What is the NIST AI Risk Management Framework and how does it structure AI governance?

The NIST AI Risk Management Framework (AI RMF 1.0) is the most widely referenced governance framework for AI. It's voluntary and risk-based, designed to help organizations build and deploy AI that is trustworthy while managing risk across the full lifecycle — design, development, deployment, and monitoring.

The four core functions

• Govern. The foundation: culture, policies, roles, accountability, and risk tolerance. Unlike the others, Govern is cross-cutting — it runs through Map, Measure, and Manage rather than being a one-time step.
• Map. Establish context and identify risks — intended use, stakeholders, the deployment environment, and what could go wrong.
• Measure. Analyze, assess, and track the identified risks using quantitative and qualitative methods, including testing and evaluation.
• Manage. Prioritize and act on risks — allocate resources, respond, recover, and communicate.

Trustworthiness characteristics

The RMF frames "trustworthy AI" around characteristics including: valid and reliable, safe, secure and resilient, accountable and transparent, explainable and interpretable, privacy-enhanced, and fair with harmful bias managed. These give risk conversations concrete dimensions.

Where it fits

The AI RMF is program-level governance, not a technical checklist. It pairs well with hands-on resources: use the OWASP LLM Top 10 and threat modeling for engineering controls, and the AI RMF (plus the Generative AI Profile) to set policy, accountability, and lifecycle risk management around them.

What interviewers look for

Knowing it's voluntary and lifecycle-oriented, being able to name the four functions and that Govern is cross-cutting, recalling a few trustworthiness characteristics, and positioning it as governance that complements technical controls rather than replacing them.