NIST AI RMF: Understanding The Risk Management Framework

The National Institute of Standards and Technology AI Risk Management Framework, or NIST AI RMF, is voluntary guidance from the National Institute of Standards and Technology, built to help organizations identify, assess, and manage risk across an AI system's entire lifecycle.¹ AI risk management matters because AI systems don't fail the way traditional software does: a model can pass every pre-production test and still make things up, drift, or return the wrong answer once it hits live data and edge cases. Managing that risk is the job increasingly landing on chief information officers (CIOs), chief data officers (CDOs), chief data and analytics officers (CDAOs), and chief operating officers (COOs).

NIST AI RMF is technically voluntary, but it's already showing up in the places that decide whether an AI program gets funded, audited, or shut down:

• The General Services Administration (GSA)'s proposed federal contract clause for AI systems maps contractor roles and documentation requirements directly to the roles that NIST AI RMF lays out for everyone with a hand in an AI system, from developers to deployers.² It’s a preview of how the framework is shaping federal procurement. 

• The U.S. Treasury's Financial Services AI Risk Management Framework, released in February 2026, goes further, giving financial institutions sector-specific guidance built directly on NIST's framework.³ It’s proof that the NIST AI RMF is becoming the base layer that regulators build compliance expectations on.

In this article, Alation governance experts break down what the NIST AI risk management framework actually is, how it stacks up against International Organization for Standardization (ISO) 42001, the international certifiable standard for AI management systems, what the four core functions mean in practice, and what it takes to move from governance-on-paper to governed AI in production.⁴

How does the NIST AI RMF build trust in AI?

The NIST AI RMF's purpose is narrow and practical: build trustworthiness into AI systems across the whole lifecycle, including design, development, use, and evaluation. Traditional risk frameworks assume deterministic software, where the same input reliably produces the same output. AI breaks that assumption: it depends on data that drifts, fails in ways that are hard to predict or detect, and isn't subject to the same testing controls as traditional software. NIST AI RMF exists specifically to manage risk in systems like that.⁵

3 layers of specificity 

The framework's approach is to break AI risk management into three layers of increasing specificity, until it stops being a vague mandate and becomes an assignable plan:

• Its 4 core functions are Govern, Map, Measure, and Manage.  Each is responsible for a distinct kind of risk work, together covering a system's full lifecycle instead of a single point-in-time review.

• There are 19 categories nested under those functions. Each names an actual risk domain, like accountability structures under Govern and third-party risk under Map, so the mandate has a defined list behind it.

• 72 subcategories exist with specific suggested actions. This is the level a team actually executes against: concrete and assignable, not a principle someone has to interpret.

Putting this into practice

Operationalizing the framework means naming one owner per category and treating the 72 subcategories as an actual task list Under Govern, for example, that means documenting who's accountable for AI risk decisions and how an issue gets escalated. It’s a specific person the rest of the team knows to go to when something breaks. Do that across all 72 subcategories, revisited every time a system, its data, or its use case changes, and you get an operating rhythm instead of a compliance snapshot.

Generative systems introduce failure modes the original 2023 framework wasn't written to cover, so NIST added a Generative AI Profile (NIST AI 600-1) in July 2024.⁶ This layers 12 GenAI-specific risks onto the core framework, including confabulation, data privacy exposure, and prompt injection.You still work through Govern, Map, Measure, and Manage; the profile just adds suggested actions where generative AI applies.

That's what makes the framework trust-building rather than just trust-claiming: a category is easy to assert compliance with in the abstract, but a subcategory with a specific action leaves no room to believe you're covered when you're not. 

What are the 7 characteristics of trustworthy AI, according to NIST?

NIST's AI RMF exists to make AI systems trustworthy, not just documented. That means someone owns the system's risk, its decisions can be traced after the fact, and a human can understand why it produced a given output and correct it when it's wrong. 

NIST names seven specific, testable characteristics a system needs to earn that trust:

1. Valid and reliable

An AI system must perform accurately and consistently, not just in testing but under the real conditions it's actually deployed in. This is the baseline for AI risk management: every other characteristic on this list assumes a system is valid and reliable in the first place. NIST confirms it through ongoing testing against realistic test sets that mirror live deployment.

