How do you run an AI risk assessment using the NIST AI RMF?

An AI risk assessment is a structured review of one AI system: what it does, who it affects, what could go wrong, how likely and how bad that is, and which controls reduce it. The NIST AI Risk Management Framework gives a workable structure, built on four functions: govern, map, measure and manage.

Where does the framework come from?

NIST released the AI RMF 1.0 on 26 January 2023. It is voluntary, and meant to help organizations include trustworthiness considerations in the design, development, use and evaluation of AI products, services and systems. NIST also published a Generative AI Profile, a companion resource for the framework, and a Playbook with suggested actions. NIST's page notes the AI RMF 1.0 is being revised, so check for the current version before you formalize a process.

What do the four functions mean in practice?

• Govern: who owns AI risk, what policies exist, who can approve a new AI use.
• Map: describe the system and its context, including purpose, users, data, and who could be harmed.
• Measure: test and track the risks you identified, with methods and metrics that you can repeat.
• Manage: decide what to do, such as reduce, accept, transfer or avoid, and then carry it out and monitor.

An assessment for one system mostly lives in map and measure, with govern supplying the rules and manage taking the output.

What goes into the assessment record?

For each AI use, capture:

1. Purpose and users: what decision or output does it produce, and who relies on it.
2. Data: what goes in, where it comes from, whether it includes personal or confidential data, and where it is sent. A hosted model means data leaves your boundary, so say so.
3. Model and supply chain: which model, which version, and which libraries, plug-ins and tools surround it.
4. Impact: what happens if the output is wrong, biased, leaked or manipulated.
5. Threats: prompt injection and data leakage for language model applications, and the families in NIST's adversarial machine learning taxonomy.
6. Controls: access limits, human review, logging, filtering, rate limits.
7. Tests and results: what you tried, what failed, what you fixed.
8. Owner and review date.

How do you score it without false precision?

Use simple scales. Rate impact and likelihood as low, medium or high, with written examples of each, so two reviewers reach the same answer. A number with two decimal places on a guess adds nothing. Where evidence is thin, say so, and plan the test that would settle it.

A constructed example

A company wants a chatbot that answers questions from its internal policy documents. Map: employees use it, documents include HR material, and the model is hosted by a third party. Impact: a wrong answer on leave policy is annoying, but a leak of salary bands is serious. Measure: the team asks questions that should be refused and checks whether restricted documents are surfaced to people without access. It finds the retrieval step ignores document permissions, so it rates the risk high. Manage: enforce document permissions at retrieval, log queries, add a feedback button, and re-test monthly.

How to check or apply this

1. Make an inventory of AI uses, including ones staff adopted without asking.
2. Assign an owner to each.
3. Use a single assessment template, based on the record above.
4. Rank by impact, and assess the highest first.
5. Run tests, not just questionnaires. Try the failure cases.
6. Record decisions, including accepted risks and who accepted them.
7. Reassess when the model, data or use changes, and on a schedule.
8. Check which laws and contracts apply to your use and region, and get legal review for those.

Safeguard's policies, MCP Guardrail and agent identity support the control step when assessed systems use agents and tools, and our compliance automation helps track evidence.

Quick check

Sources

• NIST AI Risk Management Framework
• NIST AI RMF Generative AI Profile
• NIST AI 100-2 E2025, Adversarial Machine Learning
• OWASP GenAI Top 10 for LLM Applications

Last reviewed: 18 October 2026.