BY NEURABYTE
FRAMEWORKS/AI/NIST AI RMF
RMF
AI · NIST

NIST AI RMF

Govern, Map, Measure, Manage.

The AI Risk Management Framework (AI 100-1, January 2023) is a voluntary framework for managing risks of AI systems. It organizes practice into four functions and defines trustworthiness characteristics: valid and reliable, safe, secure and resilient, accountable and transparent, explainable, privacy-enhanced, fair. A Generative AI Profile followed in 2024.

AT A GLANCE
ISSUERNIST REGIONUnited States, voluntary CATEGORYAI CROSSWALKVersioned mapping onto the 15-control registry
EVIDENCE, NOT CERTIFICATION
01. WHO IT APPLIES TO

Is this one yours?

01US organizations building or deploying AI with no binding regulation yet
02Federal contractors, where agencies reference the RMF
03Teams that want a structure before the law arrives
02. KEY REQUIREMENTS

The parts of NIST AI RMF that touch what agents do.

GOVERN 1.7
Processes for decommissioning and phasing out AI systems safely.
MAP 2.3
Scientific integrity and test, evaluation, validation, and verification considerations are documented.
MEASURE 2.7
AI system security and resilience are evaluated and documented.
MANAGE 2.2
Mechanisms are in place to sustain the value of deployed systems, including human oversight and override.
03. HOW LORE MAPS TO IT

Enforcement controls, read against the requirement.

These controls exist because the platform needs them to run safely. The crosswalk reads their signed evidence against NIST AI RMF. Where there is no evidence, the report says gap.

LORE CONTROL NIST AI RMF REFERENCE
Blocking authorization gateGOVERN 1.7, MANAGE 2.2
Maker–checker approvalMANAGE 2.2, GOVERN 3.2
Signed, hash-chained receiptsMEASURE 2.7, GOVERN 1.5
Context disclosure recordMAP 2.3, MEASURE 2.10
Illustrative references. The shipped crosswalk carries exact clause citations, its version, and the review date.
04. OUT OF SCOPE

What Lore will not claim.

Fairness and bias measurement depend on your models and data.
Governance roles and risk tolerance are organizational.
05. QUESTIONS
Is the RMF mandatory?
No. It is voluntary, but it is the reference most US agencies and procurement teams cite.
Does the GenAI Profile matter?
Yes for agent deployments. It adds suggested actions on confabulation, information integrity, and human-AI configuration.
How does it relate to ISO 42001?
Different shapes, similar goals. The RMF is a framework; 42001 is a certifiable management system.
← PREVIOUSEU AI Act ALL FRAMEWORKS NEXT →ISO 42001
NIST AI RMF · EARLY ACCESSEVIDENCE COLLECTED ONCE

Start building the record your auditor will read.

Every receipt Lore signs today is evidence for NIST AI RMF tomorrow. Turn the crosswalk on when you are ready; nothing needs re-collecting.

Also from Neurabyte: Cupel
Lore's core mechanisms are patent-pending. Product names are trademarks of their respective owners; listing an integration doesn't imply a partnership.
© 2026 NEURABYTE INC.