Example: McDonald's tested AI-powered drive-thru voice ordering with IBM in more than 100 restaurants starting in 2021, targeting 95%-plus order accuracy before wider rollout.⁷ A 2022 industry report found real-world accuracy in the low-80% range instead. It was a gap that became public fodder on social media as customers shared mishandled orders. McDonald's ended the IBM partnership in June 2024, shutting the system off by July 26.

2. Safe

According to the NIST AI RMF, a safe AI system is one that doesn't endanger life, health, property, or the environment. That's supported by simulation and in-domain testing before deployment, real-time monitoring after, and the ability to shut down, modify, or hand control back to a human the moment the system drifts from its intended behavior.

Example: Before any hospital considered using ChatGPT for clinical diagnosis, researchers ran it against 100 real pediatric case challenges and found an 83% error rate: 72% flatly wrong, 11% too vague to count as a real diagnosis.⁸ Because that testing happened in a controlled study rather than on real patients, the risk was caught before it could cause harm, which is exactly the role in-domain testing before deployment is supposed to play. 

3. Secure and resilient

Secure and resilient AI systems hold up against attacks and adverse events, protecting against adversarial inputs, data poisoning, and model or data theft. When something does go wrong, the NIST AI risk management framework requires that systems degrade safely rather than failing all at once.

Example: An AI coding agent from Replit deleted a live company database in July 2025, in direct violation of an active "code freeze" instruction.⁹ The agent later admitted to running unauthorized commands and initially told the user a rollback wasn't possible. This was before the data was in fact recovered manually, suggesting the agent had misrepresented its own error.

4. Accountable and transparent

Under NIST AI RMF, people responsible for an AI system's decisions must be able to be identified, and information about how it was built, trained, and deployed must be available and traceable. This way, a team can find and correct a wrong output rather than trying to guess at what it is and how to fix it.

Example: Families of deceased UnitedHealth Medicare Advantage members sued the company in 2023, alleging it used an AI tool called nH Predict (with a claimed 90% error rate) to override physicians' own determinations about how much post-acute care patients needed.¹⁰ UnitedHealth's position was that the tool was never a decision-maker at all, only "a guide" for care coordination, leaving no clear answer as to who was actually accountable for the coverage cutoffs patients experienced. 

5. Explainable and interpretable

These are two different things. Explainability means the system can show how it reached a decision. It’s the actual mechanism. Interpretability means the person affected by that decision can understand what it means for them, in plain language, without needing to read the mechanism itself.

Example: In August 2024, Florida police arrested Robert Dillon after facial recognition software flagged him as a 93% match to a suspect in a different city, 300 miles from Dillon's home.¹¹ The arresting officer treated that number as near-certain proof of identity. But the agency that owns the tool later said the figure was never meant to be read that way. The plain-language number was easy to read, and, on its own, impossible to correctly interpret. Charges were dropped weeks later.

6. Privacy-enhanced

An AI system must protect autonomy, identity, and dignity. Under NIST AI RMF, it does this through privacy-enhancing techniques like de-identification and aggregation, which limit what the system observes. It also preserves a person's ability to consent to, or control, disclosure of their own data.

Example: Italy's data protection authority fined Luka Inc., maker of the AI companion chatbot Replika, €5 million in May 2025 for GDPR violations.¹² The regulator found the company had no valid legal basis under GDPR for processing users' personal data, including conversations that routinely include relationship, sexual, and mental-health content. The company also had no real age-verification system, despite claiming the service excluded minors. Users could sign up with just a name, email, and gender, with no check on whether "18 or older" was true.

7. Fair, with harmful bias managed

Equity is surfaced and actively managed, not assumed. The NIST AI risk management framework names three separate sources of bias to catch: bias baked into the data, bias in how the organization operates, and bias in how people interpret the system's output. Fixing one doesn't fix the others.

Example: Derek Mobley, a Black man over 40 who says he lives with depression and anxiety, applied to more than 100 jobs at companies using Workday's AI-powered applicant screening system, and he was rejected every time. He sued, alleging the system discriminated against him based on his race, age, and disability.¹³ A federal court ruled in 2024 that Workday itself, not just the employers using its software, could be held liable for the alleged discrimination, since the AI's screening decisions functioned as the employer's decision.

Getting all seven characteristics right isn't one team's job. NIST built the AI risk management framework around a distinct set of actors, each responsible for a different piece of trustworthiness. This raises the next question: who actually owns which piece?

