The NIST AI RMF is voluntary and has no technical control list of its own, so engineers translate its subcategories into tasks: an AI system inventory, a record of third party components, repeatable tests, production monitoring, a way to switch a system off, and incident records. This checklist maps each to the subcategory it serves.
What is the framework asking engineers to do?
NIST released AI RMF 1.0 on 26 January 2023 for voluntary use. It has four functions: Govern, Map, Measure and Manage. NIST says the framework is being revised, and that its Playbook is neither a checklist nor a set of steps to follow in full. Treat the list below as one team's reading, not an official control set. A generative AI profile, NIST AI 600-1, adds actions for that case.
Govern: inventory and ownership
- System inventory. GOVERN 1.6 calls for mechanisms to inventory AI systems. Keep a register with owner, purpose, model and version, data sources, deployment location and risk rating. Generate it from repositories and cloud accounts where you can.
- Decommissioning. GOVERN 1.7 covers safe retirement of systems. Add a retirement checklist covering credentials, data, endpoints and model artefacts.
- Access. Limit who can change prompts, models, training data and configuration, and log changes.
Map: know the parts and the context
- Component record. MAP 4.1 expects approaches for mapping legal and technology risks of components, including third party data and software. Keep a software bill of materials for each AI service, including model packages, inference libraries and data pipelines, and a note of each model provider and licence.
- Intended use. Write the intended purpose, users and known limits where engineers will see them, such as the repository readme or model card.
- Impact view. MAP 5.1 asks about likelihood and magnitude of impacts. Capture the answer in the design review.
Measure: test repeatably
- Metrics. MEASURE 1.1 asks for appropriate metrics. Pick measures for accuracy, resistance to bad input, bias where relevant, and safety failures, and write the thresholds down.
- Test suites in CI. Run evaluation sets on every model or prompt change and store results with the build.
- Security and resilience. MEASURE 2.7 requires evaluating and documenting security and resilience. Include prompt injection tests, dependency scans, secrets checks and failure tests. I am not giving attack payloads here.
- Privacy. MEASURE 2.10 covers privacy risk. Check what personal data enters prompts, logs and training sets.
- Production monitoring. MEASURE 2.4 expects behaviour to be monitored in production. Track quality, drift, error rates and unusual inputs.
Manage: respond and switch off
- Kill switch. MANAGE 2.4 expects mechanisms to supersede, disengage or deactivate systems that behave outside intended use. Provide a feature flag or routing rule, test it, and name who may use it.
- Third party risk. MANAGE 3.1 covers risks from third party resources. Pin versions, watch for provider changes and have a fallback.
- Post deployment plan. MANAGE 4.1 mentions user input, appeal and override, incident response, recovery and change management. Add feedback capture and a rollback procedure.
- Incidents. MANAGE 4.3 asks for tracking and communication of incidents and errors. Use your existing incident tool with an AI tag.
What evidence should you save?
Inventory exports with dates, component lists, test reports tied to commits, monitoring dashboards and alerts, change logs, kill switch tests, incident tickets, and review notes. Keep them in one place by system.
What to do
- Build the AI system inventory from code and cloud data.
- Generate a component list for every AI service.
- Define metrics and thresholds, then run tests in CI.
- Add security, privacy and bad input checks.
- Monitor production behaviour and set alerts.
- Build and test a deactivation path.
- Tag AI incidents and review them monthly.
- Revisit the checklist when NIST publishes its revision.
Quick check
Is the NIST AI RMF certifiable?
NIST describes it as voluntary guidance. Its page lists no certification scheme, so any attestation would come from a third party's own methodology.
Is the Playbook a checklist?
No. NIST says its suggestions are voluntary and not a set of steps to follow in full.
How Safeguard helps automate this
Much of this list depends on knowing what is in your software. Safeguard's compliance suite covers frameworks, controls, evidence, continuous monitoring, automated tests and questionnaires, so evidence is collected from connected systems and code instead of by screenshot, and monitoring runs continuously between reviews. Technical evidence comes from your real code and dependencies, using scans, SBOMs and reachability, which fits the component record and the security testing items. Safeguard's agent can open tested fix pull requests for vulnerable dependencies and other findings. It is off by default, every category starts on Manual, and you choose which categories run automatically and at what approval level. Safeguard helps prepare and keep evidence ready. Book a call to see it.
Sources
- NIST, AI Risk Management Framework (AI RMF 1.0, NIST AI 100-1)
- NIST, AI RMF overview page
- NIST AIRC, AI RMF Playbook
Last reviewed: 18 October 2026.
