Why This Framework Suddenly Matters
The National Institute of Standards and Technology (NIST) introduced the AI Risk Management Framework (AI RMF) in January 2023 to help organizations identify, assess and manage risks associated with artificial intelligence. While the framework is voluntary, its role in the federal AI landscape has continued to grow as agencies develop more formal approaches to AI governance and oversight.
Federal AI requirements are also evolving quickly. Guidance from the Office of Management and Budget (OMB), emerging Department of Defense acquisition requirements and ongoing updates to NIST guidance are creating a more structured environment for how agencies evaluate and manage AI risk. For federal contractors, this means AI governance can no longer be treated as a one-time compliance exercise. Organizations need processes that can adapt as policies, standards and acquisition expectations change.
As agencies place greater emphasis on trustworthy AI, alignment with the AI RMF can help contractors demonstrate that risk management is embedded throughout AI development and deployment. Familiarity with the framework is also becoming an important baseline for organizations pursuing federal AI opportunities.
What the NIST AI RMF Actually Is
The NIST AI Risk Management Framework (AI RMF) is a voluntary framework designed to help organizations identify, assess and manage risks associated with artificial intelligence. Rather than prescribing a fixed set of requirements, it provides a structured approach built around four core functions:
- Govern: Establish policies, roles, responsibilities and processes for managing AI risk across the organization.
- Map: Understand the context in which an AI system operates, including its intended purpose, users, potential impacts and associated risks.
- Measure: Assess and track AI risks using appropriate methods, metrics and testing to understand how a system performs.
- Manage: Prioritize identified risks and take action to address, monitor and respond to them throughout the AI lifecycle.
Unlike compliance frameworks such as the Cybersecurity Maturity Model Certification (CMMC), the AI RMF is not a certification program or control checklist. There is no universal passing score or formal designation for being “AI RMF compliant.” Instead, the framework helps organizations make informed, risk-based decisions based on their specific AI systems and use cases.
NIST developed the AI RMF through a collaborative process involving input from government, industry, academia and other stakeholders, including workshops and public-comment periods. This approach was intended to create a flexible framework that organizations across sectors can apply as AI technologies and their associated risks continue to evolve.
How It’s Becoming a De Facto Requirement
Although the NIST AI RMF remains voluntary, federal policy and acquisition practices are giving it greater practical significance. Agencies are increasingly expected to establish processes for evaluating, monitoring and managing AI risks, making the principles outlined in the framework relevant to contractors developing or supporting AI-enabled systems.
The framework provides a common structure that agencies can use to shape acquisition requirements, evaluate vendor risk-management practices and establish expectations throughout the AI lifecycle. Contractors may increasingly encounter solicitations, contract requirements or agency-specific policies that reflect AI RMF concepts even when the framework itself is not explicitly mandated.
For contractors, proactively aligning AI governance practices with the AI RMF can help demonstrate readiness for this changing acquisition environment. Building processes to govern, map, measure and manage AI can make it easier to respond as agencies introduce more specific requirements for AI risk management, documentation and oversight.
OMB M-25-21 and Agency Mandates
In April 2025, the Office of Management and Budget (OMB) issued M-25-21, accelerating federal use of AI through innovation, governance and public Trust, replacing M-24-10 as the primary government-wide policy governing federal agencies’ use of AI. M-25-21 requires agencies to maintain AI governance structures, including a Chief AI Officer (CAIO) and an inventory of AI use cases, while establishing additional safeguards for high-impact AI.
For contractors, these requirements may translate into greater expectations around AI documentation, testing, monitoring and risk management. OMB’s companion procurement guidance, M-25-22, further connects AI governance with federal acquisition, making mature AI risk-management practices increasingly important during the contracting process.
The DoD/CMMC Trajectory (NDAA Section 1513)
The FY 2026 National Defense Authorization Act (NDAA) signals where AI security requirements may be headed for defense contractors. Section 1513 directs the Department of Defense (DoD) to develop a risk-based framework for cybersecurity and physical security standards for covered AI and machine learning technologies.
The legislation directs DoD to build on existing cybersecurity guidance where possible, including the CMMC, connecting emerging AI security requirements with frameworks already familiar to the Defense Industrial Base.
For contractors developing, deploying, storing or hosting covered AI technologies, this makes strengthening AI governance, documenting risks and extending existing cybersecurity practices to AI-specific threats an important step toward future readiness.
The Generative AI Profile — A Closer Look
As generative AI adoption expanded, NIST developed additional guidance to address risks that are distinct from traditional AI systems. The NIST AI 600-1 Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile, serves as a companion resource to the broader AI RMF. It identifies 12 categories of generative AI risk and more than 200 potential risk-management actions mapped to the core AI RMF. Key areas include:
- Risks associated with inaccurate or fabricated outputs
- Data privacy
- Information integrity
- Intellectual property
- Cybersecurity
- Content provenance, including methods for tracking the origin and history of AI-generated or AI-modified content.
For federal contractors, this profile is particularly relevant to common uses of generative AI, including chatbots, content generation and other tools built on generative models. Organizations using these technologies can apply the profile alongside the core AI RMF to identify risks specific to generative AI and establish appropriate safeguards throughout its lifecycle.
What’s Changing — Critical Infrastructure Profile & the Ongoing Revision
The NIST AI RMF continues to evolve alongside emerging AI technologies and use cases. On April 7, 2026, NIST released a concept note for a new Trustworthy AI in Critical Infrastructure Profile, designed to help critical infrastructure operators apply AI risk management practices across information technology, operational technology and industrial control systems. The profile is expected to address AI-enabled capabilities in areas such as cybersecurity, facility monitoring, autonomous systems and infrastructure management.
NIST is currently revising AI RMF 1.0, reinforcing the need for federal contractors to treat the AI RMF as a living framework rather than static guidance. Organizations should regularly monitor NIST updates, evaluate new profiles and adjust their AI risk management practices as federal expectations and technologies evolve.
Practical First Steps
Federal contractors do not need to wait for AI requirements to appear in a solicitation before strengthening their approach to AI risk management. A few practical steps can help organizations build a foundation now:
- Map current and planned AI use cases: Identify where AI is already being used or considered across the organization and evaluate each use case through the AI RMF’s.
- Govern, Map, Measure and Manage functions: This can help uncover gaps in oversight, risk assessment, testing and ongoing monitoring.
- Document governance practices: Start recording who is responsible for AI decisions, how systems are evaluated, what risks have been identified and how those risks are addressed. NIST emphasizes documentation and transparency throughout the RMF, making consistent records an important part of demonstrating how AI risks are managed.
- Monitor federal acquisition requirements: Review RFPs, solicitations and agency guidance for references to the AI RMF and related AI risk management expectations. These requirements can provide an early indication of the practices agencies expect contractors to demonstrate.
- Build for change: AI policies and guidance continue to evolve, so organizations should establish a process for reviewing new requirements and updating their governance practices rather than treating AI RMF alignment as a one-time exercise.
Preparing now can help agencies adapt as federal AI expectations continue to evolve. RELI Group works alongside federal agencies to navigate these changes, bringing AI and data expertise to support responsible, mission-focused innovation. Learn more about our Innovation Initiatives.