NIST AI RMF
NIST AI RMF Gap Assessment Template
A category-level gap assessment against the NIST AI Risk Management Framework 1.0 (NIST AI 100-1, January 2023). The framework is voluntary. Its four functions are Govern, Map, Measure and Manage. For a generative system, NIST AI 600-1 (July 2024) is an overlay of risk themes, not a replacement for the four functions. Adopting the framework is not a general legal safe harbor. Colorado SB 26-189 was enacted May 14, 2026. Section 5 makes the repeal-and-reenactment, which removes SB 24-205's rebuttable presumption for following a recognized framework such as the NIST AI RMF, effective January 1, 2027. Plan as if the presumption will not be available after that date. Under Texas TRAIGA section 552.105(e)(2), each route requires actually discovering the violation: through feedback; through testing, including adversarial or red-team testing; by following applicable state agency guidelines; or through an internal review process while in substantial compliance with the NIST AI RMF Generative AI Profile or another recognized framework. Third-party misuse is a separate defense. The point of the worksheet is the evidence.
Last reviewed
Template only — not legal advice.
When to use
- When an AI risk program needs a baseline and the organization does not yet have one document that covers all four functions.
- Before a customer, a board or an auditor asks how AI risk is managed and the honest answer would be a set of slide decks.
- When a generative system is added and someone needs to see which NIST AI 600-1 themes no category currently covers.
- On whatever cadence you set. The framework does not impose one, which is not the same as never repeating the assessment.
How to use this template
- 1
Name the systems in scope and write down what 0 to 4 means for this assessment. The scale on the first section is a suggestion. It is not a NIST scale.
- 2
Score the current state only where the evidence cell names a document, a record or a practice someone else could open. An empty evidence cell is a gap, not a middle score.
- 3
Set a target a named owner can reach. Do not set every row to 4.
- 4
If any system in scope is generative, complete the overlay and name which category already addresses each theme.
- 5
Move the gaps you will actually work into the remediation table. Add Playbook subcategories under a row (for example GOVERN 1.1) when the category is too coarse. This worksheet does not pre-build them.
The template
Scope and context
Write the boundary before anyone scores a row. "The company" is not a scope if three product teams ship models and a fourth pastes a vendor chatbot into a workflow. The maturity scale below is a suggested scale for this worksheet so that two assessors mean the same thing by a "2". NIST does not define these five levels.
| Field | Response |
|---|---|
| Systems in scopeName them. Include vendor systems people actually use, not only systems you trained. | — |
| Assessment date | — |
| AssessorsNames and roles. One person scoring their own function is a draft, not an assessment. | — |
| How this assessment uses the 0–4 scaleSuggested scale, not from NIST: 0 Not started, 1 Ad hoc, 2 Defined, 3 Implemented, 4 Measured and improved. Change the words if you need to, and record the words you used. | — |
Suggested scale, for this worksheet only: 0 Not started — no practice and no owner. 1 Ad hoc — something happens, depending on who is in the room. 2 Defined — the practice is written down. 3 Implemented — the written practice is what people do. 4 Measured and improved — someone checks whether it works and changes it when it does not. NIST AI 100-1 does not publish this scale.
Govern
Govern is whether the organization can say, in documents that exist, who decides and how risk is supposed to be handled. Useful evidence is an AI policy someone could violate, a RACI that names a person rather than a department, a record of who was trained, and a third-party intake rule that is applied to software and data you did not build. A policy that has never been opened during a real decision is a 2 at best.
