To scope the NIST AI RMF, inventory every AI system you build, buy or embed, rank them by potential harm to people and to your business, pick a first set to cover, and write down the boundary for each: model, data, users, deployment and third parties. The framework is voluntary and gives no formal scoping rules, so your reasoning is the deliverable.
NIST released AI RMF 1.0 on 26 January 2023, with a Playbook, and published the Generative AI Profile (NIST AI 600-1) on 26 July 2024. The NIST page we fetched on 18 October 2026 says the framework is for voluntary use, and that it is being revised under the White House AI Action Plan. It names four functions: Govern, Map, Measure and Manage. It does not describe scoping, so the method below is our suggestion, built around those functions.
What is a unit of scope?
Scope by AI system, not by model alone. A system is the model plus its data, prompts or configuration, the application around it, the people who use it and the decisions it influences. A third party model inside your product is part of your system even if you did not train it.
How do you build the inventory?
Ask each team for:
- Name, owner and purpose.
- Type: classifier, recommender, generative assistant, agent with tool access, embedded vendor feature.
- Model source: built in house, fine tuned, hosted API, open weights.
- Data: training, retrieval and runtime inputs, with sensitivity.
- Users and affected people, inside and outside the company.
- Decisions it makes or influences, and whether a person reviews them.
- Vendors involved.
Include shadow use: employees using public chat tools with company data count.
How do you choose where to start?
Rank by two questions: how bad is a failure, and how many people does it reach? A hiring screener or credit decision engine outranks an internal summarizer. Cover the top systems first, then widen. A risk tier of high, medium or low is fine if you define each tier in writing.
What boundary details matter?
For each in scope system write down:
- Intended use and out of scope uses.
- Where human oversight sits.
- Input and output channels, including tool or API access an agent has.
- Data flows and retention.
- Third parties and what each can see.
- Environments: development, test and production.
This feeds the Map function directly, because mapping starts from context and intended use.
How does it connect to the four functions?
- Govern: policies, roles and accountability that apply across all systems, so scope this organization wide.
- Map: per system context, purpose, stakeholders and risks.
- Measure: the tests and metrics you will run on in scope systems.
- Manage: treatment, monitoring and incident handling for them.
Scoping Govern at company level and the other three per system keeps the work proportionate.
What about other frameworks?
The NIST page says the framework is meant to build on and align with other AI risk efforts. If you also face EU AI Act duties or plan an ISO 42001 certification, record in your inventory which regimes apply to each system, and reuse the same boundary text.
What to do
- Appoint an owner and gather the inventory in one shared sheet.
- Define high, medium and low tiers in two sentences each.
- Pick the first three to five systems for full coverage.
- Write boundary notes per system, using the six items above.
- Record exclusions with reasons and a date to revisit.
- Re-scope when you add a model, a vendor or a new use.
Quick check
Is the NIST AI RMF a certification?
No. NIST describes it as voluntary guidance. No one certifies you against it, though you can document how you applied it.
Do I have to cover every AI system at once?
No. Start with the highest risk systems and widen on a schedule. Record what is excluded and why.
How Safeguard helps automate this
AI systems are built from code, models, libraries and services, so part of the evidence lives in your repositories. Safeguard's compliance suite covers frameworks, controls, evidence, continuous monitoring, automated tests and questionnaires, so evidence is collected from connected systems and code instead of by screenshot, and monitoring runs continuously between audits, which leaves the team time for other work. Technical evidence comes from your real code and dependencies through scans, SBOMs and reachability. Autonomous remediation can open tested fix pull requests for vulnerable dependencies. It is off by default, every category starts on Manual, and you choose which categories run automatically. Safeguard helps you prepare and keep evidence ready. Book a call to see it.
Sources
- NIST: AI Risk Management Framework, fetched 18 October 2026
Last reviewed: 18 October 2026.
