Is the NIST AI RMF mandatory? What voluntary really means

No. NIST describes the AI Risk Management Framework as intended for voluntary use, and it is not a certification. That does not mean it never matters. A customer questionnaire, a contract or an internal policy can still reference it, so check what you have actually agreed to.

What NIST says

NIST released AI RMF 1.0 on 26 January 2023 through an open, consensus-driven process. The framework text states that it is meant to be flexible and to augment existing risk practices, and that organizations should follow existing regulations and guidelines for risk criteria, tolerance and response from their sector.

The Playbook is also voluntary. NIST says it is neither a checklist nor a set of steps to be followed in its entirety.

Where "voluntary" stops

Voluntary at the framework level does not stop other parties from asking for alignment. Common routes:

• A customer asks in a security or procurement questionnaire how you manage AI risk and which framework you follow.
• A contract clause commits you to a named framework.
• Your own board or risk committee adopts it as the internal standard.
• A sector regulator or law has its own requirements that you must meet regardless.

The last item is separate from the RMF. The framework itself says to follow existing sector regulations first.

How closely to follow it

Match depth to exposure. A team that only uses a chat assistant for drafting needs far less than a team that ships a model-driven feature making decisions about customers.

A reasonable minimum for most companies:

1. Inventory the AI systems in use and in development.
2. Write down an AI risk tolerance.
3. Assign an owner to each system.
4. Document how high-risk systems are tested and monitored.
5. Keep a record of incidents and decisions.

Those map to Govern, Map, Measure and Manage without pretending to complete the whole catalog.

Expect change

NIST's overview page says AI RMF 1.0 is being revised as part of the White House AI Action Plan, without giving a date. Build your program on the structure, not on a particular subcategory number, and check the NIST page before citing the framework externally.

What to say in a questionnaire

Be exact. "We align our AI risk practices with the NIST AI RMF" is a claim about practice, and you should be able to show an inventory, a policy and test records behind it. Avoid words like compliant or certified, because the framework has no such status. If you only follow parts of it, say which parts. Keep a short internal note listing the evidence for each statement so answers stay consistent across deals.

Quick check

Sources

• NIST, AI Risk Management Framework 1.0 (NIST AI 100-1)
• NIST, AI Risk Management Framework overview page
• NIST, AI RMF development timeline

Last reviewed: 19 October 2026.