Short answer. The NIST AI Risk Management Framework (AI RMF) is a voluntary framework published on 26 January 2023 that organizes AI risk work into 4 functions: Govern, Map, Measure, and Manage. It is sector-neutral and carries no legal penalty, yet financial institutions use it as the working method that produces the evidence regulators ask for. Organizations that run the AI RMF already hold roughly 60 to 70 percent of the foundation the EU AI Act requires.
The AI RMF, formally numbered NIST AI 100-1, gives a bank or insurer a repeatable way to answer one question about every AI system it runs: what could go wrong, how do we know, and who is accountable. It does this without prescribing specific tools or model types, which is why teams in Bratislava, Prague, and Vienna can apply the same structure to a credit-scoring model, a claims-triage assistant, and a customer chatbot.
The framework turns abstract “responsible AI” language into concrete tasks tied to the four functions. A working program looks like this:
NIST released a companion in 2024. The Generative AI Profile, numbered NIST AI 600-1 and published on 26 July 2024, adds 12 risk categories specific to generative systems, including confabulation and harmful content, and maps them back to the same four functions.
Financial services sit under model-risk expectations that predate modern AI, and supervisors now read those expectations onto machine-learning systems. The AI RMF gives institutions a common vocabulary between the model owners, the risk function, and the auditors who review them. Because the framework is method rather than law, it slots underneath binding rules instead of competing with them.
For a Central European institution, the binding rules are the EU AI Act and DORA. The EU AI Act carries penalties up to 35 million euro or 7 percent of global annual turnover, and its high-risk obligations for providers and deployers phase in through August 2026 and August 2027. The AI RMF does not replace those duties. It produces the technical documentation, testing records, and oversight logs that a conformity assessment then draws on, which is why running it early lowers the cost of compliance later.
The NIST AI RMF is a voluntary framework, published 26 January 2023, built on 4 functions: Govern, Map, Measure, and Manage.
Govern, Map, Measure, and Manage form the core of the framework. Govern sits at the center and establishes the policies, roles, and accountability that hold the other three together. Map contextualizes risk for a specific system and use case, so the same model can be treated differently when it scores loans than when it drafts marketing copy. Measure assesses those risks with quantitative and qualitative methods and monitors them over time. Manage decides what to do about each risk, allocates resources to the response, and tracks its effect.
The functions are not a one-time checklist. They run continuously across the system lifecycle, from design and data acquisition through testing, deployment, monitoring, and eventual retirement. A model that passed its fairness test at launch still needs the Measure function to catch drift 8 months later.
The Generative AI Profile is a companion document that applies the AI RMF to large language models and other generative systems. It does not create a separate framework. It adds 12 generative-specific risk categories, such as confabulation, data privacy leakage, and intellectual-property exposure, and attaches new subcategories to the existing Govern, Map, Measure, and Manage functions.
For a bank piloting a generative assistant, the Profile is the practical bridge between “we tested a fraud model” and “we tested a system that writes text.” It names the failure modes that a traditional model-validation checklist misses, and it keeps them inside one governance structure instead of a second, parallel process.
The AI RMF is voluntary guidance with no enforcement. The EU AI Act is law, with defined obligations, prohibited practices, and financial penalties. The AI RMF is sector-neutral and applies to any AI system an organization chooses to run through it. The EU AI Act scopes duties by risk tier and by role, so the same system can trigger different obligations depending on whether you built it or deployed it.
These two are complementary, not competing. Institutions operating in Europe typically use the AI RMF as the internal operating model and rely on it to generate the evidence that supports EU AI Act compliance, without treating it as a substitute for the Act’s role-scoped and system-type-scoped requirements.
ISO/IEC 42001 is a certifiable management-system standard for AI. The AI RMF is the risk-management method that fills it. A common pattern is to use ISO/IEC 42001 for the management-system structure and external certification, the AI RMF for the risk-management methodology inside it, and the EU AI Act for the prescriptive obligations that apply to high-risk systems. Built together, one set of policies, processes, and documentation can satisfy all three, which is why treating them as separate projects wastes effort.
Start with the Map function: build a single inventory of every AI and machine-learning system in use, including the ones business teams adopted without IT sign-off. Risk classification is impossible without a complete list, and the inventory is also the first thing an EU AI Act reviewer expects to see. Record each system’s purpose, data, outputs, affected people, and owner.
From there, apply Govern to assign accountability, then Measure and Manage to the highest-risk systems first, typically the models that make or influence decisions about credit, claims, and customers. This sequence puts effort where supervisory attention is heaviest and produces usable compliance evidence within the first cycle.
A framework only matters when it reaches production, and that is the gap Ableneo closes. In 2025 Ableneo shipped 34 production AI projects, with roughly 4 of 5 initiatives reaching live operation and 94 percent using large language models, across financial-services clients that include ČSOB, Erste, and UNIQA. That track record in regulated Central European institutions means the AI RMF functions are not theory for our teams, they are how governed models actually get built, measured, and kept in service. Our practical approach to AI transformation for regulated industries treats governance as the foundation that lets AI ship, not the paperwork that follows it.
Key takeaways
Planning AI in a regulated business? Ableneo takes systems from classification to governed production.