Who's involved: AI actors across the AI lifecycle

No single person owns AI risk end-to-end. NIST frames that shared ownership as a lifecycle spanning five dimensions:

1. Application Context

2. Data & Input

3. AI Model

4. Task & Output

5. People & Planet

That lifecycle moves through stages from plan and design, to build and verify, to deploy and operate. At each stage, a different set of "AI actors" (NIST's term, borrowed from the Organization for Economic Co-operation and Development, or OECD) holds the risk.

Here's what that can look like in a live system. When a Cruise robotaxi in San Francisco struck a pedestrian who'd already been hit by a separate vehicle, the car came to a hard stop, then attempted a pullover maneuver while she was trapped underneath it, dragging her roughly 20 feet.¹⁴

That's a Task & Output failure: a maneuver built for a normal stop, applied to a scenario its Application Context never accounted for, with a real person (the People & Planet dimension) caught in between.

Engineers built and verified the maneuver logic. Safety teams were responsible for monitoring incidents once the vehicle was deployed. 

California's DMV, the outside body positioned to catch what the company's own internal actors didn't, ultimately suspended Cruise's operating permit. 

Who owns which piece, in practice

That's the handoff problem NIST AI RMF exists to close. In practice, here's how that maps out:

• A CIO, CDO, CDAO, and COO set risk tolerance, ownership, and escalation paths before a single model gets built.

• Data and AI architects or engineers contextualize each system by intended use. They're usually the first to discover the gap between what a system was built for and how it's actually being used.

• Data scientists and Test, Evaluation, Verification, and Validation (TEVV) specialists run the bias testing, accuracy benchmarks, and drift detection NIST calls for. They're the ones who know when a program is testing on paper instead of in production.

• Ops teams and analysts handle monitoring, incident response, and, critically, whether corrections actually make it back into the system.

• AI consultants and SIs are usually the ones stitching all four functions together across a client's org chart.

The problem shows up in the handoffs between these actors, which is exactly where a feedback loop either exists or doesn't. Alation's AIOS™ is built to answer the question at the core of that handoff problem: when an agent gets something wrong, was it the data an architect mapped, the context an integrator configured, or the model itself? AIOS runs data, context, agents, and governance as one system, so the fix routes back to whichever actor's layer actually broke.

NIST AI RMF vs. ISO 42001 vs. EU AI Act: What's actually different?

ISO 42001 is a certifiable standard. The NIST AI risk management framework, meanwhile, is a voluntary guidance. 

The EU AI Act is different from both. It's binding law, with legal consequences for non-compliance in the EU market.¹⁵

They're not competing options. A program built on NIST AI RMF's risk functions can sit inside an ISO 42001 management system and still satisfy EU AI Act obligations for the same underlying controls. Here’s a practical breakdown of all three:

What are the four functions of the NIST AI RMF core?

The four functions of the NIST AI RMF core are Govern, Map, Measure, and Manage. Each answers a different practical question: 

• Who's accountable when something breaks?

• Where does risk actually live inside the system?

• How do you know something's degrading before a user does?

• What happens the moment it does?

Many teams treat these four functions as a one-time checklist that they complete at launch and filed away. However, the NIST built the functions to run iteratively instead, because a system's risk profile shifts every time its data, its users, or its use case changes. 

1. Govern: The function that spans everything

Govern is the only function in the AI risk management framework that NIST designates as cross-cutting, meaning it’s infused across the other three rather than applied at the individual-system level.¹⁶

It covers:

• Leadership accountability and clear ownership: someone with real authority, not a working group, owns the organization's AI risk tolerance and answers for it.

• Written policies and risk tolerance thresholds: documented limits specific enough that a team can point to them the moment a use case falls outside bounds, not principles vague enough to justify anything.

• Roles, responsibilities, and escalation paths: a named path from "someone noticed a problem" to "someone with authority to act on it," tested before an incident, not improvised during one.

• A culture that actually rewards flagging problems: the person who catches a model's failure mode early gets credit for catching it, not blamed for slowing down a launch.

Skip this, and the other three functions, Map, Measure, and Manage, have no owner, no risk threshold to work against, and no authority to act on what they find.

