does not prescribe profile templates", so a plain table is fine. Comparing your current and target state shows the gaps to work on.

The compliance lead built the worksheet in this order. Each step keeps the sheet short enough to stay current.

• Scope it to one feature, the urgent flag, not the whole company.
• Start with the subcategories tied to the biggest harms in the map. The team picked 14 rows (made up).
• Rewrite each outcome as a question a busy engineer can answer.
• Fill in the current state honestly. A blank is allowed, a guess is not.
• Add a target and a date for every gap.
• Review the whole sheet every quarter and after every incident.

A worksheet only helps if gaps stay visible. This small check lists every row with no owner or no evidence. The four rows are a sample of the full sheet.

WORKSHEET = [
    {"id": "GOVERN 2.1", "owner": "compliance lead", "evidence": "roles.pdf"},
    {"id": "MAP 1.5", "owner": "compliance lead", "evidence": "tolerance.md"},
    {"id": "MEASURE 2.11", "owner": "ML lead", "evidence": None},
    {"id": "MANAGE 2.4", "owner": None, "evidence": None},
]

def open_gaps(rows):
    gaps = []
    for row in rows:
        missing = [k for k in ("owner", "evidence") if not row[k]]
        if missing:
            gaps.append(f"{row['id']}: no {' or '.join(missing)}")
    return gaps

for line in open_gaps(WORKSHEET):
    print(line)

Run it and you should see two lines: "MEASURE 2.11: no evidence" and "MANAGE 2.4: no owner or evidence". A row counts as done only when it has both a person and proof.

The compliance lead sent the hospital chain the worksheet, with gaps marked, owned and dated. The open rows did not end the deal, because each one had a name and a date beside it.

Store each hospital's daily flag rate, and pause the flag when the most recent days have been outside the band for two days in a row. A single bad day only opens an investigation.

This turns the worksheet's risk tolerance into code. The number 2 in the script is the same limit the compliance lead wrote down under MAP 1.5.

LOW, HIGH = 0.08, 0.20      # safe band from the worksheet
MAX_DAYS_OUTSIDE = 2        # risk tolerance: a broken flag for 2 days at most

def decide(rates):
    # rates: one hospital's daily flag rates, oldest first
    run = 0
    for rate in reversed(rates):
        if LOW <= rate <= HIGH:
            break
        run += 1                # count the unbroken run of bad days at the end
    if run >= MAX_DAYS_OUTSIDE:
        return "pause"
    if run >= 1:
        return "investigate"
    return "ok"

history = {
    "Hospital 1": [0.14, 0.13, 0.15],
    "Hospital 3": [0.14, 0.14, 0.06],
    "Hospital 4": [0.14, 0.05, 0.05],
    "Hospital 5": [0.13, 0.22, 0.12],
}
for hospital, rates in history.items():
    print(hospital, decide(rates))

Expected output, one line per hospital: Hospital 1 ok, Hospital 3 investigate, Hospital 4 pause, Hospital 5 ok. Hospital 5 had one high day and then came back, so it is not paused.

Know its limits before you trust it. It inherits the proxy's blind spot, so the weekly radiologist sample stays. It also needs enough scans per day, so apply the 50-scan minimum before you store a rate. A skipped site is unwatched, so pool small hospitals over several days and alert when a hospital sends no scans at all.

Explain it as four questions you ask about one AI feature, and tie each answer to a concrete part of your design. Each middle step maps to one function.

1. 1

   Name the feature and its harm

   Say what the AI does and what goes wrong if it fails. For example: a missed urgent X-ray flag delays a diagnosis.

2. 2

   Govern: say who owns the risk

   Name the owner, the risk tolerance, and who signs the go-live. Keep it to one sentence each.

3. 3

   Map: state the limits

   List who uses it, who is affected, and where the model was never tested. Show how the design enforces those limits.

4. 4

   Measure: split the numbers

   Give results per site and per group, not one average. Then name the production proxy you will watch and its blind spot.

5. 5

   Manage: draw the off switch

   Show the fallback path, who can trigger it, and how incidents are reported to the people affected.

6. 6

   Close with the worksheet

   Say you would track it all as one row per outcome, with an owner and evidence, reviewed after every incident.