The NIST AI RMF is the AI Risk Management Framework from the US National Institute of Standards and Technology. It is a voluntary guide that helps organisations manage the risks of AI systems through four functions: Govern, Map, Measure and Manage. No Australian business has to adopt it. Many use it anyway, because Australia’s own voluntary guidance lines up with it. This guide explains what the framework says, how it fits Australian expectations, and how a small or mid-sized business can turn it into action.
CalibreforumSee How Your Team Uses AICalibre Forum’s AI readiness assessment maps employee AI use and produces a scored report with a clear 90-day action plan.Explore the AI assessmentTL;DR
- The AI RMF 1.0 was published by NIST on 26 January 2023. It is voluntary and works for any sector or organisation size.
- Its Core has four functions: Govern, Map, Measure and Manage. Govern runs through the other three.
- It is not mandatory for Australian organisations. The Australian Voluntary AI Safety Standard is aligned with it, so the two work together.
- You cannot manage AI risk you cannot see. The first practical step is knowing which AI tools your staff actually use.
- Treat the framework as a way of working, not a checklist. Start with your highest-risk tools and review on a regular cycle.
Table of Contents
- What the NIST AI RMF is
- What the framework tries to protect
- The four functions of the AI RMF Core
- Is the NIST AI RMF mandatory in Australia?
- Turning the framework into a practical plan
- How the Australian essential practices fit
- What the framework does not do
- Our perspective
- Get your AI map in place
- FAQ
- Sources
What the NIST AI RMF is
NIST released the AI RMF 1.0 on 26 January 2023, as directed by the US National Artificial Intelligence Initiative Act of 2020. It is a resource for organisations that design, develop, deploy or use AI systems. Its goal is to help them manage AI risks and promote trustworthy and responsible use.
Three features matter most for a business reader.
It is voluntary. NIST says plainly in its AI RMF FAQs that no private or public sector organisation is required to use it.
It is not tied to an industry or a use case. The framework is meant to scale to organisations of all sizes, in any sector, working within or across borders. A 15-person accounting firm and a national manufacturer can both use it, at very different depths.
It was built with wide input. According to NIST’s AI Resource Center, it was developed over 18 months with more than 240 contributing organisations from industry, academia, civil society and government.
The framework is aimed at people who build AI, but the “use” part matters just as much for most Australian businesses. If your team uses AI assistants, transcription tools, AI features inside your CRM or accounting software, or anything similar, you are an AI user and the framework applies to how you manage that use.
What the framework tries to protect
NIST says the framework is meant to help developers, users and evaluators manage AI risks that could affect individuals, organisations, society or the environment. It organises the goal around characteristics of trustworthy AI, which the NIST FAQs list as:
- valid and reliable
- safe
- secure and resilient
- accountable and transparent
- explainable and interpretable
- privacy-enhanced
- fair, with harmful bias managed
For a business, these translate into everyday questions. Is the tool’s output accurate enough for the decision you are using it for? Where does your customer data go when someone pastes it into a chatbot? Who is responsible when an AI-assisted answer is wrong? Can you explain to a customer how a decision was reached?
The four functions of the AI RMF Core
The heart of the framework is the Core, described on the AIRC Core page. It has four functions. Each breaks into categories and subcategories, which break into specific actions and outcomes. NIST is explicit that the actions are not a checklist and not necessarily an ordered set of steps.
Govern
Govern builds a culture of risk management. It covers the processes and organisational structures that anticipate, identify and manage risk, and it connects how AI systems are designed and used to organisational values and strategic priorities. The AI RMF 1.0 document describes Govern as a cross-cutting function infused through the other three.
In a small business, Govern looks like this: someone is named as accountable for AI use, there is a short policy staff can follow, and leadership has agreed how much risk is acceptable.
Map
Map sets the context. It identifies the purpose of an AI system, categorises it, identifies risks and benefits, and characterises impacts. The framework notes that AI lifecycles involve many interdependent activities and actors, which makes impacts hard to anticipate.
For a business, Map is an inventory exercise with a purpose. Which tools are in use, by whom, for what tasks, with what data, and who is affected if the output is wrong?
