To launch an AI governance program, name an accountable owner, inventory every AI system and use case, set a short policy, and review risk with a repeatable process. The NIST AI Risk Management Framework offers four functions to organize that work: Govern, Map, Measure and Manage.
What is the NIST AI RMF?
NIST's AI Risk Management Framework, NIST AI 100-1, describes a Core made of four functions. In the document's words, the Core is composed of GOVERN, MAP, MEASURE and MANAGE, each broken into categories and subcategories that are subdivided into specific actions and outcomes. GOVERN applies to all stages of an organization's AI risk management. MAP, MEASURE and MANAGE can be applied in AI-system-specific contexts and at specific stages of the AI lifecycle. NIST notes that most users would start with MAP and continue to MEASURE or MANAGE once governance is in place, though the framework is not a strict sequence.
The framework is voluntary. It is not a certification, and nobody certifies you as aligned to it.
What does each function ask you to do?
Govern. The subcategories describe policies, processes, procedures and practices related to mapping, measuring and managing AI risks that are in place, transparent and implemented effectively. Legal and regulatory requirements involving AI are understood, managed and documented. Accountability structures are in place so the appropriate teams and individuals are empowered, responsible and trained.
Map. Context is established and understood. Intended purposes, beneficial uses, context-specific laws and norms, and prospective settings where the system will be deployed are understood and documented.
Measure. Appropriate methods and metrics are identified and applied. Metrics for risks found during mapping are selected, starting with the most significant, and risks that will not or cannot be measured are documented.
Manage. Risks are prioritized, responded to and managed based on the earlier assessments. A determination is made as to whether the system achieves its intended purposes and whether its development or deployment should proceed.
Where do programs usually fail?
They begin with a policy document and no inventory. A policy that says "all AI use must be approved" is unenforceable if nobody knows which tools staff use, which models sit inside products, and which vendors have added AI features in an update.
They also fail by being all review and no speed. If approval takes six weeks, people route around it. A small low-risk use case needs a quick path, and a high-risk one needs a deeper review.
A constructed example
A 300-person software company starts with four weeks. Week one: the CTO is named owner and a legal and security lead join her. Week two: a survey and a review of subscriptions produce a list of 23 AI uses, from coding assistants to a support bot to a customer-facing feature that summarizes documents. Week three: each use is placed in a tier by data sensitivity and by whether it acts or only advises. Week four: a one-page policy goes out. Tier one uses need a short form and an owner. The customer-facing feature, in tier three, gets a full review: intended purpose, data sources, test results, human oversight, and a rollback plan.
How to check or apply this
- Appoint an owner and a small group. Include security, legal, engineering and the business. Write down who decides.
- Inventory. List internal tools, vendor tools and AI features inside your own products, with owner, data and purpose.
- Tier by risk. Decide what makes a use higher risk, such as personal data, automated decisions or customer exposure.
- Write a short policy. Cover approved uses, data that must not go into models, human oversight and incident reporting.
- Build a fast path. Low-risk uses get a lightweight approval. Spend the review effort on the top tier.
- Map and measure. For high-risk systems, document purpose and context, choose metrics and run tests before launch.
- Manage. Track findings to closure, set triggers for re-review, such as a model change or new data source, and keep a rollback plan.
- Report and revise. Review the program quarterly and adjust.
Safeguard's compliance automation and policies and gates can help turn some of these rules into checks on the software you build, while the governance decisions themselves stay with your people.
Quick check
Does using the NIST AI RMF make us compliant?
The framework is voluntary guidance and there is no certification for it. Use it to structure your risk management, and check separately which laws apply to you.
Where should we start?
Start with ownership and an inventory of AI uses. Policy and risk review depend on knowing what you actually run.
Sources
- NIST AI 100-1, Artificial Intelligence Risk Management Framework (AI RMF 1.0), fetched 18 October 2026.
- NIST AI Risk Management Framework overview, fetched 18 October 2026.
Last reviewed: 18 October 2026.
