A deep dive into NIST AI 100-1, the voluntary AI Risk Management Framework (AI RMF 1.0) from January 2023: how it frames AI risk, what makes AI trustworthy, and the four Core functions down to the subcategories exams ask about. It ends with the current revision status, how it lines up with ISO/IEC 42001 and ADG, a worked agent-sprawl example and the common exam traps.
The AI RMF is a free guidebook from NIST, the US standards agency, for spotting and handling the ways AI can go wrong. Think of it as a good cookbook rather than a law: nobody makes you use it, it works in any kitchen, and you pick the recipes that fit your meal.
diagram
AI RMF 1.0 in one picture: four promises about how it can be used, the two parts of the document, and the companion resources NIST built around it.
Key points
NIST AI 100-1, the Artificial Intelligence Risk Management Framework (AI RMF 1.0), was released on 26 January 2023 by the National Institute of Standards and Technology (NIST).
NIST describes it as voluntary, rights-preserving, non-sector-specific and use-case agnostic, so organizations of any size, in any sector, can use it.
It was directed by the National Artificial Intelligence Initiative Act of 2020 and built in the open: a Request for Information, workshops, a concept paper and two public drafts.
Its audience is AI actors, an OECD term for those who play an active role in the AI system lifecycle, including organizations and individuals that deploy or operate AI.
Part 1 covers framing risk, the audience and trustworthy AI; Part 2 holds the Core (GOVERN, MAP, MEASURE, MANAGE) and Profiles; Appendices A to D add detail.
It defines an AI system as an engineered or machine-based system that, for given objectives, generates outputs such as predictions, recommendations or decisions.
Appendix D says it aims to be outcome-focused and non-prescriptive, law- and regulation-agnostic, and a living document rather than a one-size-fits-all rulebook.
Exam tip
If an answer calls the AI RMF mandatory, sector-specific or certifiable, it is wrong. The four words to remember are voluntary, rights-preserving, non-sector-specific and use-case agnostic.
In the AI RMF, risk is two questions put together: how likely is something bad, and how bad would it be? A wobbly ladder in a storeroom is a small risk; the same ladder over a busy sidewalk is a big one. The framework also reminds you that AI can do good, so risk work looks for upsides too.
diagram
Figure 1 of AI RMF 1.0 in plain words. The risk of any of these harms is how likely it is combined with how bad it would be.
Key points
Risk is the composite of an event's probability and the magnitude of its consequences (Section 1.1, adapted from ISO 31000:2018 and OMB Circular A-130).
Impacts can be positive, negative or both, so the AI RMF aims to minimize negative impacts and also find opportunities to maximize positive ones.
Figure 1 sorts potential harms into three groups: harm to people, harm to an organization and harm to an ecosystem.
Harm to people covers individuals (rights, safety, economic opportunity), groups (discrimination against a sub-group) and society (democratic participation, educational access).
Harm to an organization covers business operations, security breaches or monetary loss, and reputation; ecosystem harm covers financial systems, supply chains and the planet.
AI is socio-technical: risk comes from the technology mixed with how people use it, who operates it and the social setting where it is deployed.
Appendix B lists risks that are new or bigger for AI than normal software, such as stale or unrepresentative data, opacity, emergent behavior and privacy risk from data aggregation.
Exam tip
When a question asks who can be harmed, the AI RMF answer is people, organizations and ecosystems, not just the deploying company. Risk is likelihood combined with magnitude, never likelihood alone.
Section 1.2 is the honest part of the framework: it admits AI risk is hard to pin down. Think of a doctor: some symptoms are hard to measure, each patient accepts different side effects, the worst problem gets treated first, and the treatment has to fit the patient's whole health plan.
diagram
The four challenges from Section 1.2 with the points exams pick from. Each one shapes how the Core functions are used.
Key points
Section 1.2 names four challenges: risk measurement (1.2.1), risk tolerance (1.2.2), risk prioritization (1.2.3), and organizational integration and management of risk (1.2.4).
Measurement is hard because of third-party data and models, emergent risks, few reliable metrics, lab results that differ from real life, inscrutable systems and no clear human baseline.
