The NIST AI Risk Management Framework (AI RMF 1.0, NIST AI 100-1, published January 26, 2023) is a voluntary framework that organises AI risk management into four functions — Govern, Map, Measure and Manage — broken into 19 categories and 72 subcategories of outcomes, and defines seven characteristics of trustworthy AI: valid and reliable, safe, secure and resilient, accountable and transparent, explainable and interpretable, privacy-enhanced, and fair with harmful bias managed. It is the scaffold most US banks use for enterprise AI governance: Truist says its AI programme is 'foundationally based' on it, KeyBank's AI risk framework follows the four functions, Capital One maps in-house model development to it and its generative-AI profile, and Columbia Banking runs an AI Control Tower aligned to it. Three NIST companions extend it: the Generative AI Profile (AI 600-1, July 26, 2024) adds twelve generative-AI risks and 211 suggested actions; the adversarial machine learning taxonomy (AI 100-2e2025, March 24, 2025) supplies the threat vocabulary for the 'secure and resilient' characteristic; and the Cyber AI Profile (IR 8596, preliminary draft December 16, 2025) applies Cybersecurity Framework 2.0 to AI. Treasury's February 2026 FS AI RMF adapts the framework to financial services, and NIST is revising AI RMF 1.0 under the July 2025 AI Action Plan.
TRACKED DOCUMENTS: NIST AI RMF 1.0 · NIST AI 600-1 (Generative AI Profile) · NIST AI 100-2e2025 (Adversarial ML) · NIST IR 8596 (Cyber AI Profile)
What is the NIST AI RMF and why do banks use it?
NIST AI 100-1 is the document; ‘AI RMF 1.0’ is the framework it describes. Congress directed NIST to write it in the National Artificial Intelligence Initiative Act of 2020, NIST ran a request for information in 2021 and two public drafts in 2022, and published the final text on January 26, 2023, with the AI RMF Playbook the same day. Part 1 of the framework explains how AI risk differs from conventional software risk, who the framework is for and what makes an AI system trustworthy. Part 2 is the Core: the four functions, their categories and their subcategories, each written as an outcome rather than a control. Nothing in it is mandatory, and no US banking agency has incorporated it into guidance.
Banks use it anyway, for a reason that is specific to banking. Model risk management under SR 11-7 and, since April 17, 2026, SR 26-2 governs quantitative models one at a time: inventory, validation, effective challenge. It does not govern an enterprise AI programme — who may buy a copilot, what a customer assistant may say, how an agent’s tool access is approved — and the 2026 revision explicitly leaves generative and agentic AI to banks’ broader risk programmes. The RMF supplies the missing structure, and it does so in a form examiners can read: a written profile that selects the Core outcomes that apply, maps each to an existing control, and names the evidence. That is why Truist’s 2025 10-K says its AI programme is ‘foundationally based’ on the framework, why KeyBank’s Corporate Responsibility Report says its AI risk framework follows the four NIST functions, why Capital One maps in-house model development to the RMF and its generative-AI profile, and why Ally calls the RMF the reference frame for its four-layer governance. Columbia Banking centralises oversight of AI assets, models and prompts in a ServiceNow AI Control Tower aligned to the framework. Six of the 140 bank profiles on this site cite the framework by name; two more link to it in their regulatory mapping.
Two caveats sit on top of all of this. The framework is being revised: NIST says AI RMF 1.0 is under revision as part of the July 2025 America’s AI Action Plan, which also tells NIST to remove references to misinformation, diversity and climate change; no revised draft has been published as of this guide’s date. And a sector profile now exists: Treasury’s Financial Services AI RMF of February 19, 2026 adapts the framework to the operational, regulatory and consumer-protection specifics of finance. A bank starting today should build on AI 100-1 but read the FS AI RMF alongside it, and expect to re-map once the revision lands.
What are the four functions: Govern, Map, Measure and Manage?
The Core has four functions. Govern is cross-cutting: it cultivates a risk-management culture, sets policies, assigns accountability and runs the processes that make the other three work, including for third-party systems and data. Map establishes context before a system is built or bought: its intended purpose, deployment setting, affected people, components, benefits and costs. Measure is the testing, evaluation, verification and validation that shows whether the trustworthiness characteristics are met, and the tracking of risks over time. Manage is the response: which risks are treated, transferred, avoided or accepted, how third-party risk is handled, and how incidents, recovery and decommissioning are planned. NIST describes Map, Measure and Manage as iterative and cross-referencing, with Govern informing all three; the figure below is the conventional way to draw it.
