The NIST AI Risk Management Framework tells you what AI risk management should cover and how to organise it. It does not say which controls to put on an AI agent, at what level, or how to enforce them. Map your documents to its functions and stop there, and you have a tidy description of risk, not controls that act.
What is the NIST AI RMF?
The AI Risk Management Framework 1.0, published by the US National Institute of Standards and Technology in January 2023, is voluntary guidance for managing risks from AI systems. It is organised around four functions: Govern, which sets culture, roles and accountability; Map, which establishes context and identifies risks; Measure, which assesses and tracks them; and Manage, which prioritises and acts on them. NIST has also published a Generative AI Profile, NIST AI 600-1, which applies the framework to generative AI. Our explainer on what the NIST AI Risk Management Framework is covers it in more detail.
Each function contains categories and subcategories describing outcomes a mature organisation should achieve. They are written to apply across sectors, system types and organisation sizes. That breadth is a strength and the reason the framework cannot be a control set.
Why can't a framework this broad be a control set?
Because controls are specific and the framework deliberately is not. A control says: refunds above 500 are made only by a named team leader, never the agent; this agent may not change bank details; certificates lapse after 90 days. A framework outcome says, in effect, that the organisation should have processes to manage risks according to their priority. Many different control sets could satisfy that outcome, and so could a poor one.
The framework is also neutral on technology. It does not distinguish an agent that acts from a model that scores, though the risks differ greatly. The decisions that matter most for agents, such as how far each agent may act, what evidence is needed to widen it and where the check happens, sit below the level of detail the framework works at. Our page on how the NIST AI RMF applies to AI agents explores that gap.
How do you turn the map into controls for agents?
Take each function and ask what it requires of an agent in practice, then choose a control that delivers it and leaves evidence.
| Function | Question for an agent | Example control | Evidence |
|---|---|---|---|
| Govern | Who answers for this agent and each capability? | Named agent owner and capability owners; written delegation of authority | Ownership register; approval records |
| Map | What does it do, where, with what effect on people? | Inventory of capabilities, depth, sources and affected parties | Agent register entries; impact assessments |
| Measure | Does it perform on our cases, for each capability? | Certification on real cases per agent; ongoing scoring | Certification results; edit and refusal patterns |
| Manage | How are risks contained and acted on? | Bounds checked at the moment of action; depth lowered on signals | Verdict record naming the deciding bound; narrowing decisions |
The Map function is often where agent programmes are weakest, because a single agent can have many capabilities with very different effects. Our page on the NIST AI RMF Map function for AI agents shows how to inventory them.
What does "mapping to the framework" usually miss?
The common exercise is to list existing policies and procedures against each subcategory and declare coverage. That shows the organisation has thought about each area. It does not show that any agent is actually constrained.
The test is simple. For any subcategory you claim to meet, ask what happens when an agent tries to do something it should not. If the answer is "the policy says it must not", there is no control. If the answer is "the action is checked against its bounds and refused, and the refusal is recorded", there is. The framework cannot tell these two answers apart; you have to.
How does the RMF compare with other frameworks?
It sits alongside them rather than replacing them. The EU AI Act is law, with specific obligations for certain uses and roles; the RMF is voluntary and outcome-based. Our comparison of the EU AI Act and the NIST AI RMF for AI agents shows how they overlap. ISO/IEC 42001 is a certifiable management system standard, which an organisation can be audited against. The RMF has no certification. Our piece on choosing between the NIST AI RMF and ISO/IEC 42001 explains why many firms use both: the RMF to organise thinking, 42001 to structure a management system that can be certified.
None of the three supplies the agent-level controls. Each assumes the organisation will choose them.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
What is the trade-off?
Using the RMF well means doing the work it leaves to you: choosing controls, setting their levels and building enforcement. That takes more effort than a mapping exercise and exposes gaps a mapping would hide.
The benefit of the framework is that it helps you find those gaps. Use it as a checklist of areas your agent controls must cover, not as evidence that they do. For each function, write down the specific controls on your agents, where they are enforced and what evidence each leaves. Where you cannot, you have found the work. The wider mapping of rules and frameworks to controls is in our guide to AI agent regulation, mapped to controls.
Where Pryme fits
Pryme supplies agent-level controls that sit under the framework's functions. Each agent has named owners; capabilities, depth and sources are recorded per customer; Attest certifies each agent on the customer's own cases; and every action meets five bounds at the moment it is taken, with the verdict and the deciding bound filed. The framework helps you check coverage; these controls are what act.
Questions people ask
Is the NIST AI RMF required for US firms?
No. It is voluntary. Some regulators and customers may reference it or expect firms to show they manage AI risk in a comparable way, but the framework itself imposes no legal obligation.
Does the Generative AI Profile cover agents?
It addresses risks common to generative AI, many of which apply to agents built on generative models. It does not provide agent-specific controls such as certified depth per agent or bounds checked at the moment of action.
Can the RMF be used outside the US?
Yes. It is written to apply across jurisdictions and sectors, and many organisations outside the US use it to structure AI risk work alongside local rules.