The inability to measure an AI risk does not imply that the system poses either a high or a low risk (Section 1.2.1).
The AI RMF does not prescribe risk tolerance; each organization sets it from its priorities, laws and norms, and it can change over time.
If risk is unacceptable, for example severe harm is happening or catastrophic risk is present, development and deployment should cease in a safe manner until it is managed.
Residual risk is the risk left after treatment (ISO Guide 73); documenting it tells end users about possible negative impacts of using the system.
AI risk belongs inside enterprise risk management alongside cybersecurity and privacy, and it needs senior-level commitment; the AI RMF alone will not change culture.
Exam tip
A common distractor says the AI RMF sets acceptable risk levels for you. It does not: the organization defines its own risk tolerance, and the AI RMF helps it manage against that line (see 3.1).
An AI system passes through many hands, like a car moving down an assembly line from designers to builders to inspectors to drivers. The AI RMF names each stage and the people at it, and it puts testing at every stage instead of only at the end.
diagram
The AI lifecycle from Figure 3, grouped by key dimension. Each stage has its own kind of TEVV, so testing never waits until the end.
Key points
Lifecycle stages (Figure 2): Plan and Design, Collect and Process Data, Build and Use Model, Verify and Validate, Deploy and Use, and Operate and Monitor; risk work should start at Plan and Design.
Key dimensions are Application Context, Data and Input, AI Model, and Task and Output; the AI actors working in them are the primary AI RMF audience.
People and Planet sits at the center for human rights and well-being; its actors, such as advocacy groups, researchers and affected communities, inform the primary audience.
NIST's change to the OECD model highlights test, evaluation, verification and validation (TEVV) throughout the lifecycle, allowing mid-course fixes and post-hoc risk management.
TEVV by stage (Figure 3): audit and impact assessment in design and operation, internal and external validation of data, model testing, then integration and compliance testing at deployment.
As a best practice, people who build and use models are kept separate from those who verify and validate them, and verifiers are ideally distinct from testers.
Appendix A actor groups include AI design, development, deployment, operation and monitoring, TEVV, human factors, domain experts, impact assessment, procurement, and governance.
Exam tip
When a question asks who should validate a model, pick someone other than the people who built it. TEVV runs at every stage, so testing only once before launch is a distractor (see 5.2).
NIST lists seven qualities a trustworthy AI system needs, a bit like a house. Valid and reliable is the foundation, five rooms sit on top, and accountable and transparent is the frame that holds every room together. A house is only as strong as its weakest wall, and so is trust.
diagram
Figure 4 as a diagram: valid and reliable holds up the other characteristics, and accountable and transparent wraps around all of them. Trust is only as strong as the weakest box.
Key points
The seven: valid and reliable; safe; secure and resilient; accountable and transparent; explainable and interpretable; privacy-enhanced; and fair with harmful bias managed (Section 3).
Figure 4 shows valid and reliable as the base, a necessary condition for the rest, and accountable and transparent as a vertical box because it relates to all the others.
Trustworthiness is a social concept on a spectrum and is only as strong as its weakest characteristic; fixing them one at a time does not guarantee trust.
Trade-offs are normal: interpretability versus privacy, predictive accuracy versus interpretability, and privacy techniques that cost accuracy when data is sparse.
NIST calls highly secure but unfair, accurate but opaque, and inaccurate but secure and transparent systems all undesirable; the aim is balance for the context.
Human judgment sets the metrics and thresholds, and trade-offs should be resolved in a way that is transparent and appropriately justifiable.
The decision to commission or deploy an AI system should rest on a contextual look at these characteristics plus the risks, impacts, costs and benefits.
Exam tip
Asked which characteristic the others depend on, answer valid and reliable. Asked which one relates to all the others, answer accountable and transparent. Trade-offs in practice are in 4.3.
These are the engineering side of trust. Valid means it does the job it was meant for, reliable means it keeps doing it, safe means it does not hurt anyone, and secure and resilient means it resists attackers and bounces back, like a bridge that carries its load, never collapses and gets repaired after a storm.