Measure
Measure uses quantitative, qualitative or mixed methods to analyse, assess, benchmark and monitor AI risk and its impacts. That includes testing before deployment and regularly while the system is running.
Not every business needs statistical testing. A practical version is to sample AI-assisted work, check it against a standard, record error rates or near misses, and look at whether staff follow the rules you set.
Manage
Manage allocates resources to the risks you have mapped and measured. Risk treatment includes plans to respond to, recover from and communicate about incidents. In practice, that means deciding what to fix first, assigning an owner and a due date, and knowing what you will do if a tool leaks data or produces a harmful output.
Is the NIST AI RMF mandatory in Australia?
No. The framework is voluntary everywhere, and it is a US document with no legal force in Australia. But it is not irrelevant here.
The Department of Industry, Science and Resources states that the 10 guardrails of the Voluntary AI Safety Standard align with international standards, including ISO/IEC 42001:2023 and NIST AI RMF 1.0. It also says the guardrails are meant to be ongoing activities, not one-off tasks. Law firm Allens made the same point when the standard was released, noting the alignment with both AS ISO/IEC 42001:2023 and the NIST framework.
What that means for you:
- Working through the NIST functions moves you toward the Australian voluntary guidance, and the reverse is also true.
- Existing Australian law still applies to how you use AI, including privacy obligations when personal information goes into an AI tool. The framework does not replace legal advice. If you handle sensitive client data, speak to your lawyer or privacy adviser about your specific obligations.
- Voluntary does not mean unimportant. Customers, insurers and larger clients increasingly ask how you manage AI, and a recognisable framework gives you a straightforward answer.
NIST AI RMF and ISO 42001
People often ask how the two differ. In short, NIST AI RMF is a flexible risk-management framework, while ISO/IEC 42001 is a management system standard for AI. If you want more on the standard side, our guide to ISO 42001 for Australian businesses covers what it asks for. Many organisations start with the framework’s approach and add the standard later if customers require it.
Turning the framework into a practical plan
The framework describes outcomes, not a project plan. Here is a sequence that suits a small to mid-sized Australian business.
Step 1: See what is actually in use
Map cannot start without an honest inventory, and the official list of approved tools is rarely the real list. Staff use free chatbots, browser extensions and AI features switched on inside existing software. Our guide to finding shadow AI explains why asking the people doing the work gives a truer picture than asking IT alone.
Step 2: Name an owner and set your risk appetite
This is Govern. The Australian National AI Centre’s implementation guidance tells organisations to establish a risk management framework that fits the specific characteristics of AI systems, set an organisation-level risk tolerance with criteria for acceptable and unacceptable risks, and run impact assessment, risk assessment and risk treatment with criteria for reassessment across the system lifecycle.
Write down, in plain words, what staff may and may not put into AI tools, which uses need approval, and who approves.
Step 3: Record risks in one place
A risk register turns a vague worry into a tracked item with an owner. See our guide on what to include in an AI risk register. Pair it with a quick check of suppliers using our one-page AI vendor risk checklist, because most AI risk in smaller businesses enters through third-party tools.
Step 4: Check, then fix the biggest items first
Measure and Manage work together. Test the tools that touch customer data or important decisions first. Then handle the risks through controls such as access limits, approved-tool lists, human review of outputs, and training. Our AI security checklist and guide to AI data governance cover the controls most businesses reach for first, and our piece on AI model risk management goes deeper on accuracy and drift.
Step 5: Use the Playbook, borrow what fits
NIST published a companion Playbook with suggested actions for each function. The NIST FAQs say organisations may borrow as many or as few suggestions as suit their use case. That freedom matters for smaller teams: pick the actions that match your tools and ignore the rest. If you like working from a structured week-by-week format, a 12 week AI playbook shows how a staged programme can be laid out in practice.
Step 6: Repeat on a schedule
The Voluntary AI Safety Standard treats its guardrails as ongoing, and the AI landscape changes quickly: new tools appear, vendors change terms, staff find new uses. A quarterly review is a reasonable rhythm for a smaller business.
How the Australian essential practices fit
The National AI Centre’s Essential AI practices give Australian organisations a baseline for responsible AI use. They align with Australia’s AI Ethics Principles and relevant international standards. The six practices are:
- Decide who is accountable.
