Govern sets who may let an agent act and on what evidence. Map records each capability, its context and who it can affect. Measure tests the agent on real cases against defined thresholds. Manage enforces limits when the agent acts and withdraws authority when evidence lapses. Applied this way, the NIST AI RMF's four functions become controls, not headings.
What does the NIST AI RMF set out?
The NIST AI Risk Management Framework 1.0, published in January 2023, is voluntary guidance for managing risks of AI systems. It is organised into four functions:
- Govern: a culture of risk management; policies, processes and accountability; workforce diversity and competence; engagement with affected parties; management of third-party risks. Govern runs across the other three.
- Map: establishing the context of an AI system, its intended purposes, its capabilities and limits, and its potential impacts on individuals, groups, organisations and society.
- Measure: methods and metrics to analyse, assess and track AI risks and trustworthiness, including testing before deployment and regularly in operation.
- Manage: prioritising and acting on risks, planning responses, managing third-party risks, and monitoring and communicating after deployment.
Each function has categories and subcategories, and a companion playbook suggests actions. The Generative AI Profile, NIST AI 600-1, adds risks specific to generative systems. Our article on how the NIST AI RMF applies to AI agents gives the short answer.
Who uses it?
Any organisation that develops or uses AI. It is voluntary and sector-neutral. Many regulated firms adopt it because it is recognised by supervisors and maps to other frameworks. How it compares with the EU's binding approach is covered in EU AI Act vs NIST AI RMF for AI agents.
What does each function mean when the system is an agent that acts?
The framework does not distinguish systems that recommend from systems that act. For agents, that distinction drives the controls in every function.
Govern: authority is the policy question. The key decision for agents is who may grant an agent authority to act, at what level, on what evidence, for how long. A policy that says "AI must be used responsibly" leaves that to whoever configures the agent.
Map: per capability, not per system. An agent's risks differ by what it does. Mapping should list each capability, the data it reads, the actions it can take, whether those actions can be undone, and who is affected.
Measure: on your own cases. Benchmarks from vendors measure general ability. The framework asks for measurement in context. For an agent, that means replaying real cases from your operation and scoring the results against thresholds you set.
Manage: at the moment of action. Managing risk in a document is not the same as managing it in operation. For agents, the response to measured risk is a limit enforced each time the agent tries to act, plus a way to withdraw authority when tests fail.
How do you apply the functions with controls?
| Requirement | Control | Evidence it leaves |
|---|---|---|
| Govern: policies and accountability | Policy defining levels of agent authority and who may grant them; named owner per agent | Policy; owner register |
| Govern: third-party risk | Platform and model provider assessed; change notification required | Supplier assessments |
| Map: context and purpose | Capability register with data, actions, reversibility and affected people | Capability register |
| Map: impacts | Impact assessment per capability | Impact records |
| Measure: testing before deployment | Replay on real cases; scores against thresholds per capability | Test reports |
| Measure: trustworthiness characteristics | Tests for accuracy, fairness, security against manipulation, privacy leakage | Results by characteristic |
| Measure: in operation | Live outcome tracking and periodic retest | Monitoring reports |
| Manage: risk response | Authority level set by evidence; held, refused or withdrawn when evidence is weak | Authority records |
| Manage: enforcement | Limits checked at each action | Verdict records |
| Manage: post-deployment | Incidents handled; authority reduced on failure; lessons fed back to Map | Incident and change records |
The framework is a map of what to think about, not a set of controls; our article the NIST AI RMF is a useful map, not a control set makes that argument in full. The table above is one way to turn it into controls.
What will an auditor, supervisor or customer ask?
- How have you used the AI RMF? Show us the mapping to your controls.
- Who decides how far an agent may act, and on what evidence?
- How did you measure this agent, on which cases, and against what threshold?
- What happens when measurement shows the agent falling short?
- How do you know the agent cannot exceed its limits in operation?
What does the framework not cover?
It is not a law and has no certification. It does not prescribe thresholds, tests or controls. It does not replace sector rules such as SR 11-7 or data protection law. Firms wanting a certifiable system often pair it with ISO/IEC 42001; see NIST AI RMF vs ISO/IEC 42001 for AI agents and whether to follow the NIST AI RMF or ISO/IEC 42001. For the full map, see AI agent regulation, mapped to controls.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
Where Pryme fits
Each function has a counterpart in Pryme. Govern: depth is earned, not configured; the agent's role sets a ceiling and evidence sets the depth. Map: Agent Studio produces a brief per capability. Measure: Attest replays real cases across seven gates. Manage: the minimum chain enforces limits at the moment of action, and certificates lapse after 90 days.
Questions people ask
Is Govern a separate step from the other three?
No. Govern runs across the whole life cycle and shapes how Map, Measure and Manage are carried out. For agents, it is where authority decisions are made.
How often should Measure be repeated for an agent?
After any material change to the agent's brief, sources, model or actions, and on a regular cycle. Agents change more often than traditional models.
Does the framework require human oversight?
It treats human oversight as part of managing risk and stresses human roles and responsibilities. It does not require a person to approve every action.