The NIST AI Risk Management Framework is voluntary guidance for managing AI risk through four functions: Govern, Map, Measure and Manage. A product manager's decisions are which AI features to cover, who owns each risk, how much risk is acceptable, and what must be true before release.
What is the AI RMF?
NIST released it on 26 January 2023 for voluntary use, to help build trustworthiness into the design, development, use and evaluation of AI products, services and systems. A companion Playbook offers suggested actions for the four functions, and NIST says organizations may borrow as many or as few as fit. NIST also notes the AI RMF 1.0 is being revised as part of the White House AI Action Plan, so check for updates.
Which decisions belong to product?
Scope. Do you apply it to all AI features or start with the one that touches the most users or sensitive data? Starting narrow is fine.
Ownership (Govern). Every AI feature needs a named accountable person, and a path to escalate concerns. If product owns the feature, product likely owns the answer.
Context (Map). Who uses the feature, who else is affected, what could go wrong, and what is it not meant to do? Writing this down is the cheapest risk work you will do.
Measures (Measure). Choose tests that match the risks you named: accuracy on realistic inputs, behavior on edge cases, bias checks where decisions affect people, security testing for misuse. Decide pass thresholds before you see results.
Response (Manage). Decide the release gate, monitoring after launch, rollback plan and who can switch the feature off.
A constructed example
A product team adds an AI summarizer to a claims tool. In Govern, the PM is named owner and legal is a reviewer. In Map, the team writes that summaries may omit a key fact and an adjuster might rely on them. In Measure, it tests summaries against a set of real claims and sets a minimum for omission rate. In Manage, summaries ship with a source link, adjusters can flag errors, and a flag rate above a stated level triggers review. None of this needs a certificate; it needs written decisions.
How does it relate to laws and standards?
It is not a law or a certification. Laws such as the EU AI Act have their own duties, and a standard like ISO 42001 can be certified. The AI RMF can inform both, but do not claim compliance with a law because you followed it.
How to apply it
- List AI features and pick the first to cover.
- Name an owner and reviewers.
- Write a one page context note: users, harms, limits.
- Choose tests and thresholds in advance.
- Define the release gate and post launch monitoring.
- Plan how users report problems.
- Review after launch and at each major change.
Safeguard's policies and gates, guardrails and compliance automation can support enforcing parts of this, such as blocking releases that miss defined checks, though the risk decisions stay with you.
What goes wrong in practice?
Teams write a long document once and never revisit it. Others pick measures that are easy rather than relevant, such as overall accuracy when the risk is a rare costly error. Some skip Govern because it feels abstract, then no one owns the feature when a complaint arrives. Keep it small: a one page context note, a short test plan with thresholds, a release checklist and a named owner. Review it whenever the model, the data or the use case changes, since each can shift the risk. And record decisions you rejected, with reasons, because they show your process worked.
Quick check
Is the AI RMF mandatory?
No. NIST describes it as voluntary.
Who should own AI risk for a feature?
A named person accountable for the feature, usually its product owner, with legal and security as reviewers.
Sources
- NIST AI Risk Management Framework
- NIST AI RMF Playbook
- European Commission, AI Act regulatory framework
Last reviewed: 18 October 2026.