2. Map: Where intended use meets actual use

Map is the function where an AI system gets contextualized. It’s about defining what it was actually built to do, who it actually touches, and what happens once its outputs leave the model, so a team has the contextual knowledge needed to make a responsible go/no-go decision about the system in the first place.¹⁷ 

Map covers:

• Intended use: what the system was actually built and approved to do, documented specifically enough to catch it drifting from that.

• Stakeholders: everyone the system's outputs touch, directly or several steps downstream, not just the team that built it.

• Downstream impacts: what happens once a decision leaves the model, where risk tends to hide because no one's watching that far down the chain.

At Alation, we’ve seen that this is where a system's intended use and its actual downstream use tend to diverge. A context layer only reflects what the business assumed its data meant when it was written, and it takes real usage to expose where that assumption was wrong. 

That drift is exactly what the next function of measurement is built to catch.

3. Measure: where governance needs infrastructure

Govern and Map can be completed largely on paper. Measure can't: it's where the seven trustworthy AI characteristics covered earlier stop being definitions and start being tested.¹⁸ The NIST AI RMF assigns each one its own dedicated testing subcategory, requiring evidence gathered on a schedule.

Three of the clearest examples:

• Bias testing against fairness: run before deployment and re-run on a schedule, not a one-time model card entry.

• Robustness testing against safety: adversarial and edge-case inputs, deliberately, not just the clean test set a model was trained to pass.

• Drift detection against reliability: ongoing comparison between what a system was validated on and what it's actually seeing in production.

Catching drift here doesn't fix it. That's the job of the next function, Manage, which decides what happens once a problem is flagged through Measure.

4. Manage: Where the loop has to actually close

Manage is the function where a flagged risk becomes a decision.¹⁹ NIST requires each risk surfaced by Measure to be explicitly treated (fixed, mitigated, accepted, or escalated) with that choice documented and revisited as conditions change.

Manage handles:

• Risk treatment: deciding whether a flagged risk gets fixed, mitigated, accepted, or escalated, and documenting which and why.

• Monitoring: tracking a system's behavior in production against the thresholds Govern set, not just checking in at launch.

• Incident response: a rehearsed process for when something breaks: who's notified, who has authority to pause the system, how fast.

• Continuous improvement: feeding what Measure catches back into the system itself, closing the loop instead of logging it and moving on.

NIST specifies what Measure and Manage each have to accomplish. It doesn't specify how a correction actually gets routed back to the right layer of the stack. That's where an AI governance framework earns its keep as a live pipeline connecting the point of failure back to whichever layer, prompt, tool, context, or data, actually broke.

A leading global automotive manufacturer is a live example of what closing that gap looks like when working with a true intelligence operating system like Alation. Agentic "vertical" planning agents and "horizontal" execution agents act as early-warning systems, detecting supply risks and monitoring inventory so planners can act before disruptions escalate.

The Alation for AI Governance eBook walks through how to operationalize a governance engine like this inside a data intelligence platform. 

NIST tells you these four functions exist; it doesn't tell you what order to tackle them in. That's what the AI RMF Playbook is for.

What is the AI RMF Playbook?

The AI RMF Playbook is NIST's companion guide to the AI RMF Core. For each of the four functions, Govern, Map, Measure, and Manage, it offers suggested actions and references for putting that function into practice.²⁰ If the NIST AI RMF Core tells you what to manage, the AI RMF Playbook tells you how. 

Under Govern, for example, the Core requires organizations to assess an AI system's potential impacts. The Playbook turns that into a specific action: establish an impact-assessment policy, and reapply it on a regular basis as the system changes.²¹

It's a living document: NIST updates it based on public comment as needed, not on a fixed schedule, so it can shift as practices mature. 

Is there an official NIST AI RMF assessment tool?

No, NIST hasn't released a single official assessment tool. What you get instead is a set of related resources:

• The AI Resource Center: a searchable hub for the playbook, roadmap, and real-world use cases.²²

• Third-party questionnaires: vendors and consultancies have built assessments mapping to the 72 subcategories — useful as aids, not as certifications.

How to run a NIST AI RMF self-assessment in 5 steps

A NIST AI RMF self-assessment runs on the same underlying logic as Alation's EU AI Act compliance roadmap: a 90-day asset inventory, near-term risk mapping, and a shift to continuous monitoring.

Here are the 5 steps, and who owns each:

1. Inventory every AI system in production, development, and pilot. This is typically owned by the CDO/CDAO.

2. Run a gap analysis against the 72 subcategories. This is often led by the AI Consultant or System Integrator (SI) on a client engagement.

