The NIST AI Risk Management Framework is voluntary guidance, released on 26 January 2023, organised into four functions: Govern, Map, Measure and Manage. A DevOps lead can express each as pipeline work: a model inventory, evaluation gates before release, runtime monitoring and a tested rollback path.
What is the AI RMF?
NIST describes it as a framework to manage risks to individuals, organisations and society associated with AI, intended for voluntary use and to build trustworthiness into the design, development, use and evaluation of AI products and systems. It is not a certification or a regulation. NIST also publishes companion material, including a profile for generative AI. Governance language in the framework is broad, so teams translate it into their own controls.
How do the four functions look in a pipeline?
Govern is the culture and policy layer: roles, accountability, risk tolerance, and how decisions get made. For DevOps it means a named owner for every model in production and an approval step for changes that matters.
Map is about context. What is the system for, who is affected, what data does it use, what can go wrong? In practice it becomes a model card or service record stored next to the code, plus a dependency list covering models, datasets, prompts, tools and libraries.
Measure covers testing and tracking. Build evaluation suites that run on every change: accuracy and quality checks, safety and abuse tests, bias checks where relevant, and regression tests for known failures. Record results with the model and data versions.
Manage covers response: prioritising risks, acting on them and communicating. That means alerting on drift and abuse, feature flags and kill switches, rollback to the previous model or prompt, and an incident path that includes AI specific failures.
A constructed example
A team ships a support assistant that drafts replies using retrieved customer records. Under the four functions:
- Govern: the support lead owns the risk; any change to retrieval scope needs sign off.
- Map: a service record lists the model, the retrieval index, the tools, and the harm if it exposes another customer's data.
- Measure: CI runs a test set of cross-tenant leakage prompts and fails the build on any hit.
- Manage: a flag disables retrieval within minutes, and alerts fire on unusual query volumes.
What belongs in the inventory?
Treat AI components like any other supply chain element. Record model name and version, provider, hosting location, fine tuning data source, prompts, tool permissions, and the services that call it. Pin versions and keep checksums where possible. Any consistent register works. If agents call tools over MCP, Safeguard's MCP Guardrail can enforce limits on those calls at runtime.
What do auditors and customers ask?
They ask who owns the system, what was tested before release, what is monitored, and what you did the last time something went wrong. Having evaluation reports and incident notes in version control answers most of it.
What to do
- Create a register of every model, prompt set and AI dependency in production.
- Name an owner per system and require review for scope changes.
- Store a service record with intended use and harms next to the code.
- Add an evaluation suite to CI with failing thresholds.
- Add runtime monitoring, a kill switch and a rollback plan.
- Drill an AI incident once, and record the lessons.
- Map your controls to the four functions for reporting.
Quick check
Is the NIST AI RMF mandatory?
No. NIST describes it as intended for voluntary use. Other rules, such as sector regulation or contracts, may still require specific controls.
What is the difference between Measure and Manage?
Measure is about testing and tracking risk with evidence. Manage is about acting on that evidence: prioritising, responding and recovering.
Sources
Last reviewed: 18 October 2026.
