How to Apply the NIST AI Risk Management Framework to Your Business

Managing AI risk has become one of the most pressing challenges for IT and compliance leaders. Most organizations are already using AI across business functions, embedded in recruiting software, customer support tools, financial systems, and everyday productivity apps, and most of them lack formal governance structures to manage what could go wrong.

The risks are not hypothetical. AI systems can produce inaccurate outputs, encode historical bias into consequential decisions, expose sensitive employee or customer data, and create regulatory liability in jurisdictions where AI oversight requirements are actively tightening. At the same time, slowing down AI adoption to wait for perfect governance is not realistic for organizations that need to stay competitive.

The NIST AI Risk Management Framework (AI RMF) was designed precisely for this tension. It provides a practical structure for adopting AI responsibly without treating governance as a bottleneck. This article covers what the framework is, why AI requires a different approach to risk than traditional software, how each of the four core functions works in practice, and what a realistic implementation roadmap looks like.

What is the NIST AI Risk Management Framework?

The NIST AI RMF 1.0 is a voluntary framework that helps organizations identify, assess, and manage AI risks throughout the AI lifecycle. Published by the U.S. National Institute of Standards and Technology (NIST) in January 2023, it was developed through a consensus-driven process involving more than 240 organizations across industry, academia, civil society, and government. The framework applies to any organization building AI systems internally, deploying AI-enabled third-party products, or purchasing AI-powered software from vendors.

The AI RMF focuses on governance, accountability, transparency, and continuous risk management. Rather than prescribing specific technical controls, it provides a flexible structure that organizations can adapt to their own risk profile, industry, and regulatory environment. Because it is voluntary and technology-neutral, it has been widely adopted beyond the U.S. and aligns closely with emerging regulations such as the EU AI Act.

The framework includes:

• Four core functions: Govern, Map, Measure, and Manage
• 19 categories organized across those functions
• 72 subcategories that provide more detailed guidance

In July 2024, NIST expanded the framework with the Generative AI Profile (NIST AI 600-1), which addresses risks unique to large language models and generative AI systems, including confabulation, prompt injection, and harmful bias. Organizations deploying generative AI should use both the core AI RMF and the Generative AI Profile together.

NIST also provides a companion AI RMF Playbook, which offers suggested actions, references, and implementation guidance for each of the four core functions. Rather than serving as a checklist, the Playbook is designed to help organizations adopt the recommendations that best fit their AI governance program.

Why AI requires a different approach to risk management

Traditional software is designed to produce predictable results: the same input should produce the same output, and failures are generally easier to identify and fix. AI systems work differently. Their outputs can vary depending on the model, data, and context, and their performance can change over time as models evolve. As a result, organizations must manage risks that go beyond security and reliability, including inaccurate outputs, bias, privacy, and regulatory compliance.

The table below outlines the key differences between traditional software and AI systems from a risk management perspective:

Because AI systems are less predictable and can have far-reaching business and human impacts, managing AI risk requires more than security and software maintenance. Organizations need governance processes that support ongoing monitoring, human oversight, and cross-functional collaboration—areas that the NIST AI RMF is designed to address.

The four core functions of the NIST AI Risk Management Framework

The NIST AI RMF organizes AI risk management into four interconnected functions: Govern, Map, Measure, and Manage. Rather than following a linear process, these functions operate as a continuous cycle throughout the AI lifecycle. Govern establishes the foundation for AI governance, while Map, Measure, and Manage help organizations identify, assess, and respond to AI risks as systems evolve.

Govern: establishing policies, accountability, and culture

The Govern function establishes the policies, ownership, and oversight needed to manage AI responsibly. Without clear accountability, documented policies, and executive support, risk assessments and monitoring programs have little authority to drive action.

Key activities include:

• Assigning clear accountability for AI risk management to a specific leader, typically the CISO, CIO, Chief Risk Officer, or a newly defined Chief AI Officer
• Establishing AI usage policies and acceptable use guidelines that define approved tools, permitted data, and prohibited uses
• Building cross-functional collaboration between IT, security, legal, HR, compliance, and business teams
• Defining executive oversight structures and decision-making responsibilities for AI approvals
• Creating governance documentation and processes that evolve alongside AI adoption

Common outputs include an AI Governance Charter, which defines ownership, governance objectives, and oversight responsibilities, and an AI Acceptable Use Policy, which specifies approved tools, prohibited uses, and data handling requirements.

