Next to your security program
AI risk evidence in the same record as your FISMA, FedRAMP or CMMC controls.
Platform →- Home
- NIST AI RMF
AI risk, backed by the same evidence
The NIST AI Risk Management Framework asks organizations to govern, map, measure and manage AI risk, and OMB's 2025 memos set how agencies use and buy AI. NISTcompliance.ai keeps the security evidence behind your AI systems in the same evidence base as your FISMA, FedRAMP or CMMC work.
Runs inside Quzara Cybertorch: FedRAMP Certified, Rev5 Class D (High)SOC 2 Type 2
What NISTcompliance.ai does
AI systems on the same evidence base
Assessor workspace
Evidence and history your assessor can trace, with access you control.
Assessor workspace →Continuous monitoring
Evidence collected on a schedule and mapped to your controls, so the record never goes stale between assessments.
Continuous monitoring →Functions
Four functions
Govern
A cross-cutting function that informs and runs through the other three.
Map
Establishes the context to frame risks related to an AI system.
Measure
Analyzes, assesses and tracks AI risks and their impacts.
Manage
Allocates resources to mapped and measured risks on a regular basis.
Sources: NIST AI 100-1. Sources checked Oct 23, 2026. Not a substitute for the official text.
Trustworthy AI
Seven characteristics to evidence
Valid and reliable
The system does what it is meant to, consistently.
Safe
It does not endanger people, property or the environment.
Secure and resilient
It withstands attack and recovers from disruption.
Accountable and transparent
People can see how it works and who answers for it.
Explainable and interpretable
Its outputs can be understood in context.
Privacy-enhanced
It protects personal information by design.
Fair, with harmful bias managed
Bias is identified, measured and managed.
Sources: NIST AI 100-1. Sources checked Oct 23, 2026. Not a substitute for the official text.
Companion work
What NIST has added since 1.0
AI 600-1FACT
Generative AI Profile
A cross-sectoral profile of the AI RMF for generative AI, released July 26, 2024.
AI 100-2 E2025FACT
Adversarial machine learning
A taxonomy and terminology for adversarial machine learning, final March 24, 2025.
IR 8596FACT
Cyber AI Profile
A preliminary draft released December 16, 2025. No later draft has been published as of October 2026.
AI RMF 1.0FACT
Under revision
NIST states AI RMF 1.0 is being revised as part of the White House AI Action Plan.
Sources: NIST AI 600-1, NIST AI 100-2 E2025, NIST IR 8596 draft, NIST AI RMF. Sources checked Oct 23, 2026. Not a substitute for the official text.
OMB AI policy
Using AI: OMB M-25-21
Issued April 3, 2025. Rescinds and replaces M-24-10.
M-25-21MUST
Chief AI Officer
Agencies designate a Chief AI Officer.
M-25-21MUST
AI strategy
CFO Act agencies publish an AI strategy within 180 days, by Sep 30, 2025.
M-25-21MUST
Use case inventory
Agencies inventory their AI use cases at least annually. DoD and the Intelligence Community are excepted.
M-25-21MUST
High-impact AI
Agencies document implementation of minimum practices for high-impact AI within 365 days, by Apr 3, 2026.
Sources: OMB M-25-21. Sources checked Oct 23, 2026. Not a substitute for the official text.
OMB M-25-22 and M-26-04
Buying AI: OMB M-25-22 and M-26-04
M-25-22MUST
Protect agency data
Contracts permanently prohibit using nonpublic agency inputs and outputs to train publicly or commercially available AI, absent explicit agency consent.
M-25-22MUST
Avoid lock-in
Acquisitions protect government data and IP rights and guard against vendor lock-in.
M-25-22FACT
When it applies
Applies to contracts awarded under solicitations issued, and options exercised, 180 or more days after April 3, 2025.
M-26-04MUST
Unbiased AI principles
Issued December 11, 2025, it sets contract terms for large language model procurement in new solicitations.
Sources: OMB M-25-22, OMB M-26-04. Sources checked Oct 23, 2026. Not a substitute for the official text.
Questions
Common questions
Is the NIST AI RMF mandatory?
No. NIST released the AI RMF for voluntary use. Federal agencies follow OMB M-25-21 for their use of AI, including minimum practices for high-impact AI, and M-25-22 for acquiring it.
Is AI RMF 1.0 still current?
Yes. AI RMF 1.0 remains the current version, and NIST states it is being revised as part of the White House AI Action Plan. The Generative AI Profile, NIST AI 600-1, was released July 26, 2024.
Book a demo
Govern AI with evidence
We will show how your existing evidence base supports your AI risk work.