How does the NIST AI Risk Management Framework apply to a manager rolling out AI?
The NIST AI RMF is voluntary guidance built around four functions: Govern, Map, Measure and Manage. The AI Capability Rollout Framework is not a NIST product and is not endorsed by NIST, but its 90-day system follows the same logic for organizations that use AI rather than build it. Days 1 to 30 assign ownership, audit tools already in use and document guardrails (Govern and Map). Days 31 to 60 run one pilot with a baseline and a human checkpoint (Map, Measure and Manage). Days 61 to 90 review results against the baseline and decide whether to expand, refine or pause (Measure and Manage). The framework does not cover model-level testing for teams that build AI systems.
The NIST AI RMF was published as version 1.0 in January 2023 and is voluntary. Source: NIST AI Risk Management Framework.
The four NIST functions, mapped to the 90-day system.
| NIST function | Where the framework lines up |
|---|---|
| Govern | Module 01 Strategy & Leadership Clarity and Module 02 Governance & Risk Awareness. Phase 1 outcomes “Ownership assigned” and “Guardrails documented”. Tool: Stage 1 Leadership Check-In |
| Map | Phase 1: “Audit what tools are already in use” and the readiness baseline (“Readiness baseline complete”). Module 03 Workflow Integration: “Identify your highest-value, lowest-risk workflows for structured piloting.” Tools: AI Readiness Score, Baseline Capability Worksheet, Workflow Evaluation Checklist |
| Measure | Phase 2: “Define success before you start” and “Baseline measured before start”. Phase 3: “Review pilot results against your baseline.” Tools: Pilot Metrics Tracker, Before/After Capability Dashboard, AI Pilot Results Summary |
| Manage | Phase 2: “Run the pilot with guardrails in place and a human checkpoint built in.” Phase 3: “Decide what to expand, refine, or pause — and document why.” Tools: AI Pilot Approval Two-Pager, 90-Day AI Capability Roadmap, Executive Briefing Builder |
What this does not cover.
Model-level testing, bias evaluation and other work done by teams that build AI systems are outside the framework. It is for managers and directors who adopt and run AI.
Common questions about the NIST AI RMF and AI adoption.
Start with where your organization stands.
Take the free AI Readiness Assessment, then work through the 90-day system one phase at a time.