3. Define your target profile of where you actually need to be. Governance/risk leads this area.

4. Build a remediation roadmap. Your COO/ops are accountable here for execution.

5. Move to continuous measurement, not one-off audits. This step belongs to whoever owns Manage, usually risk or ops.

The AI Governance Checklist is a companion download for step 1, pressure-testing whether your data is actually ready to support the systems you're running this self-assessment against.

None of these steps wait for a vendor or an auditor. The moment step five becomes a standing habit instead of a one-time push, you've effectively built your own continuous NIST AI RMF assessment, more than any third-party questionnaire can promise. Staying disciplined about that process matters as much as staying current on the framework itself.

Recent NIST AI news worth tracking

A few recent developments within AI risk management to keep on your radar include:

• February 2026: NIST's Center for AI Standards and Innovation (CAISI) launched the AI Agent Standards Initiative, with an AI Agent Interoperability Profile expected Q4 2026.²³ 

• April 2026: NIST released a concept note for an AI RMF Profile on Trustworthy AI in Critical Infrastructure. Recent NIST AI news signals that sector-specific profiles are the direction of travel.²⁴

• June 2026: The EU AI Act's Digital Omnibus amendments received final sign-off to push high-risk compliance deadlines to December 2027 (Annex III) and August 2028 (Annex I).²⁵ This is worth tracking if your AI risk management program spans both U.S. and EU obligations.

• Ongoing: AI RMF 1.0 is being revised, per NIST's own roadmap. No official name for the update exists yet.²⁶

Bookmark the NIST AI RMF page directly since this is where the latest NIST AI news lands first.¹

Frameworks tell you what. AIOS™ tells you how

Frameworks like NIST AI RMF tell you what to do: inventory your models, register your agents, track compliance. 

AIOS™ (Alation's intelligence operating system) is the how. It's the layer underneath your agents that routes every correction back to whichever part of the stack actually broke, while your knowledge stays sovereign. It’s yours, and free to move across whatever platforms your agents touch.

Frameworks alone don't get you there. What AIOS actually delivers is Governed AI: knowledge your agents consume that's accurate, improving, and defensible, so agents can operate with enough autonomy to actually transform the business. As Alation uses the term, Governed AI is a system whose accuracy compounds the longer it runs. It’s the how, working continuously, rather than a one-time answer to what.

Start a conversation.

Frequently Asked Questions

Does NIST AI RMF alignment satisfy EU AI Act conformity assessment requirements?

No. NIST AI RMF is voluntary U.S. guidance with no certification mechanism attached to it. The EU AI Act requires a formal conformity assessment for high-risk systems.²⁷ For most Annex III categories, that means self-assessment under Annex VI, not third-party review. NIST alignment doesn't substitute for that legal step, though the risk-management, documentation, and human-oversight work it asks for overlaps heavily with what Article 43 requires.

Does the NIST Generative AI Profile replace AI RMF 1.0?

No, it extends it. The Generative AI Profile (NIST AI 600-1), released July 26, 2024, layers 12 GenAI-specific risks, like confabulation and prompt injection, onto the existing four functions.⁶ You still implement Govern, Map, Measure, and Manage; the profile just adds suggested actions where generative AI is involved.

Does aligning with NIST AI RMF create a legal safe harbor?

Not anymore, in at least one state that tried it. Colorado's original AI Act offered a rebuttable presumption of compliance for organizations aligned with NIST AI RMF or ISO 42001.²⁸ That law, however, was repealed and replaced before it ever took effect. The replacement statute, signed May 14, 2026, dropped the safe harbor entirely. At the federal level, NIST AI RMF remains voluntary guidance, not a liability shield.

Who inside an enterprise actually owns NIST AI RMF implementation?

No single role does, by design. Governance and risk tolerance typically sit with the CDO or CDAO, gap analysis and technical mapping often falls to AI consultants or systems integrators, and remediation execution is a COO or operations responsibility, following the actor model built into the framework itself.

Does NIST AI RMF cover autonomous AI agents?

Not natively, and NIST has acknowledged the gap rather than folded it into the original document. AI RMF 1.0 predates agentic AI's rise; NIST's response is a separate initiative, the AI Agent Standards Initiative launched in February 2026, not a revision to the core framework itself. ²³

Sources & Notes

Every external claim on this page is independently verifiable. The public sources are listed here.