Resilience
Withstands unexpected events
Returns to normal function
Degrades safely when needed
Both
Handle adverse events
Security includes resilience
Security
Keeps confidentiality, integrity, availability
Blocks unauthorized access and use
Responds to and recovers from attacks
Section 3.3: security and resilience are related but distinct. Resilience is about bouncing back; security adds protection against people trying to break in.
Key points
Validation is confirmation, with objective evidence, that the requirements for a specific intended use are met (ISO 9000:2015); reliability is performing as required, without failure, over time.
Accuracy and robustness both support validity and can be in tension; robustness means keeping performance across many conditions, including uses nobody planned.
Accuracy results should come with realistic test sets that represent expected use, details of the test method and, where useful, results broken down by data segment.
Safe means not leading to a state that endangers human life, health, property or the environment; risks of serious injury or death get the most urgent priority.
Safety practices include simulation, in-domain testing, real-time monitoring, and the ability to shut down, modify or have a human intervene when a system strays.
Resilience is withstanding the unexpected and degrading safely; security includes resilience plus protocols to avoid, protect against, respond to and recover from attacks.
Named security concerns are adversarial examples, data poisoning, and exfiltration of models, training data or other intellectual property through system endpoints.
Exam tip
Security and resilience are related but distinct: resilience is bouncing back, and security adds protection against attackers. A shutdown or human-override ability is the AI RMF's safety answer (see 4.3).
These are the people side of trust. Transparency tells you what happened, explainability tells you how, and interpretability tells you why it matters to you. Privacy protects people's dignity and data, and fairness asks whether some groups get worse treatment, even when nobody meant it.
diagram
Three distinct ideas that support each other. Each answers a different question about the same decision (Section 3.5).
Key points
Accountability presupposes transparency, which is the extent to which information about a system and its outputs is available to people interacting with it, even unknowingly.
Transparency answers what happened, explainability answers how a decision was made, and interpretability answers why, and what it means for the user (Section 3.5).
A transparent system is not necessarily accurate, private, secure or fair, but an opaque system makes those qualities hard to check.
Privacy-enhanced AI protects autonomy, identity and dignity; privacy-enhancing technologies (PETs), de-identification and aggregation help, sometimes at a cost to accuracy.
NIST names three categories of AI bias: systemic, computational and statistical, and human-cognitive; each can occur with no intent to discriminate (NIST SP 1270).
Mitigating harmful bias does not make a system fair: balanced predictions can still shut out people with disabilities or widen existing gaps.
Keeping the provenance of training data, and tracing decisions back to subsets of it, supports both transparency and accountability.
Exam tip
Match the question word: what happened is transparency, how is explainability, and why is interpretability. For bias, the three NIST categories are systemic, computational and statistical, and human-cognitive.
The Core is the action part of the framework: four verbs. GOVERN is like a hospital's rules and culture, and inside it every case goes through MAP (understand the patient), MEASURE (run the tests) and MANAGE (treat and follow up), again and again.
diagram
GOVERN is not a step in the line; it surrounds the other three. MAP, MEASURE and MANAGE repeat as the system and its context change.
Key points
The Core has four functions, GOVERN, MAP, MEASURE and MANAGE, broken into 19 categories and 72 subcategories of outcomes and actions.
GOVERN is cross-cutting: it is infused through the other three and covers all stages, while MAP, MEASURE and MANAGE apply to specific systems and lifecycle stages.
Counts: GOVERN has 6 categories and 19 subcategories, MAP 5 and 18, MEASURE 4 and 22, and MANAGE 4 and 13.
Actions are not a checklist or a fixed order; once governance is in place, functions can run in any order, though most users start with MAP, then MEASURE or MANAGE.
The process is iterative with cross-referencing between functions; MAP outcomes are the basis for MEASURE and MANAGE.
Organizations may pick from among the categories and subcategories or apply them all, depending on their resources and capabilities.
Risk management should be continuous, timely and carried out by diverse, multidisciplinary teams, possibly with views from outside the organization.