Counts matter because they drive the size of a bank’s evidence pack. Counting the Core tables in NIST AI 100-1 gives 19 categories and 72 subcategories: Govern has six categories and 19 subcategories, Map five and 18, Measure four and 22, Manage four and 13. Measure 2 alone has 13 subcategories, one per trustworthiness characteristic plus several on evaluation method, which is why validation evidence is the largest single artefact in any RMF-aligned programme. The Playbook adds suggested actions, documentation prompts and references for every subcategory and is downloadable as CSV, Excel and JSON, so most banks load it into their GRC tool and tailor from there rather than writing a control library from scratch.
What are the 19 categories, and what does a bank's evidence look like for each?
The table restates every category in the Core, gives its subcategory count from the official text, and names the evidence a bank would file for it, with examples drawn from the bank profiles on this site. The evidence column is our reading, not NIST’s; the Playbook’s ‘documentation’ prompts for each subcategory are the closest official equivalent.
| Category | Subcategories | Outcome (paraphrased from NIST AI 100-1) | What a bank's evidence looks like |
|---|---|---|---|
| Govern 1 | 7 | Policies, processes, procedures and practices for mapping, measuring and managing AI risk are in place, transparent and implemented | Board-approved AI policy and AI standard; a written AI risk appetite; a legal and regulatory inventory (Govern 1.1). KeyBank’s Enterprise Risk Management Committee approves the AI Policy; Barclays discloses an AI Policy with prohibited, high, medium and low-risk uses and an AI Standard introduced in 2025. |
| Govern 2 | 3 | Accountability structures: roles, responsibilities and lines of communication are documented and clear | A named owner. Barclays’ Head of AI/ML Risk reports into Model Risk Management and chairs the Group AI Governance Council; CVB Financial’s AI Governance Council is chaired by the COO with the CIO, CISO and an Associate General Counsel on it. |
| Govern 3 | 2 | Workforce diversity, equity, inclusion and accessibility in AI risk decisions | Cross-functional membership of the review body (technology, risk, compliance, legal, security), as at Columbia Banking; training records. Citi gave 175,000 staff 60 days to complete ‘Prompting like a Pro’. |
| Govern 4 | 3 | A culture that considers and communicates AI risk; safety-first mindset; incident disclosure | Incident and near-miss reporting routed to the AI risk forum; the 10-K AI risk factor that Truist, Ally, Capital One and KeyBank now carry is the public face of this category. |
| Govern 5 | 2 | Processes for engagement with affected parties and external feedback | Customer-complaint and model-appeal channels that feed back to model owners; Truist’s Client Pulse aggregates feedback across millions of conversations. |
| Govern 6 | 2 | Policies for third-party AI risk, including IP, and contingency processes for third-party failures | Vendor AI due-diligence standard and exit plans; the NIST GenAI profile’s value-chain risk maps here. PNC is adopting model-data ‘nutrition labels’ for vendor training data. |
| Map 1 | 6 | Context is established: intended purpose, deployment setting, affected users, mission alignment | A use-case intake record per system, with purpose, users and business owner. HSBC reviews every novel use case before pilot; NatWest triages every AI use case through its AIDE process. |
| Map 2 | 3 | The AI system is categorised: task, method, knowledge limits, human oversight | Model inventory fields for technique (classifier, generative model, agent) and human-in-the-loop design; the SR 26-2 / SS1/23 model inventory already carries most of this. |
| Map 3 | 5 | Capabilities, targeted usage, goals, costs and benefits are understood | A benefits-and-costs statement per use case; Truist says every deployment needs a defined return on investment. |
| Map 4 | 2 | Risks and benefits are mapped for every component, including third-party data and software | Component-level risk register (data, model, prompts, tools); Columbia Banking centralises oversight of AI assets, models and prompts in a ServiceNow AI Control Tower aligned to the RMF. |
| Map 5 | 2 | Impacts to individuals, groups, communities and society are characterised | Fair-lending and disparate-impact analysis for credit and marketing models; the same work that ECOA and Regulation B already require. |
| Measure 1 | 3 | Appropriate methods and metrics are identified and applied, starting with the most significant risks | A test plan per tier naming the metrics; independent assessment of what is not measurable and why. |
| Measure 2 | 13 | AI systems are evaluated for the trustworthiness characteristics (validity, safety, security, bias, privacy, explainability, …) | Validation reports, fairness tests, red-team results. KeyBank’s AI observability and evaluation platform standardises generative-AI testing; Truist trains a challenger beside every production model. |
| Measure 3 | 3 | Mechanisms for tracking identified risks over time, including emergent risks | Model performance monitoring with thresholds and drift alerts; Truist monitors outputs against thresholds in near real time. |
