It is a playbook, not a law
Nobody can fine you for ignoring it. It exists to give organisations a structured way to think about what could go wrong with an AI system and what to do about it.
NIST AI RMF 1.0 · voluntary, no certificate
The NIST AI RMF, explained for people who have to use it
The NIST AI Risk Management Framework is the US government’s voluntary playbook for managing AI risk. Not a law, no certificate: the shared vocabulary US buyers and auditors increasingly expect you to speak.
PublishedJanuary 2023Statusvoluntary, no certificateCore4 functions · 72 subcategoriesQuox gives youevidence you verify offlineStart here
What it is, and what it is not
If you are meeting this for the first time because you need AI and you need to stay on the right side of compliance, three plain facts will save you a week.
There is no certificate
NIST does not certify anyone against it. You adopt it, you keep evidence that you did, and you can show that evidence to a customer or an auditor. Treat anyone selling a certificate with care.
It is how buyers ask the question
US customers, auditors and procurement teams use its language to ask how you manage AI risk. Knowing the four functions means you can answer in terms they already use.
4functionsGovern, Map, Measure, Manage.
19categoriesThe groupings inside the four functions.
72subcategoriesThe individual outcomes you can work through.
7trustworthy-AI characteristicsWhat “good” looks like for an AI system.
AI RMF 1.0 is NIST AI 100-1, published in January 2023. The Core is the part that matters day to day, and the rest of this page walks through it.
The four functions
One cycle, with Govern at the hub
Map, Measure and Manage go round in turn. Govern is not a fourth step: it sits underneath the other three and shapes all of them. Most teams start with Govern, then go round the orbit and keep going.
Govern
The hubDecide who is accountable for AI risk, write the policies, and build a culture where people can raise a concern. Govern is not a stage you finish. It runs underneath the other three, and most teams start here.
In practiceSomeone named owns the agent that touches customer records. There is a written rule for what it may and may not do, and a way to stop it.
Where Quox fits: Accountability you can show
The audit trail is the accountability: every governed action is a witnessed record with an identity attached, in a chain a sceptic can recompute offline. Policies are enforced at the moment of action, and audit-required policy changes need a second person.
The governance layerFor auditorsMap
Frame the riskFor one specific AI system, write down what it is for, who it touches, what could go wrong and what context it runs in. You cannot measure a risk you have not framed.
In practiceAn agent drafts refund approvals. Mapping says: it handles money, it can be wrong, a customer can be harmed, and a human should sit in the path above a set amount.
Where Quox fits: Partly yours, partly ours
Mapping is judgement work: impact assessments, intended use, who is affected. Quox does not do that thinking for you. What it supplies is the inventory side: which agents exist, what tools and data they can reach, and what they actually did.
QuoxCOREMeasure
Show your workingAssess, track and keep re-checking the risks you mapped, using numbers, observation or both. Measuring means the evidence exists, not that someone feels it is fine.
In practiceNot “the agent seems to behave”, but how many actions it took last month, how many were blocked by policy, and how many went to a human.
Where Quox fits: The strongest fit
Every agent action is a witnessed, tamper-evident record, so you measure what the AI did rather than estimate it. Blocks, denials and human approvals are counted in the same chain, and the whole record exports as a bundle an assessor verifies offline.
How long to keep the logsManage
Act on itPrioritise the risks you found, decide what to do about each, respond when something goes wrong, and keep watching afterwards.
In practiceA policy blocks personal data reaching an external model. A production-destructive command waits for a person. An E-STOP halts the agents when something looks wrong.
Where Quox fits: Controls that fire first
The policy gate and human-in-the-loop approval act before the action runs, and each leaves a receipt that it did. A control you can show fired is worth more to an assessor than a control you can only describe.
Policy gate and approvalsWhat good looks like
Seven characteristics of trustworthy AI
The functions are the how. These seven are the target. For each one, here is what it means and an honest read on how much a tool like Quox can contribute. Several are plainly your job.
Valid and reliable
It does what it is meant to do, and keeps doing it.
Model accuracy is your work. Quox gives you the continuous record that lets you notice when behaviour drifts.
Safe
It does not put people, property or the environment at risk.
Pre-action policy gates, human approval on risky steps and a stop path limit what an agent can do. They do not prove the system is safe overall.
Secure and resilient
It resists attack and recovers when something goes wrong.
Signed job execution, scoped capability tokens, governed SSH through Bastion and E-STOP with a DEFCON posture. Your wider security programme still applies.
Accountable and transparent
People can see what it did, and someone answers for it.
This is the thesis Quox is built on: witnessed records, replayable traces and evidence a third party can verify without trusting you.
Explainable and interpretable
You can understand how it reached an output and what that output means.
Trace Explorer shows what an agent saw, decided and called, in order. It explains the run, not the inside of the model.
Privacy-enhanced
It protects people’s personal data and their autonomy.
Evidence events record metadata, not raw payloads, and policies can block personal data reaching an LLM. Lawful basis and consent remain yours.
Fair, with harmful bias managed
It does not treat groups of people unjustly, and bias is looked for and handled.
Bias testing and mitigation are model and data work. Quox can evidence that your reviews and approvals happened, not that the model is fair.
If you use generative AI
The Generative AI Profile adds 12 risks
NIST AI 600-1, published in July 2024, is a companion to the framework. It extends the AI RMF for generative AI rather than replacing it, and it names 12 risk categories that generative AI creates or makes worse.
For each risk it suggests actions mapped back to the Core, each with its own ID such as GV-1.1-001 (the GV is Govern). If your AI is a chat model or an agent built on one, this is the document your assessor is most likely to have open.