Exam tip
GOVERN is not just step one; it wraps everything. If asked which function usually comes first once governance is in place, the answer is MAP (overview in 2.2).
GOVERN is the house rules: who is in charge, what the policies say, how people are trained and how suppliers are handled. It is like a restaurant's food-safety program, which covers every dish rather than one recipe.
diagram
All six GOVERN categories with the subcategories exams like most. GOVERN sets the rules for every AI system, not just one.
Key points
GOVERN 1, policies: 1.1 legal requirements understood, 1.2 trustworthy traits built into policy, 1.3 effort sized to risk tolerance, 1.4 transparent policies, 1.5 periodic review.
GOVERN 1.6 puts mechanisms in place to inventory AI systems, resourced by risk priority; GOVERN 1.7 covers decommissioning and phasing out AI systems safely.
GOVERN 2, accountability: 2.1 documented roles and lines of communication, 2.2 AI risk training for staff and partners, 2.3 executive leadership owns AI risk decisions.
GOVERN 3, diversity and human roles: 3.1 a diverse team informs decisions, and 3.2 defines roles for human-AI configurations and oversight of AI systems.
GOVERN 4, risk culture: 4.1 a critical-thinking, safety-first mindset, 4.2 teams document and share impacts, 4.3 practices enable testing, incident identification and information sharing.
GOVERN 5, engagement: 5.1 collect and prioritize feedback on impacts from people outside the team, and 5.2 regularly feed adjudicated feedback into design.
GOVERN 6, third parties: 6.1 policies for third-party AI risk, including intellectual property infringement, and 6.2 contingency plans for failures in high-risk third-party data or AI.
Exam tip
Inventory is GOVERN 1.6, decommissioning GOVERN 1.7, executive accountability GOVERN 2.3 and supplier risk GOVERN 6. These homes are favorite exam targets (see 2.1, 3.2 and 4.1).
MAP is doing your homework before you build or buy: what is this AI for, who will it touch, what could go wrong, and is it worth it? It is like a builder surveying the land, checking the zoning and talking to the neighbors before pouring a foundation.
diagram
MAP in its order of thinking. The payoff is an informed go or no-go decision before money and data are committed.
Key points
MAP 1, context: 1.1 intended purpose, users, laws and settings documented, 1.3 mission and goals, 1.4 business value, 1.5 risk tolerances determined, 1.6 requirements elicited.
MAP 1.2 asks for interdisciplinary, demographically diverse AI actors when setting context, with their participation documented.
MAP 2, categorization: 2.1 defines the task and method, such as classifier or generative model, 2.2 documents knowledge limits and human oversight, 2.3 records TEVV and data considerations.
MAP 3, benefits and costs: 3.1 benefits, 3.2 costs including non-monetary ones, 3.3 targeted scope, 3.4 operator proficiency, and 3.5 human oversight processes.
MAP 4, components: 4.1 maps technology and legal risks of every component, including third-party data, software and intellectual property, and 4.2 records internal risk controls.
MAP 5, impacts: 5.1 likelihood and magnitude of each impact, drawing on past uses, incident reports and outside feedback, and 5.2 regular engagement with relevant AI actors.
After MAP there should be enough context for an initial go or no-go decision on whether to design, develop or deploy; MAP is repeated as context and risks change.
Exam tip
Risk tolerance is determined and documented in MAP 1.5, while GOVERN 1.3 sizes the risk management effort to it. Knowledge limits are MAP 2.2. More MAP practice is in 3.1.
MEASURE is the lab work: once MAP says what could go wrong, MEASURE tests for it, before launch and while the system runs. It is like a car's crash tests plus its dashboard warning lights, plus someone checking that the gauges themselves read true.
diagram
Each trustworthy characteristic has its own MEASURE 2 subcategory. MEASURE 1 sets up the testing, and MEASURE 3 and 4 keep it honest over time.
Key points
MEASURE 1, methods: 1.1 start with the most significant risks and document what cannot be measured, 1.2 regularly reassess metrics and controls, 1.3 involve independent assessors.
MEASURE 1.3 brings in internal experts who were not front-line developers, or independent assessors, plus domain experts, users and affected communities as needed.
