The NIST AI Risk Management Framework gives buyers a structure for vendor questions, built around four functions: Govern, Map, Measure, and Manage. It is voluntary, so no vendor is required to follow it, but you can use each function as a heading for the questions you ask.
What the framework is
NIST released AI RMF 1.0 on 26 January 2023. It is intended for voluntary use by organizations that design, develop, use, or evaluate AI products and systems. NIST later published a Generative AI Profile, NIST AI 600-1, on 26 July 2024. The NIST page notes that the framework is being revised, so check the current version before you cite it in a policy.
Using the framework as a question guide is not the same as claiming compliance with it. There is no certification attached.
Turning the four functions into vendor questions
| Function | Question for the vendor |
|---|---|
| Govern | Who is accountable for this feature, and what policies cover it? |
| Map | What is the intended use, and what uses are out of scope? |
| Measure | How do you test accuracy, and how often? Can we see results? |
| Manage | What happens when it fails, and how do you respond to issues? |
These map neatly to a buyer's worries. Govern is about ownership. Map is about fit. Measure is about proof. Manage is about the bad day.
A worked example
Suppose a vendor offers AI generated remediation. Govern: who approves the feature's release and reviews incidents? Map: which vulnerability categories is it meant for, and which are excluded? Measure: what share of proposed fixes pass review in the vendor's own tests, and on what sample? Manage: what is the rollback path if a fix is bad, and can we require human approval?
Notice that none of these questions needs a specialist. They need a vendor willing to answer in specifics.
Keep your own program aligned
If you build or deploy your own AI features, you can apply the same four functions internally. Many teams find it easier to ask vendors for what they already ask of themselves. Record your answers in the same register you use for other supplier reviews.
Try it yourself
Click through it at your own pace, or open it full screen.
See how controls are mapped to a framework, and apply the same mapping habit to your vendor questions.
Where Safeguard fits
Safeguard offers compliance and evidence automation that can help you organize control mapping. It does not claim certification against any framework named here.
Quick check
Is the AI RMF mandatory?
No. NIST describes it as intended for voluntary use.
Can a vendor be certified against it?
There is no certification attached to the framework itself. Be cautious of anyone who claims one.
Sources
- NIST, AI Risk Management Framework: https://www.nist.gov/itl/ai-risk-management-framework
Last reviewed: 19 October 2026.