- Understand impacts.
- Measure and manage risks.
- Share essential information.
- Test and monitor.
- Maintain human control.
Lay these next to the NIST functions and the overlap is clear. Accountability is Govern. Understanding impacts is Map. Measuring and managing risks, plus testing and monitoring, are Measure and Manage. Human control and transparency run through all four. If you do the Australian practices well, you are already doing the substance of the NIST approach.
What the framework does not do
The framework is guidance, so using it does not by itself make a business compliant with any law. It is designed for managing risk, and it leaves decisions about what is acceptable to you. Keep it as one layer in your wider governance, alongside privacy, security and contract obligations. For privacy or legal questions about a particular tool or dataset, the person to see is a privacy lawyer or your legal adviser.
Our perspective
Most businesses we speak to do not have an AI risk problem they can name. They have a visibility problem. Leadership believes a handful of approved tools are in use, while staff are quietly using many more, with real customer and company data going into them.
The NIST framework starts from the right place: you must govern and map before you can measure and manage. But the Map step is where most small and mid-sized teams stall, because nobody has the time to interview every person about every tool.
That is why we built our assessment around an anonymous staff survey. When people can answer without fear of being blamed, they tell you what they really use and why. We combine those answers into a scored report and a 90-day action plan, so the first quarter has concrete steps instead of a blank page. We do not install software or collect individual data, and we make no compliance or legal claims. The aim is simple: give management an honest map, then a sensible order of work.
Anthony
Get your AI map in place
If you want the Map step done without a long internal project, Calibre Forum’s AI readiness assessment surveys your staff anonymously and returns a scored report with a tailored 90-day action plan. The report is A$1,990 one-off, and the membership is A$2,388 per year for quarterly assessments and reports, which suits the ongoing review the guidance calls for.
You can see what is in the readiness report and how the process works from setup to report before you decide.
FAQ
What is the NIST AI RMF?
It is a voluntary framework from the US National Institute of Standards and Technology, released as version 1.0 on 26 January 2023. It helps organisations that design, develop, deploy or use AI manage risk and promote trustworthy, responsible use. It is organised around four functions: Govern, Map, Measure and Manage.
What are the four main functions of the AI RMF Core?
Govern sets culture, accountability and policy across everything. Map frames the context and impacts of each AI system. Measure analyses and monitors risk with testing and benchmarks. Manage allocates resources to treat the risks, including incident response and communication.
Is the NIST AI RMF mandatory?
No. NIST states that no private or public sector organisation is required to use it. In Australia, the Voluntary AI Safety Standard is also voluntary, and its guardrails are aligned with the NIST framework. Existing Australian laws, such as privacy law, still apply to your use of AI regardless.
How does the NIST AI RMF differ from ISO 42001?
NIST AI RMF is a flexible risk-management framework with outcomes you adapt to your situation. ISO/IEC 42001 is a standard for an AI management system. Australia’s voluntary standard aligns with both, so working toward one supports the other.
Can a small business use it?
Yes. NIST designed it to scale to organisations of any size, and its Playbook lets you borrow only the actions that fit. A small business can begin with an inventory of AI tools, a named owner, a short usage policy and a simple risk register.
Sources
- NIST: Artificial Intelligence Risk Management Framework (AI RMF 1.0)
- NIST: AI Risk Management Framework FAQs
- NIST AIRC: AI RMF
- NIST AIRC: AI RMF Core
- NIST: AI RMF 1.0 full document
- Department of Industry, Science and Resources: The 10 guardrails
- Allens: Preparing for voluntary standards and mandatory legislation
- National AI Centre: Guidance for AI adoption, implementation guidance
- National AI Centre: Essential AI practices
- 12 Week AI Playbook for Ecommerce
Recommended
- AI Risk Mitigation: A Practical Guide for Australian Businesses
- AI Model Risk Management for Australian Businesses
- AI Access Control: A Practical Guide for Australian Businesses
- AI Data Classification: A Practical Guide for Australian Businesses
General information only. Articles on this blog are written with the help of AI writing tools and published by Calibre Forum. They are not legal, insurance, tax or financial advice, so check anything important with a qualified adviser.