MEASURE 2 has 13 subcategories: 2.1 test sets and tools documented, 2.2 human-subject protections, 2.3 performance in deployment-like conditions, 2.4 monitoring in production.
MEASURE 2.5 to 2.11 test one characteristic each: valid and reliable, safe, secure and resilient, transparent and accountable, explained and interpreted, privacy, and fairness.
MEASURE 2.6 shows the system is safe, its residual risk does not exceed tolerance and it can fail safely; 2.12 covers environmental impact and 2.13 checks TEVV itself.
MEASURE 3 tracks risks over time: 3.1 existing and emergent risks, 3.2 risks with no metrics yet, and 3.3 ways for users to report problems and appeal outcomes.
MEASURE 4 checks that measurement works: approaches tied to the deployment context, results validated with domain experts, and performance changes documented.
Exam tip
Independence points to MEASURE 1.3, appeals and problem reports to MEASURE 3.3, and production monitoring to MEASURE 2.4. Tests and metrics are MEASURE, not MANAGE (see 3.1 and 5.2).
MANAGE is where decisions turn into action: fix the biggest risks first, keep a way to switch the system off, watch suppliers and keep monitoring after launch. It is like a ship's captain who has the charts from MAP and the instrument readings from MEASURE, and now has to steer.
diagram
MANAGE turns MAP and MEASURE results into action, from the launch decision to the off switch. Third-party monitoring under MANAGE 3 runs alongside.
Key points
MANAGE 1: 1.1 decides if the system meets its purpose and should proceed, 1.2 prioritizes by impact, likelihood and resources, 1.3 plans responses, 1.4 documents residual risk.
MANAGE 1.3 lists four risk responses: mitigate, transfer, avoid or accept; MANAGE 1.4 documents negative residual risk for downstream acquirers and end users.
MANAGE 2: 2.1 weighs resources and viable non-AI alternatives, 2.2 sustains the value of deployed systems, 2.3 responds to and recovers from previously unknown risks.
MANAGE 2.4 requires mechanisms, with assigned responsibilities, to supersede, disengage or deactivate AI systems whose performance or outcomes are inconsistent with intended use.
MANAGE 3, third parties: 3.1 monitors third-party risks and applies controls, and 3.2 monitors pre-trained models used in development as part of regular maintenance.
MANAGE 4.1 puts post-deployment monitoring plans in place, covering user input, appeal and override, decommissioning, incident response, recovery and change management.
MANAGE 4.2 builds measurable continual improvement into updates, and 4.3 communicates incidents and errors to relevant AI actors, including affected communities.
Exam tip
The off switch is MANAGE 2.4, post-deployment monitoring is MANAGE 4.1 and incident communication is MANAGE 4.3. A question about choosing a non-AI option points to MANAGE 2.1 (see 5.1).
A profile is the AI RMF tailored to one situation, like a general fitness plan turned into a training plan for one specific marathon. You write down where you are today, where you want to be, and the steps to close the gap.
diagram
A temporal profile gap analysis. The AI RMF prescribes no template, so each organization shapes its own profiles.
Key points
Use-case profiles apply the functions, categories and subcategories to one setting, based on its requirements, risk tolerance and resources, for example a hiring or fair housing profile.
Temporal profiles describe the current state or the desired target state of AI risk management in a sector, industry, organization or application.
A Current Profile shows how AI risk is managed today; a Target Profile shows the outcomes needed to reach the desired risk management goals.
Comparing Current and Target Profiles reveals gaps; action plans close them, prioritized by the user's needs, and help size the staffing and funding required.
Cross-sectoral profiles cover risks common across use cases or sectors, such as large language models, cloud-based services or acquisition; NIST AI 600-1 is one.
The AI RMF does not prescribe profile templates, which leaves each organization free to shape its own.
On 7 April 2026 NIST released a concept note for an AI RMF Profile on Trustworthy AI in Critical Infrastructure, to guide operators using AI-enabled capabilities.
Exam tip
Gap analysis between a Current and a Target Profile is the AI RMF answer to how an organization plans improvement. The generative AI profile is cross-sectoral, not a use-case profile (see 2.2).