| Category | What it asks | Current state (0–4) | Target | Evidence | Gap | Owner | Priority |
|---|---|---|---|---|---|---|---|
| GOVERN 1 | Policies, processes, procedures and practices for mapping, measuring and managing AI risk are in place, transparent and implemented. | — | — | — | — | — | — |
| GOVERN 2 | Accountability structures are in place so the right teams and individuals are empowered, responsible and trained. | — | — | — | — | — | — |
| GOVERN 3 | Workforce diversity, equity, inclusion and accessibility are prioritized in the work of mapping, measuring and managing AI risk. | — | — | — | — | — | — |
| GOVERN 4 | Teams are committed to a culture that considers and communicates AI risk. | — | — | — | — | — | — |
| GOVERN 5 | Processes are in place for robust engagement with relevant AI actors and with parties affected by the system. | — | — | — | — | — | — |
| GOVERN 6 | Policies and procedures address AI risks and benefits arising from third-party software, data and the rest of the supply chain. | — | — | — | — | — | — |
Map
Map is the context of a specific system: what it is for, what it is made of, and who can be harmed or helped. Useful evidence is a short context note (users, operators, affected people, where the output is used), a categorization you can point at, a statement of benefits and costs against some benchmark you name, an inventory of components that includes third-party models and data, and an impact note that is not only the business case. A risk register with no system named on the row is not Map evidence.
| Category | What it asks | Current state (0–4) | Target | Evidence | Gap | Owner | Priority |
|---|---|---|---|---|---|---|---|
| MAP 1 | Context is established and understood. | — | — | — | — | — | — |
| MAP 2 | The AI system is categorized. | — | — | — | — | — | — |
| MAP 3 | Capabilities, targeted usage, goals, and expected benefits and costs are understood, compared with appropriate benchmarks. | — | — | — | — | — | — |
| MAP 4 | Risks and benefits are mapped for all components of the system, including third-party software and data. | — | — | — | — | — | — |
| MAP 5 | Impacts to individuals, groups, communities, organizations and society are characterized. | — | — | — | — | — | — |
Measure
Measure is how you know the risks in Map are real, shrinking or growing. Useful evidence is a set of methods and metrics chosen for those risks, an evaluation of the trustworthy characteristics you claim (a single accuracy figure is not that), a way to see the same risk again later, and a note on whether the measurement itself was any good. A test report that nobody compared with the risk register does not score as implemented.
| Category | What it asks | Current state (0–4) | Target | Evidence | Gap | Owner | Priority |
|---|---|---|---|---|---|---|---|
| MEASURE 1 | Appropriate methods and metrics are identified and applied. | — | — | — | — | — | — |
| MEASURE 2 | AI systems are evaluated for trustworthy characteristics. | — | — | — | — | — | — |
| MEASURE 3 | Mechanisms to track identified AI risks over time are in place. | — | — | — | — | — | — |
| MEASURE 4 | Feedback about the efficacy of measurement is gathered and assessed. | — | — | — | — | — | — |
Manage
Manage is what you do with what Map and Measure found. Useful evidence is a risk register whose rows have a priority, a response and an owner, a written approach to increasing benefits and reducing harms that affected parties had a chance to inform, a way of dealing with third-party risk that is more than the contract, and response, recovery and communication plans that someone reviews. An incident playbook that has never been read against an AI failure mode is a draft.
| Category | What it asks | Current state (0–4) | Target | Evidence | Gap | Owner | Priority |
|---|---|---|---|---|---|---|---|
| MANAGE 1 | AI risks identified in Map and Measure are prioritized, responded to and managed. | — | — | — | — | — | — |
| MANAGE 2 | Strategies to maximize benefits and minimize negative impacts are planned, prepared, implemented and documented, and informed by relevant AI actors. | — | — | — | — | — | — |
| MANAGE 3 | AI risks and benefits from third-party entities are managed. | — | — | — | — | — | — |
| MANAGE 4 | Risk treatments, including response, recovery and communication plans, are documented and monitored regularly. | — | — | — | — | — | — |
Generative AI overlay (NIST AI 600-1)
Complete this section when any system in scope generates content or is itself a generative model. NIST AI 600-1 (July 2024) names the themes below. It does not add a fifth function. For each theme, say whether it is in scope for the systems you listed, which Govern / Map / Measure / Manage category already addresses it, and what is still open. A theme with no category next to it is a gap even if every category above scored well.
| Risk theme | In scope? | Addressed by which category | Notes |
|---|---|---|---|
| CBRN information or capabilities | — | — | — |
| Confabulation | — | — | — |
| Dangerous, violent or hateful content | — | — | — |
| Data privacy | — | — | — |
| Environmental impacts | — | — | — |
| Harmful bias and homogenization | — | — | — |
| Human-AI configuration | — | — | — |
| Information integrity | — | — | — |
| Information security | — | — | — |
| Intellectual property | — | — | — |
| Obscene, degrading and/or abusive content | — | — | — |
| Value chain and component integration | — | — | — |
These are the risk themes NIST AI 600-1 names. The profile's suggested actions sit underneath them. This worksheet does not copy those actions; use the profile when you turn a "yes, in scope" row into work.