For distributed organizations, governance also means enforcing AI policies through device and access management—not just documenting them. This is where IT management tooling becomes an essential part of AI governance.

Map: understanding context, stakeholders, and potential harms

Before risks can be assessed, they first need to be identified. The Map function helps organizations build a clear picture of each AI system in use, including its purpose, the stakeholders it affects, the data it relies on, and the ways it could cause harm.

Key activities include:

• Documenting each AI system's intended purpose and business objectives
• Identifying stakeholders who interact with or are affected by the system, including employees, customers, job applicants, and third parties
• Assessing potential risks before deployment, such as bias, privacy issues, inaccurate outputs, and business disruption
• Evaluating data sources, third-party vendors, and operational dependencies
• Identifying potential impacts on individuals, the organization, and broader ecosystems

For example, before deploying an AI-powered recruiting tool, organizations should document the tool's purpose, identify affected stakeholders, assess potential bias in training data, evaluate how candidate data is processed and stored, and define which decisions the tool informs versus automates. For more on governing AI in hiring, see Deel's guide to AI in HR.

The Map function also includes identifying shadow AI—tools employees adopt without central oversight. Maintaining a complete inventory is often one of the most challenging parts of AI governance, particularly as organizations adopt SaaS applications with embedded AI features and employees increasingly use public generative AI tools. Effective discovery processes, including device-level application visibility, are essential for keeping that inventory current.

Measure: testing, monitoring, and quantifying risk

The Measure function focuses on evaluating AI systems for accuracy, reliability, fairness, security, and resilience. Rather than treating risk assessment as a one-time checkpoint before deployment, it emphasizes continuous monitoring as AI systems, data, and business requirements change.

Key activities include:

• Testing AI systems against defined performance benchmarks before and after deployment
• Monitoring for bias, model drift, performance degradation, and unexpected outputs over time
• Assessing risk based on business impact as well as technical performance
• Conducting fairness audits to identify disparate outcomes across demographic groups
• Reviewing whether AI systems continue to meet organizational expectations as models, data, and use cases evolve
• Tracking metrics that support informed risk management decisions and executive reporting

A common implementation challenge is investing in governance and risk mapping without establishing the measurement capabilities needed to monitor AI systems in practice. Building metrics, testing processes, and monitoring for high-priority AI systems early helps ensure governance extends beyond documentation.

Manage: prioritizing, treating, and monitoring risks

The Manage function focuses on responding to identified risks. It covers prioritizing risks based on their likelihood and business impact, selecting appropriate treatment strategies, and establishing processes for responding when AI systems fail or behave unexpectedly.

The framework outlines four common risk treatment strategies:

• Mitigate: Implement controls to reduce the likelihood or impact of a risk.
• Accept: Document and accept a risk that falls within the organization's defined tolerance.
• Transfer: Shift responsibility for a risk through contractual agreements, insurance, or third-party providers.
• Avoid: Decide not to deploy or continue using an AI system if the risk is unacceptable.

The Manage function also requires organizations to prepare for AI-related incidents. Response plans should define how to detect harmful outputs, contain their impact, notify affected stakeholders when appropriate, and improve the system or its governance controls to reduce the likelihood of recurrence.

Together, the Measure and Manage functions create a continuous feedback loop that helps organizations adapt as AI systems evolve, turning AI risk management into an ongoing operational practice rather than a one-time compliance exercise.

Applying the framework in your organization

Implementing the NIST AI RMF is an ongoing program rather than a one-time project. Most organizations begin by applying the framework to their highest-risk AI systems before expanding it across their broader AI portfolio. This phased approach helps teams build governance capabilities while focusing resources where they matter most.

Step 1: Identify AI already in use

The first step is understanding where AI is already being used across the organization. In most businesses, this includes four categories:

• Enterprise AI platforms: centrally procured and managed AI tools
• Third-party SaaS with embedded AI: applications such as CRMs, ATSs, productivity suites, and customer support platforms that include AI features
• Public generative AI tools: services such as ChatGPT, Claude, and Copilot that employees use for work
• Shadow AI: tools adopted by teams or individuals without IT or procurement approval

For each system, record its purpose, business owner, vendor or model, data flows, deployment environment, applicable jurisdictions, and an initial risk rating. This inventory becomes the foundation for ongoing AI governance and supports the Map function of the framework.