If the AI RMF is the list of goals, the Playbook is the book of tips for reaching them. It is like a recipe box next to the menu: for each outcome it suggests actions, and you take only the cards that suit your kitchen.
diagram
How the Playbook is meant to be used: pick the suggestions that fit and leave the rest. It is a menu, not a checklist.
Key points
The AI RMF Playbook is a free online companion from NIST that suggests tactical actions for reaching the outcomes in the Core, Tables 1 to 4 of AI RMF 1.0.
Suggestions line up with each subcategory: 72 entries across GOVERN (19), MAP (18), MEASURE (22) and MANAGE (13).
NIST says the Playbook is neither a checklist nor a set of steps to follow in full; its suggestions are voluntary, so organizations borrow as many or as few as apply.
Entries can be filtered by AI actor, such as TEVV or Operation and Monitoring, and by topic, such as Risk Tolerance, Decommission or Third-party.
It is part of the NIST Trustworthy and Responsible AI Resource Center (AIRC), launched on 30 March 2023, and downloads as PDF, CSV, Excel or JSON.
NIST planned frequent Playbook updates, with comments reviewed twice a year; it now says the Playbook will be updated after the AI RMF is revised.
Exam tip
The Playbook offers suggested actions, not requirements. An option that calls it a mandatory checklist or a certification audit guide is a distractor.
Download the Playbook and count entries per function · bash
curl -sO https://airc.nist.gov/docs/playbook.json
python3 -c "import json,collections as c; d=json.load(open('playbook.json')); print(len(d), c.Counter(x['type'] for x in d))"
# 72 Counter({'Measure': 22, 'Govern': 19, 'Map': 18, 'Manage': 13})
Generative AI, the kind that writes text or makes images, brings some new problems, such as confident made-up answers. NIST AI 600-1 is a companion profile that names 12 of these risks and suggests GOVERN, MAP, MEASURE and MANAGE actions for them, like an extra chapter for a new kind of vehicle.
diagram
All 12 risks named in NIST AI 600-1. The four groups here are a memory aid, not NIST's own grouping.
Key points
NIST AI 600-1, the Generative Artificial Intelligence Profile, was published on 26 July 2024 as a cross-sectoral profile of, and companion resource for, AI RMF 1.0.
It names 12 risks unique to or worsened by generative AI (GAI); the first four are CBRN information or capabilities, confabulation, dangerous, violent or hateful content, and data privacy.
Next: environmental impacts; harmful bias or homogenization; human-AI configuration, such as over-reliance or automation bias; information integrity; and information security.
Last: intellectual property; obscene, degrading and/or abusive content; and value chain and component integration, meaning untraceable third-party parts and weak supplier vetting.
Confabulation is NIST's term for confidently stated but false content, known colloquially as hallucinations; CBRN means chemical, biological, radiological or nuclear.
Its public working group focused on four considerations: governance, content provenance, pre-deployment testing and incident disclosure.
It was written under Executive Order (EO) 14110, which EO 14148 revoked on 20 January 2025; NIST still lists AI 600-1 as a companion to the AI RMF.
Exam tip
Hallucination questions want the word confabulation. Know that the profile lists 12 risks and is a cross-sectoral profile of the AI RMF, not a separate framework (see 1.2 and 2.2).
AI RMF 1.0 is still the version to study and use. NIST has said it is being revised, the way a textbook gets a new edition, but as of November 2026 the new edition has not been published.
diagram
Key dates around AI RMF 1.0. A revision is ordered and in progress, but no new version has been published.
Key points
AI RMF 1.0 remains the current published version; the NIST AI RMF page still offers 1.0 for download and lists no replacement.
NIST states that AI RMF 1.0 is being revised as part of the White House AI Action Plan, and its resource center says a revised version is in progress.
America's AI Action Plan of 23 July 2025 directed NIST to revise the AI RMF to remove references to misinformation, diversity, equity and inclusion (DEI), and climate change.