Prioritized remediation plan
Bring forward only the gaps you intend to close before the next assessment. A plan that lists every empty cell will not be used. Owner is a person. Due is a date. Status is a word you define and then keep.
| Gap | Action | Owner | Due | Status |
|---|---|---|---|---|
| — | — | — | — | — |
| — | — | — | — | — |
| — | — | — | — | — |
| — | — | — | — | — |
| — | — | — | — | — |
Sign-off
The sign-off is that the scores match the evidence the assessors saw, not that the organization has finished the framework. Subcategory detail (GOVERN 1.1 and the rest of the NIST AI RMF Playbook) is out of scope for this template. Add those identifiers under a category row when you need them.
| Field | Response |
|---|---|
| Prepared by | — |
| Reviewed by | — |
| Approved by | — |
| Date | — |
| Next assessment date | — |
Category wording on this worksheet is a paraphrase, not the text of NIST AI 100-1. Primary documents: NIST AI 100-1 (January 2023) and, for generative systems, NIST AI 600-1 (July 2024). Last reviewed 2026-09-26.
Frequently asked questions
Is the NIST AI RMF mandatory?
No. AI RMF 1.0 (NIST AI 100-1, January 2023) is voluntary guidance from NIST. Nothing in the framework makes it binding on a US company. Organizations use it because a documented Govern, Map, Measure and Manage record is what a customer, an auditor or a court will ask to see. That is an evidentiary reason, not a statutory one.
How is this different from ISO/IEC 42001?
The AI RMF is a voluntary risk-management framework: four functions and a set of categories an organization can adopt in whole or in part. ISO/IEC 42001:2023 is a management-system standard. An accredited certification body can audit an AI management system against it. Nobody certifies an organization "to the AI RMF", and this worksheet does not ask you to pretend otherwise. Many teams use the framework to find the gaps and the management system to run the controls. They are not substitutes.
Does following the AI RMF give a legal safe harbor?
Not by itself. Adopting the framework creates no general legal presumption. Colorado SB 26-189 was enacted May 14, 2026. Section 5 makes the repeal-and-reenactment, which removes SB 24-205's rebuttable presumption for following a recognized framework such as the NIST AI RMF, effective January 1, 2027. Plan as if the presumption will not be available after that date. Texas is the exception worth knowing: TRAIGA (HB 149, Texas Business & Commerce Code chapter 552, effective January 1, 2026) section 552.105(e)(2) requires the defendant to have actually discovered the violation, through feedback, through testing including adversarial or red-team testing, by following applicable state agency guidelines, or through an internal review process while in substantial compliance with the NIST AI RMF Generative AI Profile or another recognized framework. Third-party misuse is a separate defense. The statute is enforced only by the Texas Attorney General. It is a conditional defense, not immunity, and it only applies to TRAIGA claims. The record this worksheet produces is the evidence those routes need.
Do we need the Generative AI Profile?
Use NIST AI 600-1 when a system in scope generates content or is a generative model. It is a profile published in July 2024. It cross-cuts the four functions with a list of risk themes (confabulation, information integrity, human-AI configuration, and the others on this worksheet). It does not replace Govern, Map, Measure and Manage, and it is not a separate certification. If none of the systems in scope are generative, say so in the overlay and leave the rows out of scope.
This template is not legal advice.
As of September 14, 2026. We are not lawyers and this is not legal advice. It is the responsibility of consumers of this data that they verify the applicability and current ratified statutes and legal precedence with a qualified attorney licensed in the state or country they are researching.
From a worksheet to a readiness assessment
A template records the decision. A readiness assessment is where that decision gets tested against the way the organization actually ships.