| Measure 4 | 3 | Feedback about the efficacy of measurement is gathered and assessed | Validation findings reviewed by domain experts and end users; a periodic review of whether the metrics still match the deployment context. |
| Manage 1 | 4 | Risks are prioritised, responded to and managed based on the Map and Measure results | Go / no-go decisions recorded with the risk rationale; BNP Paribas’ Group AI Committee evaluates use cases against risk assessments before approval. |
| Manage 2 | 4 | Strategies to maximise benefits and minimise negative impacts, including non-AI alternatives | Documented consideration of a rules-based alternative; Bank of America’s CTIO says every AI project is reviewed against 16 risk pillars and AI is often rejected in favour of deterministic rules. |
| Manage 3 | 2 | AI risks and benefits from third-party entities are managed and monitored | Vendor model monitoring, contractual rights to test, and pre-trained model provenance; SS1/23 Principle 2.6 and SR 26-2 third-party model expectations overlap here. |
| Manage 4 | 3 | Risk treatments including response, recovery and communication plans are documented and monitored | Post-deployment monitoring plan, decommissioning criteria, incident playbooks and an override route for users; Lloyds holds models and use cases in a central inventory, and its board risk committee has held a deep dive on generative and agentic AI. |
Two patterns emerge from the profiles. First, the Govern evidence is what banks publish: named councils, board committee ownership, an AI policy, a 10-K risk factor. Of the 140 bank profiles tracked here, the most common named structures are an AI governance council or committee (Bread Financial, CVB Financial, Barclays, BNP Paribas, Commonwealth Bank, Standard Chartered, Lloyds), a board technology or risk committee with explicit AI oversight, and, increasingly, a head of AI risk inside model risk management. Second, the Measure evidence is what banks mostly do not publish; where it surfaces it is in platform language, such as KeyBank’s AI observability and evaluation platform or Truist’s champion–challenger monitoring. An examiner reading an RMF profile will look for both halves.
What are the seven trustworthiness characteristics, with bank examples?
Part 1 of the framework lists seven characteristics of trustworthy AI and says valid and reliable is the baseline the others depend on, while accountable and transparent cuts across all of them. They are the objects of the Measure function: Measure 2’s subcategories test for each. The table pairs each characteristic with its meaning in NIST’s words, paraphrased, and with the way it shows up in the bank disclosures we track.
| Characteristic | What NIST means | Bank example from our profiles |
|---|---|---|
| Valid and reliable | Accuracy, robustness and generalisation beyond the training data; the framework calls this the baseline for the other characteristics | Champion–challenger monitoring at Truist; the 10-K risk factors at U.S. Bancorp and Wells Fargo name flawed or biased datasets and model opacity as the risks this characteristic controls. |
| Safe | Should not endanger human life, health, property or the environment; needs responsible design and the ability to halt a system | Kill-switches and human approval gates for agents: Truist’s digital teammates are still in proof-of-concept; JPMorgan’s 10-K names generative and agentic AI failures as a risk factor. |
| Secure and resilient | Withstands adversarial attack and unexpected events; the companion is the AI 100-2e2025 taxonomy | Prompt-injection, poisoning and extraction testing; Arvest’s security engineering endorsed an AI security maturity model assessed against the RMF, CSF 2.0 and the EU AI Act. |
| Accountable and transparent | Information about the system and its decisions is available to the right people; roles are assigned | Named councils: Bread Financial’s AI Governance Council (2024) reporting to the board’s Risk & Technology Committee; Commonwealth Bank’s AI Risk Committee with AI Risk Indicators in the group risk appetite statement. |
| Explainable and interpretable | Users can understand how an output was produced and what it means | Adverse-action reasons for credit models; Ally’s model validation staff include AI specialists and its 10-K names explainability explicitly. |
| Privacy-enhanced | Data minimisation, de-identification and limits on inference | Data-privacy review in the use-case intake; the GenAI profile’s data-privacy risk maps here. Columbia Banking’s 10-K names leaky generative-AI output as a risk. |
| Fair, with harmful bias managed | Systemic, computational and human bias are identified and managed | Fair-lending testing on credit and marketing models; Standard Chartered’s Responsible AI Council scores each model against fairness, ethics, transparency, performance, cyber and privacy principles before approval. |
In practice banks do not test seven characteristics separately for every system. They tier systems by materiality and then decide which characteristics are in scope at each tier, exactly as model risk tiering works under model risk management. A fraud model gets the full set with security testing emphasised; an internal document summariser gets validity, privacy and security; a marketing copy generator gets fairness, IP and content safety. The profile records that choice, which is the point: the RMF is a vocabulary for writing down what was tested and why, not a fixed test battery.