The 1.0 text still names diversity, equity, inclusion and accessibility in GOVERN 3 and environmental impact in MEASURE 2.12; study them as written until NIST publishes changes.
The original plan was a formal community review by 2028 at the latest; the first version number changes only for major revisions, and minor ones would be numbered 1.1.
NIST says the Playbook will be updated after the AI RMF revision, and it keeps adding profiles, such as the April 2026 critical infrastructure concept note.
AI RMF 1.0 became final on 26 January 2023 after an initial draft in March 2022 and a second draft in August 2022.
Exam tip
An option saying AI RMF 2.0 has replaced 1.0 is wrong as of November 2026. Exam questions test the 1.0 structure: four functions, seven characteristics and the published subcategories.
The AI RMF is a free, voluntary guidebook; ISO/IEC 42001 is a formal standard an auditor can certify you against. Think of the AI RMF as a coach's playbook and ISO/IEC 42001 as the league rulebook that referees check. Many organizations use both.
NIST AI RMF 1.0
Free voluntary guidance
Outcomes, not requirements
No certification
Profiles and Playbook
Both
Risk-based
Whole AI lifecycle
Organization-wide
Linked by a crosswalk
ISO/IEC 42001
Requirements standard
Certifiable AI management system
Plan-Do-Check-Act cycle
Annex A controls
Same goal, different tools. ISO/IEC 42001 is the certifiable management system; the AI RMF is free voluntary guidance that fits inside it.
Key points
ISO/IEC 42001:2023, published in December 2023, sets requirements to establish, implement, maintain and continually improve an AI management system (AIMS).
ISO/IEC 42001 is a management system standard built on Plan-Do-Check-Act, and organizations can be certified against it; the AI RMF has no certification scheme.
The AI RMF is outcome-focused and non-prescriptive, with suggested actions; ISO/IEC 42001 states requirements, plus Annex A controls, that an auditor checks.
Both are voluntary, risk-based and cover the whole AI lifecycle; neither is a law, unlike the EU AI Act (see 2.3).
NIST's AI Resource Center lists a community-submitted crosswalk from the AI RMF to ISO/IEC 42001, alongside crosswalks to ISO/IEC 23894 and ISO/IEC 42005.
They fit together: AI RMF functions frame and test AI risk, and ISO/IEC 42001 runs that work as an auditable management system.
Exam tip
Certification, audit or an AI management system points to ISO/IEC 42001; voluntary guidance with GOVERN, MAP, MEASURE and MANAGE points to the AI RMF. More on ISO/IEC 42001 is in 2.2.
EC-Council's ADG (Adopt, Defend, Govern) framework turns AI RMF goals into 12 concrete controls with evidence an auditor can hold. Think of the AI RMF as the destination on a map and ADG as the turn-by-turn directions. The exam blends both across its five domains.
diagram
Read each row left to right: the AI RMF outcome, the ADG Minimum Control that evidences it, and where the exam covers it. Mappings follow ADG's own published table.
Key points
ADG (Adopt, Defend, Govern) is EC-Council's AI security governance framework; it maps its 12 Minimum Controls (MC-1 to MC-12) to AI RMF functions and ISO/IEC 42001 clauses.
ADG's published table maps MC-1 AI system inventory to GOVERN, MC-2 risk classification to MAP, MC-4 pre-production evaluation to MEASURE, and MC-8 runtime monitoring to MANAGE.
The same table maps MC-9 incident response to MANAGE, MC-11 fairness evaluation to MAP bias identification, and human oversight tiers to GOVERN human-AI teaming.
Name clash: GOVERN is both an AI RMF function and an ADG pillar; ADG's GOVERN pillar oversees, assures and decides, alongside ADOPT and DEFEND.
CRAGE map: core functions and profiles in 2.2, GOVERN policies in 2.1, MAP and MEASURE in 3.1, third-party risk (GOVERN 6, MANAGE 3) in 3.2, inventory (GOVERN 1.6) in 4.1.
More of the map: trade-offs and safety in 4.3, incidents (MANAGE 4.3) in 5.1, TEVV and validation (MEASURE 2) in 5.2, and decommissioning (GOVERN 1.7) in 1.2.
