If you sell to larger customers, you may have started seeing a new line in their security questionnaires: “Describe how you manage AI risk. Do you follow the NIST AI Risk Management Framework or equivalent?” It is turning up in tenders, insurance proposals and supplier audits, and most small and medium businesses have no ready answer.
This guide explains what the NIST AI Risk Management Framework is, why it matters to UK businesses, and how to put it in place without a six-month consultancy project.
What is the NIST AI Risk Management Framework?
The AI Risk Management Framework (AI RMF) is published by the US National Institute of Standards and Technology, the same body behind the widely used NIST Cybersecurity Framework. Version 1.0 (NIST AI 100-1) was released on 26 January 2023 after public consultation with industry and government. It is free and voluntary.
Its job is simple: help organisations manage the risks AI creates for people, for the business and for society. It applies whether you build AI or simply use it, which includes Microsoft Copilot, ChatGPT and the AI features now built into most business software.
In July 2024 NIST added a Generative AI Profile (NIST AI 600-1), covering risks specific to tools like Copilot and ChatGPT. NIST is now revising the core framework, and has started work on further profiles, so it is a living standard rather than a one-off document.
The four functions: Govern, Map, Measure, Manage
The framework is built around four functions. Govern runs through everything; the other three are repeated for each AI tool you use.
- Govern: an AI policy the board has agreed, named owners for each AI tool, clear accountability and staff who know how to use AI safely.
- Map: know what AI you actually use, what it is for, what data it can reach and who could be affected if it goes wrong.
- Measure: test and monitor your AI for security, privacy, accuracy and bias, and keep a record of the results.
- Manage: prioritise the risks, fix what needs fixing, handle incidents and switch off AI that is not safe or not approved.
What “trustworthy AI” means in the framework
NIST describes trustworthy AI as valid and reliable, safe, secure and resilient, accountable and transparent, explainable and interpretable, privacy-enhanced, and fair with harmful bias managed. You do not need to be an AI engineer to act on this. For most businesses it comes down to three practical questions: is our data protected, can we explain what the AI is doing, and is a person accountable for each decision it supports?
Why a US framework matters to UK businesses
The NIST AI RMF is not UK law. But it has become the reference point that enterprise buyers, US-owned customers, insurers and auditors reach for when they ask about AI. Following it gives you a recognised, structured answer, rather than a policy written from scratch.
It also sits neatly alongside the rest of your compliance. If you already hold Cyber Essentials or ISO 27001, much of the groundwork (access control, device security, monitoring, supplier checks) is already in place. And if a customer later asks for a certificate, the same controls carry straight across to ISO 42001, the certifiable AI management standard.
NIST AI RMF or ISO 42001?
You do not have to choose. NIST tells you what good AI risk management looks like; ISO 42001 turns it into an auditable management system with a certificate at the end. There is no NIST AI RMF certificate, so a common route is to adopt NIST first, get the controls working, and certify to ISO 42001 when a customer or tender asks for it.
Five steps to get started this month
- List your AI. Every tool, plug-in and AI feature in use, including the ones staff connected themselves.
- Agree an AI policy. What is allowed, what data can go where, and who owns each tool.
- Lock down access. MFA, conditional access and device checks so only trusted people on trusted devices use AI with company data.
- Keep sensitive data out of public models. Block unapproved AI apps and consider private AI on your own hardware for your most sensitive work.
- Monitor and record. Log AI use, review it, and keep the evidence ready for the next questionnaire.
How Total Group helps
We provide and run the controls behind each of the four functions: the AI register, policy templates, access and device controls, security testing, 24/7 monitoring and supplier checks. You get a working framework and the evidence to prove it. See how each function maps to our services on our NIST AI Risk Management Framework page.
Not sure where you stand? Book a free AI Readiness review or call us on 01727 881 224. We will show you which controls you already meet and what to do next, in plain English.
The NIST AI Risk Management Framework is published by the US National Institute of Standards and Technology and is free to use. Total Group is not affiliated with NIST. Read the framework at nist.gov.
