NIST AI Risk Management Framework (AI RMF 1.0 and Generative AI Profile)
United States · NIST AI 100-1 (AI RMF 1.0); NIST AI 600-1
A voluntary federal framework that helps organizations identify, measure, and manage risks from AI systems — including bias, safety, and security issues. It creates no legal rights for individuals, but it has become the de facto standard referenced by regulators, several state AI laws, and federal contractors.
Technical detail
NIST AI RMF 1.0 (Jan. 26, 2023) is a voluntary risk framework, supplemented by the Generative AI Profile (NIST AI 600-1, July 2024) and ongoing 2025–2026 profile work; compliance is non-mandatory but referenced in state statutes (e.g., TRAIGA safe harbors) and procurement expectations.
Who is protected: Indirectly: individuals affected by AI systems whose developers/deployers adopt the framework
Who must comply: Voluntary for all organizations; effectively expected of federal contractors and referenced by regulators
Key facts
| Jurisdiction | United States |
|---|---|
| Level | Federal |
| Status | In effect |
| Protection strength | Limited protection |
| Effective date | 2023-01-26 |
| Citation | NIST AI 100-1 (AI RMF 1.0); NIST AI 600-1 |
| Enforced by | None (voluntary; NIST is non-regulatory) |
| Private right of action | No — agency enforcement only |
| Topics | AI disclosure and transparency · automated decision-making · government use of AI · consumer protection |
| Last verified | 2026-06-10 |
| Official source | AI Risk Management Framework | NIST ↗ |
More AI rules in United States
- Trump AI Innovation & Security EO (June 2026) · In effect
- FERC order directing PJM and other grid operators to reform · Enacted (not yet in effect)
- Chatrie v. United States (Fourth Amendment protection for lo · Blocked / in litigation
- Kids Internet and Digital Safety Act (KIDS Act) (H.R. 7757) · Proposed / pending
- NAIC AI Evaluation Tool Pilot (12 states, 2026) · Proposed / pending
- FTC Proposed Policy Statement — AI Accuracy (July 2026) · Proposed / pending
Related AI disclosure and transparency rules elsewhere
- CO ADMT Act (SB 26-189, 2026) · Enacted (not yet in effect)
- Utah SB 319 (health insurer AI) · Enacted (not yet in effect)
- Morris County resolution urging state oversight of data cent · Enacted (not yet in effect)
- SU-47 Special-Use Data Center Zoning District Ordinance · Proposed / pending
- Washington HB 1170 (AI content watermarking & provenance metadata) · Enacted (not yet in effect)
- Cherokee Nation EO 2026-02-CTH (Data Center Task Force) · In effect
See something wrong or out of date? Submit a correction — every entry must carry a verifiable official source.