NIST AI RMF (voluntary AI risk framework)
NIST AI Risk Management Framework (AI RMF 1.0 and Generative AI Profile)
United States · NIST AI 100-1 (AI RMF 1.0); NIST AI 600-1
- Status
- In effect
- Took effect
- January 26, 2023
- Applies to
- Voluntary for all organizations; effectively expected of federal contractors and referenced by regulators
- Enforced by
- None (voluntary; NIST is non-regulatory)
A voluntary federal framework that helps organizations identify, measure, and manage risks from AI systems — including bias, safety, and security issues. It creates no legal rights for individuals, but it has become the de facto standard referenced by regulators, several state AI laws, and federal contractors.
Who is protected: Indirectly: individuals affected by AI systems whose developers/deployers adopt the framework
Legal detail
NIST AI RMF 1.0 (Jan. 26, 2023) is a voluntary risk framework, supplemented by the Generative AI Profile (NIST AI 600-1, July 2024) and ongoing 2025–2026 profile work; compliance is non-mandatory but referenced in state statutes (e.g., TRAIGA safe harbors) and procurement expectations.
Key facts
| Jurisdiction | United States |
|---|---|
| Level | Federal |
| Strength | Limited |
| Citation | NIST AI 100-1 (AI RMF 1.0); NIST AI 600-1 |
| Private right of action | No, agency enforcement only |
| Topics | AI disclosure and transparency · automated decision-making · government use of AI · consumer protection |
| Agency page | AI Risk Management Framework | NIST |
More AI rules in United States
- Trump AI Innovation & Security EO (June 2026) · In effect
- FERC order directing PJM and other grid operators to reform tariffs on… · Enacted (not yet in effect)
- Chatrie v. United States (Fourth Amendment protection for location… · Blocked / in litigation
- Kids Internet and Digital Safety Act (KIDS Act) (H.R. 7757) · Proposed / pending
- NAIC AI Evaluation Tool Pilot (12 states, 2026) · Proposed / pending
- FTC Proposed Policy Statement — AI Accuracy (July 2026) · Proposed / pending
Related AI disclosure and transparency rules elsewhere
- Morris County resolution urging state oversight of data center power… · Enacted (not yet in effect)
- SU-47 Special-Use Data Center Zoning District Ordinance · Proposed / pending
- Cherokee Nation EO 2026-02-CTH (Data Center Task Force) · In effect
- PR P. del S. 731 (AI Public Procurement Law) · Proposed / pending
- Virginia IVO AI Safety Study (SB 384/HB 797, 2026) · In effect
- PA HB 1924 data center water/energy reporting (signed July 12, 2026) · Enacted (not yet in effect)
See something wrong or out of date? Submit a correction. Every entry must carry a verifiable source.