1. NIST AI RMF released January 2023, developed with public- and private-sector stakeholders. National Institute of Standards and Technology. https://www.nist.gov/itl/ai-risk-management-framework

2. GSA's proposed clause 552.239-7001 maps the "LLM System Operator" role to NIST AI RMF actor categories. Federal Register, June 17, 2026. https://www.federalregister.gov/documents/2026/06/17/2026-12205/general-services-acquisition-regulation-acquisition-of-information-and-communication-technology

3. Treasury's Financial Services AI Risk Management Framework released February 19, 2026, aligns with NIST AI RMF. — U.S. Department of the Treasury. https://home.treasury.gov/news/press-releases/sb0401

4. ISO/IEC 42001:2023 is the international standard specifying requirements for an AI management system (AIMS), published December 2023. — International Organization for Standardization (ISO). https://www.iso.org/standard/42001 

5. NIST AI RMF built specifically for the risks of probabilistic AI systems. — NIST AI 100-1, January 2023. https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf

6. Generative AI Profile (NIST AI 600-1) added July 26, 2024, covering 12 GenAI-specific risks. — NIST. https://www.nist.gov/news-events/news/2024/07/department-commerce-announces-new-guidance-tools-270-days-following

7. McDonald's tested AI drive-thru voice ordering with IBM in 100+ locations from 2021, targeting 95%+ accuracy; a 2022 BTIG report found real-world accuracy in the low 80% range. McDonald's ended the partnership, with the system shut off by July 26, 2024. Nation's Restaurant News, June 17, 2024. https://www.nrn.com/quick-service/mcdonald-s-is-ending-its-ai-drive-thru-test-with-ibm 

8. Barile J, Margolis A, Cason G, et al. Diagnostic accuracy of a large language model in pediatric case studies. JAMA Pediatrics, 2024;178(3):313-315. https://doi.org/10.1001/jamapediatrics.2023.5750 

9. A Replit AI coding agent deleted a company's production database in July 2025 during an explicit "code freeze," then reportedly misrepresented whether the data could be recovered. Fortune, July 23, 2025. https://fortune.com/2025/07/23/ai-coding-tool-replit-wiped-database-called-it-a-catastrophic-failure 

10. Families of two deceased UnitedHealth Medicare Advantage beneficiaries filed a federal lawsuit on November 14, 2023, alleging the company used an AI tool called nH Predict — which they claimed had a 90% error rate — to override treating physicians' determinations of necessary post-acute care. UnitedHealth said the tool is used only as a guide, not to make coverage decisions. CBS News, November 20, 2023. https://www.cbsnews.com/news/unitedhealth-lawsuit-ai-deny-claims-medicare-advantage-health-insurance-denials  

11. Robert Dillon was arrested in August 2024 after AI facial recognition software identified him as a "93% match" to a suspect in a case 300 miles from his home; charges were dropped weeks later. The Pinellas County Sheriff's Office, which oversees the technology, said facial recognition results "are never 'matches'" and require independent verification. ABC News, June 12, 2026. https://abcnews.com/GMA/News/man-sues-law-enforcement-alleging-ai-facial-recognition/story?id=133810835 

12. Italy's data protection authority (Garante) fined Luka Inc., maker of the AI companion chatbot Replika, €5 million on May 19, 2025, for lacking a valid legal basis for processing user data, an inadequate privacy policy, and no effective age-verification mechanism despite the company's claim that minors were excluded. Garante per la protezione dei dati personali. https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/10132048 

13. 16  Derek Mobley v. Workday, Inc., Case No. 3:23-cv-00770-RFL (N.D. Cal.). Mobley, who alleges he was screened out of more than 100 job applications through employers using Workday's AI hiring platform, sued alleging discrimination based on race, age, and disability. The court ruled July 12, 2024 that Workday could be held liable as an "agent" of the hiring employers; the case was granted preliminary collective-action certification on May 16, 2025. U.S. District Court, Northern District of California. https://storage.courtlistener.com/recap/gov.uscourts.cand.408645/gov.uscourts.cand.408645.80.0_1.pdf 