ADG calls its mapping indicative, not exhaustive: it supports compliance but does not guarantee it.
Exam tip
When a question mixes frameworks, separate the layers: the AI RMF says what outcome to reach, ADG names the control and its evidence, and ISO/IEC 42001 is what gets certified.
Imagine Contoso discovers dozens of AI agents running across teams, quietly reading mail, filing tickets and calling APIs, and nobody can say who owns many of them. That is agent sprawl. The AI RMF gives a calm order of work: get control with GOVERN, understand each agent with MAP, test and watch with MEASURE, and act with MANAGE.
diagram
The agent sprawl walk-through as a flow. Unowned or unapproved agents leave through retirement; approved agents get access only after the go decision.
Key points
GOVERN first: inventory every agent (GOVERN 1.6) and name an accountable owner and lines of communication for each (GOVERN 2.1); agents with no owner go on a retirement list.
Set the rules: agents act only within documented risk tolerance (GOVERN 1.3, MAP 1.5), human oversight roles are defined (GOVERN 3.2), and vendor agents fall under GOVERN 6.1.
MAP each agent: purpose and users (MAP 1.1), task and knowledge limits (MAP 2.1, 2.2), tools, connectors and third-party parts (MAP 4.1, 4.2), and likely impacts (MAP 5.1).
Approval before access: no agent gets new tools or data until MAP is done and a go decision is recorded (MANAGE 1.1), with human oversight processes set (MAP 3.5).
MEASURE: monitor agent behavior in production (MEASURE 2.4), test security and resilience against abuse and misuse (MEASURE 2.7), and use reviewers outside the build team (MEASURE 1.3).
MANAGE: every agent has a tested deactivation path with a named person (MANAGE 2.4), post-deployment monitoring and change control (MANAGE 4.1), and safe retirement (GOVERN 1.7).
Tamper-evident logs are Contoso's chosen control for outcomes the AI RMF asks for: documented accountability (MEASURE 2.8) and tracked incidents (MANAGE 4.3); ADG MC-1 and MC-7 echo this.
Exam tip
For sprawl, the first move is inventory and ownership (GOVERN 1.6 and 2.1), not a new monitoring tool, and the off switch is MANAGE 2.4. Agent-specific controls are in 4.1 and 4.2.
One agent's inventory record at Contoso (placeholder values) · json
Exam writers like answers that sound right but swap one word. Most AI RMF traps change the status (voluntary or mandatory), the structure (four functions, seven characteristics) or the home of a subcategory. Learn the real versions and the fakes fall away.
diagram
The five places most AI RMF distractors hide. CSF 2.0 has six functions; the AI RMF has four. If an option changes one of these facts, eliminate it.
Key points
Trap: the AI RMF is mandatory or certifiable. Fact: it is voluntary guidance with no certification; ISO/IEC 42001 is certifiable and the EU AI Act is law.
Trap: AI RMF 2.0 replaced 1.0. Fact: as of November 2026, 1.0 is current and a revision ordered by the July 2025 AI Action Plan is in progress.
Trap: borrowing NIST Cybersecurity Framework (CSF) 2.0 functions such as Identify, Protect or Detect. Fact: the AI RMF has four functions: GOVERN, MAP, MEASURE and MANAGE.
Trap: GOVERN is just the first step. Fact: GOVERN is cross-cutting and infused throughout; once it is in place, functions run in any order, usually starting with MAP.
Trap: the AI RMF sets your risk tolerance, or says to accept unacceptable risk. Fact: the organization sets tolerance (MAP 1.5), and unacceptable risk means stopping safely.
Trap: accountable and transparent is the base. Fact: valid and reliable is the base; accountable and transparent relates to all the other characteristics.
Trap: wrong homes. Inventory is GOVERN 1.6, independent assessors MEASURE 1.3, deactivation MANAGE 2.4, residual risk MANAGE 1.4, pre-trained model monitoring MANAGE 3.2.
Exam tip
Read every option for the one swapped word, such as mandatory, prescribes, six functions or replaced. That single word is usually what makes it wrong.