Step 2: Classify AI systems by risk

Governance should be proportionate to the level of risk each AI system presents.

• Low risk: Productivity tools that assist employees without making or influencing significant decisions, such as writing assistants or code completion tools
• Medium risk: Customer-facing AI that shapes user experiences or provides recommendations, such as chatbots or recommendation engines
• High risk: AI systems used in hiring, performance management, financial decision-making, access control, healthcare, or other scenarios where outputs can materially affect individuals

Higher-risk systems typically require documented approval processes, pre-deployment testing, human oversight, and more frequent reviews. Lower-risk tools may only require an acceptable use policy and inclusion in the organization's AI inventory.

For organizations operating in or selling into the EU, this type of risk classification is increasingly becoming a regulatory requirement under the EU AI Act. Deel's guide to AI in HR management and European regulation explains how these requirements apply to workforce decisions.

Step 3: Establish AI governance processes

Once you've identified and classified AI systems, put governance processes in place to manage them consistently.

These typically include:

• AI usage policies covering approved tools, prohibited uses, and data handling requirements
• Approval workflows for evaluating new AI tools
• Documentation standards covering model provenance, intended use, and key risks
• Assigned business owners who are accountable for each AI system
• Security, privacy, and compliance reviews before deployment

The complexity of these processes should reflect the organization's size and risk profile. Smaller organizations may be able to manage governance with an AI Governance Charter and an Acceptable Use Policy, while larger enterprises often establish dedicated AI governance committees and integrate AI oversight into existing GRC processes.

Step 4: Monitor AI continuously

AI governance doesn't end once a system is deployed. Ongoing monitoring ensures AI systems continue to perform as expected and that new risks are identified as models, data, and business requirements evolve.

Continuous monitoring should include:

• Performance reviews against established benchmarks
• Bias assessments for AI systems that influence employment, customer, or financial decisions
• Reviews of third-party AI vendors as their models, data practices, or terms change
• Monitoring for AI-specific security threats, including prompt injection and unauthorized data exposure
• Human oversight for consequential AI-assisted decisions
• Regular reviews of the AI inventory as new tools are introduced

For organizations managing distributed workforces, maintaining an accurate inventory of AI applications is difficult to do manually. Automated discovery and application management tools help organizations keep pace with rapid AI adoption and provide the visibility needed to support continuous governance. This is especially important as organizations begin deploying autonomous AI agents, which introduce new governance challenges explored in our guide to agentic AI risk management.

How the NIST AI RMF fits into the broader AI governance landscape

The NIST AI RMF is designed to complement—not replace—other AI governance standards, cybersecurity frameworks, and regulatory requirements. Organizations often use it alongside the following:

• ISO/IEC 42001: An international standard for AI management systems. While the NIST AI RMF provides a framework for identifying and managing AI risks, ISO 42001 defines the governance processes needed to achieve a certifiable AI management system. Many organizations use the two together.
• NIST Cybersecurity Framework (CSF): Organizations with mature cybersecurity or GRC programs can extend existing governance processes to include AI risk, rather than creating a separate program.
• EU AI Act: The EU AI Act introduces legal obligations based on the level of risk an AI system presents. The NIST AI RMF can help organizations operationalize many of these requirements and align governance with regulatory expectations.
• Colorado AI Act: Colorado's AI Act is one of the first U.S. state laws to explicitly recognize alignment with the NIST AI RMF as evidence that an organization has taken reasonable steps to manage AI risk.

Rather than treating AI governance as a standalone initiative, most organizations achieve better results by integrating the AI RMF into their existing governance, risk, and compliance (GRC) processes.

How Deel helps organizations adopt AI responsibly

Building an AI governance program requires more than policies—it also requires tools that help organizations use AI safely and at scale. Deel combines AI innovation with governance-minded controls to help organizations adopt AI with confidence.

• Deel IT helps organizations manage AI use across company-managed devices.
• Akai by Deel enables operations, finance, and HR teams to automate repetitive workflows with AI agents—without coding or complex integrations.
• Built for responsible automation: Akai includes role-based access controls (RBAC), human approval for sensitive actions, encrypted credential management, and comprehensive audit trails, helping organizations automate with greater oversight and confidence.

As organizations expand their use of AI, the ability to innovate responsibly becomes a competitive advantage. With solutions like Deel IT and Akai, organizations can scale AI adoption while maintaining the visibility, oversight, and controls needed to manage risk.

Book a demo to find out more.