14. A Cruise robotaxi dragged a pedestrian roughly 20 feet after a hard stop; California's DMV suspended its operating permit. TechCrunch, October 24, 2023. https://techcrunch.com/2023/10/24/dmv-immediately-suspends-cruises-robotaxi-permit-in-california/

15. The EU AI Act imposes administrative fines of up to €35 million or 7% of worldwide annual turnover for non-compliance with prohibited AI practices, and up to €15 million or 3% for breaches of other operator obligations. — EU AI Act, Article 99. European Commission, AI Act Service Desk. https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-99 

16. NIST AI 100-1 designates GOVERN as "a cross-cutting function that is infused throughout AI risk management and enables the other functions of the process," while Map, Measure, and Manage apply at the individual AI-system level. NIST AI 100-1, January 2023. https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf 

17. NIST AI 100-1 describes the MAP function as establishing the context needed to frame an AI system's risks, so that "after completing the MAP function, Framework users should have sufficient contextual knowledge... to inform an initial go/no-go decision" about the system. NIST AI 100-1, January 2023. https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf 

18. NIST AI 100-1's MEASURE function includes dedicated subcategories evaluating all seven trustworthy AI characteristics in production — validity/reliability, safety, security/resilience, accountability/transparency, explainability/interpretability, privacy, and fairness (Table 3, MEASURE 2.5–2.11). NIST AI 100-1, January 2023. https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf 

19. NIST AI 100-1 describes the MANAGE function as "allocating risk resources to mapped and measured risks on a regular basis," including risk treatment plans to "respond to, recover from, and communicate about incidents or events." NIST AI 100-1, January 2023. https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf 

20. NIST's Information Technology Laboratory created the AI RMF Playbook as a companion guide for voluntary use, including suggested actions, references, and related guidance to achieve the outcomes of the AI RMF's four functions: Govern, Map, Measure, and Manage. Playbook content evolves through public comment as needed. NIST. https://www.nist.gov/itl/ai-risk-management-framework/nist-ai-rmf-playbook 

21. The AI RMF Playbook aligns suggested actions to each subcategory within the four AI RMF functions. Under Govern, one such suggestion is to "establish impact assessment policies and processes for AI systems" and verify that "assessments are applied on a regular basis." NIST AI Resource Center (AIRC). https://airc.nist.gov/airmf-resources/playbook/govern/ 

22. The NIST AI Resource Center (AIRC) is a searchable hub supporting the AI RMF, hosting the Playbook, the AI RMF Roadmap, a glossary, and real-world use cases and case studies. National Institute of Standards and Technology. https://airc.nist.gov/ 

23. NIST's Center for AI Standards and Innovation (CAISI) launched the AI Agent Standards Initiative on February 17, 2026, aiming to foster industry-led standards and protocols for secure, interoperable AI agents. National Institute of Standards and Technology. https://www.nist.gov/news-events/news/2026/02/announcing-ai-agent-standards-initiative-interoperable-and-secure 

24. NIST released a concept note for an AI RMF Profile on Trustworthy AI in Critical Infrastructure, April 7, 2026. National Institute of Standards and Technology. https://www.nist.gov/programs-projects/concept-note-ai-rmf-profile-trustworthy-ai-critical-infrastructure

25. The Council of the EU gave final approval to the Digital Omnibus on AI on June 29, 2026, deferring high-risk compliance deadlines to December 2, 2027 (Annex III) and August 2, 2028 (Annex I). Council of the European Union. https://www.consilium.europa.eu/en/press/press-releases/2026/06/29/artificial-intelligence-council-gives-final-green-light-to-simplify-and-streamline-rules/

26. AI RMF 1.0 is being revised; no successor name has been officially assigned by NIST. NIST AI RMF Roadmap. https://airc.nist.gov/AI_RMF_Knowledge_Base/Roadmap

27. EU AI Act Article 43: most Annex III high-risk systems use self-assessment (Annex VI, internal control); only certain biometric systems may require notified-body review. — European Commission, AI Act Service Desk. https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-43

28. Colorado's SB 24-205 offered a rebuttable presumption of compliance for NIST AI RMF/ISO 42001-aligned risk management programs; repealed and replaced by SB 26-189, signed May 14, 2026, which dropped that safe harbor. — Crowell & Moring. https://www.crowell.com/en/insights/client-alerts/colorado-hits-reset-on-ai-regulation-sb-26-189-repeals-and-reenacts-the-colorado-ai-act