A sample of the 12:
- Confabulation (confident, wrong output)
- CBRN information
- Harmful bias and homogenisation
- Data privacy
- Information security
- Human-AI configuration
- Value chain and component integration
The full list and every suggested action are in the profile itself.
The honest map
The framework tells you to govern, map, measure and manage. Quox gives you the evidence that you did.
Measure
Measure what the AI did, do not estimate it
Every governed agent action becomes a witnessed, tamper-evident record. When Measure asks you to track risk continuously, the answer is counts and records you can open: actions taken, actions blocked, actions sent to a human.
Manage
Risk controls that fire before the action
The policy gate and human approval act before an agent does something consequential, and each leaves a receipt that it fired. Manage asks you to respond to risk. A control with a receipt is a response you can prove.
Govern
Accountable and transparent, literally
“Accountable and transparent” is one of the seven characteristics and it is the thesis Quox is built on. The audit trail is the accountability, and offline verification makes it transparent to someone who has no reason to trust you.
Keeping the evidence
Evidence you cannot produce a year later is not evidence. The RMF does not set a retention period, so you decide one from your own policy, your sector and what customers will ask for. Our guide walks through how to choose.
The auditor page shows what the other side of the table can verify without a Quox account. The wider compliance suite covers the SoA builder, DPIA and risk tools.
Honest maturity
What ships today, what does not, and what is yours
Quox is one layer of an AI risk programme. Here is the line, drawn plainly.
Ships today
- Witnessed, hash-chained, tamper-evident record of every governed agent action (WARD and VOLT, the evidence protocols), the raw material for the Measure function.
- Policy gate enforced at execution, with two-person approval for audit-required policy changes and an append-only history.
- Human-in-the-loop approval inbox, for human oversight of AI actions: a governed agent cannot self-approve a real gate.
- Replayable traces so a reviewer can inspect what an AI system actually did (Trace Explorer, AEE envelope standard). Explorer, AEE envelope standard).
- Exportable evidence bundles an assessor verifies offline, with no Quox account.
- E-STOP and DEFCON posture, Ed25519-signed job execution, scoped capability tokens.
Not shipped
- A policy simulator, so you can test a policy before it goes live. Planned, not shipped.
- A subcategory-level crosswalk to all 72 RMF subcategories. Not published; this page maps at the level of the four functions and seven characteristics.
Still your job
- Setting your risk tolerance and writing the AI policy that sits above any tooling.
- Impact assessments, intended-use statements and deciding who your AI affects.
- Testing the model itself for accuracy, reliability and bias.
- Training your people and naming the owners of each AI system.
- Deciding whether, and how far, to adopt the framework. It is voluntary.
The path
Where to start on Monday morning
You do not need to work through 72 subcategories to begin. Five moves get you from nothing to something you can show.
List your AI systems
Including the quiet ones: the agent a team set up last month, the model behind a vendor feature. You cannot govern what you have not counted.
Name an owner and write the rules
That is Govern. One accountable person per system and a short policy for what it may and may not do. Two pages beats a binder nobody reads.
Frame the risk for each system
That is Map. Purpose, people affected, what could go wrong. If it handles money, health or hiring, say so plainly.
Switch on the evidence
That is Measure and Manage. Put a gate in front of the risky actions and record everything the system does, so the answer to “what did it do” is a record rather than a reconstruction.
Review on a rhythm
Re-measure, tune the policies, keep the evidence for as long as your rules and customers need it, then go round again. The cycle does not finish.
Questions people actually ask
NIST AI RMF: the FAQ
What is the NIST AI Risk Management Framework?
The NIST AI RMF 1.0 (NIST AI 100-1, published January 2023) is a US framework for managing the risks of AI systems across their lifecycle. Its core has four functions (Govern, Map, Measure, Manage), 19 categories and 72 subcategories, and it describes seven characteristics of trustworthy AI.
Is the NIST AI RMF mandatory?
No. It is voluntary. It is not a law and there is no certification or attestation for it. It matters because US buyers, auditors and procurement teams increasingly use it as the shared vocabulary for asking how you manage AI risk.
Can a company be NIST AI RMF certified?
No. NIST does not certify organisations or products against the AI RMF. Be cautious of anyone selling a “NIST AI RMF certificate”. What you can do is adopt the framework and keep evidence that you did.
What are the four functions?
Govern (accountability, policies, culture), Map (frame the risks of a specific system), Measure (assess and monitor those risks) and Manage (prioritise, respond and keep watching). Govern runs through the other three. Teams usually start there, then work Map, Measure, Manage and repeat.
What is the Generative AI Profile?
NIST AI 600-1, published July 2024, is a companion profile that extends the RMF for generative AI. It identifies 12 risk categories that are new or made worse by generative AI, such as confabulation, harmful bias and data privacy, and suggests actions mapped to the Core, each with an ID such as GV-1.1-001.
Does the NIST AI RMF apply to AI agents?
It applies to AI systems generally, and an agent that acts on your systems and data is an AI system with real consequences. Agents make the Measure and Manage functions harder, because the system takes actions rather than just producing text, which is why a record of what it did matters.
Does Quox make me NIST AI RMF compliant?
No, and no tool can. The framework is voluntary and has no certificate. Quox is the evidence layer that helps you meet it and prove it: witnessed records, pre-action policy gates, human approval and offline-verifiable evidence. The risk programme around it is yours.
How long should I keep AI agent logs?
The RMF does not set a number. Retention comes from your own policy, your sector rules and what your customers and assessors will ask for. Our guide to AI agent log retention walks through how to decide. How long to keep AI agent logs.
Self-hosted · free · governed
Show your working to someone who does not trust you
NIST AI RMF is voluntary, so the proof is yours to choose. Govern, map, measure and manage with witnessed records an assessor verifies offline, on your own servers.