Use the NIST AI Risk Management Framework as an answer structure, not a badge. Group your replies under Govern, Map, Measure and Manage, point to evidence for each, and say "aligned with" only where you can show the mapping. The framework is voluntary, so there is no certificate to claim.
Customer questionnaires increasingly include AI sections: what models you use, where data goes, how you test and who is accountable. Teams without a framework answer inconsistently. The AI RMF gives you a shared skeleton that matches what many buyers already read.
What is the AI RMF, and what is it not?
NIST's page describes the AI RMF 1.0, released on 26 January 2023, as a framework for voluntary use to help manage AI risks. NIST also published a Generative AI Profile, NIST-AI-600-1, on 26 July 2024. NIST states the AI RMF 1.0 is being revised as part of the White House AI Action Plan, so cite the version you used and the date.
It is not a control checklist you pass or fail, and NIST does not describe any certification for it on that page. So the right words in a questionnaire are "we use the NIST AI RMF to structure our AI risk management," followed by specifics. Avoid "NIST compliant" or "certified."
How do common questions map to the four functions?
"Which AI systems do you use or build?" This is Govern. GOVERN 1.6 calls for mechanisms to inventory AI systems. Answer with a list: system, purpose, owner, model provider, data it touches.
"Who is accountable for AI risk?" Also Govern. GOVERN 2.1 asks that roles, responsibilities and lines of communication for AI risk are documented and clear. Name a role, not a committee.
"What is the intended use, and what could go wrong?" This is Map. MAP 1.1 covers intended purposes, context and settings where the system will be deployed. Give a short use statement per system, plus known limits.
"What third-party models or data do you depend on?" Map and Govern. MAP 4.1 covers risks of components including third-party data or software, and GOVERN 6.1 covers policies for third-party AI risks. Name providers and say what contract terms cover training on your data.
"How do you test security and safety?" This is Measure. MEASURE 2.7 says AI system security and resilience are evaluated and documented, and MEASURE 2.6 covers regular evaluation for safety risks. Describe test types in general terms and give dates and owners.
"How do you handle incidents and shut-offs?" Manage. MANAGE 4.3 covers communicating, tracking and recovering from incidents and errors. MANAGE 2.4 covers mechanisms to supersede, disengage or deactivate AI systems that behave outside their intended use.
What does a good answer look like?
Keep each answer to three parts: the fact, the evidence, the limit.
- Fact: "We use a hosted language model for support summaries."
- Evidence: "The system is on our AI inventory, reviewed on a stated date, with an owner named."
- Limit: "It does not make decisions about customers, and a person reviews outputs before they are sent."
State limits plainly. A customer reading ten questionnaires trusts the one that says what is not covered.
What should you not claim?
Do not claim certifications you do not hold. If an audit is underway, say it is in progress and give the scope, never the outcome. Do not claim customers, numbers or partnerships you cannot document. Do not describe a planned control as live. If your product has features at different maturity levels, label each as generally available, early access or roadmap.
How do you keep answers consistent?
Write them once. Keep an answer library keyed by AI RMF subcategory, each with an owner, an evidence link and a review date. When a questionnaire arrives, pull from the library and adapt. Review the library every quarter and after any change in model provider, data use or system purpose.
What are the limits of this approach?
A mapping to the AI RMF shows structure, not quality. Buyers in regulated sectors may ask about other frameworks, such as ISO/IEC 42001 or sector rules, which we did not review for this article. Check what your buyer actually requires before reusing the same answer.
What to do
- Build an AI system inventory with owner, purpose, provider and data touched.
- Draft one short answer per question group above, with a fact, evidence and limit.
- Collect evidence: test records, review dates, incident procedure, provider terms.
- Replace any vague claim with a specific, dated one, or delete it.
- Have security and legal review the library once, then on a schedule.
- Record the AI RMF version and date you used.
Quick check
Can a company be NIST AI RMF certified?
NIST describes the AI RMF as a framework for voluntary use and does not describe a certification on its overview page. Say you align with it and show how, rather than claiming certification.
Which AI RMF function covers testing?
Measure. MEASURE 2.6 and 2.7 cover safety and security evaluation, with results documented.
Sources
Last reviewed: 18 October 2026.