What does the Generative AI Profile (NIST AI 600-1) add?
NIST AI 600-1, published July 26, 2024, is the first NIST-authored profile of the framework. A profile is a selection and tailoring of Core outcomes for a technology, sector or use case, and this one is cross-sectoral: it names twelve risks that are unique to or exacerbated by generative AI and then lists 211 suggested actions, each filed under an AI RMF subcategory and tagged with the risks it addresses and the AI actor tasks involved. It was a deliverable under Executive Order 14110, since revoked, but it remains a standing NIST publication and is widely cited; Texas’s TRAIGA makes substantial compliance with it an affirmative defence. The profile is written for deployers as well as developers, which is the position of almost every bank.
| GAI risk (AI 600-1 section) | What it covers | Bank exposure | Example subcategories the actions map to |
|---|---|---|---|
| 2.1 CBRN information or capabilities | Eased access to chemical, biological, radiological or nuclear know-how | Low for a bank deployer; relevant to vendor model selection only | Govern 1.2, Map 1.1 |
| 2.2 Confabulation | Confidently false or fabricated content (hallucination) | High: customer assistants, call summaries, document drafting | Measure 2.5, Measure 2.13 |
| 2.3 Dangerous, violent or hateful content | Generation of incitement or hateful material | Medium: customer-facing assistants need output filters | Govern 1.3, Measure 2.11 |
| 2.4 Data privacy | Leakage, memorisation and inference of personal data | High: prompts carrying customer data; retrieval over account records | Govern 1.6, Map 4.1 |
| 2.5 Environmental impacts | Compute and energy cost of training and inference | Low to medium; appears in sustainability reporting | Map 5.1, Measure 2.12 |
| 2.6 Harmful bias and homogenisation | Amplified bias and uniform outputs across decisions | High: marketing, collections, underwriting assistance | Measure 2.11, Manage 2.2 |
| 2.7 Human-AI configuration | Over-reliance, automation bias, unclear human oversight | High: adviser copilots and agent approvals | Govern 3.2, Measure 2.8 |
| 2.8 Information integrity | Synthetic content that misleads; deepfakes | High: AI-enabled fraud and social engineering against the bank | Measure 2.7, Manage 2.3 |
| 2.9 Information security | Prompt injection, data poisoning, model extraction; lowered attack costs | High: any assistant with tool access or retrieval | Govern 1.4, Measure 2.7 |
| 2.10 Intellectual property | Infringing training data or outputs; licence terms | Medium: coding assistants, marketing content | Govern 6.1, Map 4.1 |
| 2.11 Obscene, degrading or abusive content | Generation of abusive material, including of real people | Medium: output filtering on customer channels | Govern 1.3, Measure 2.11 |
| 2.12 Value chain and component integration | Opaque third-party models, data and components | High: nearly every bank consumes foundation models through vendors | Govern 6.1, Manage 3.1 |
For a bank the four risks that dominate are confabulation, information security, human-AI configuration and value chain. Confabulation is why customer-facing assistants such as Truist Assist and call-summary tools are tested against ground truth rather than against user satisfaction alone. Information security is where the AI 100-2e2025 taxonomy comes in. Human-AI configuration is the control question for adviser copilots and agent approvals: who is accountable when a human rubber-stamps a generated recommendation. And value-chain risk is the vendor question: most banks consume foundation models through cloud and software vendors, so Govern 6 and Manage 3 evidence, plus contractual testing rights, carry more weight than in-house model documentation.
How do NIST AI 100-2 and IR 8596 fit with the RMF?
NIST publishes AI guidance in two stacks that bank teams tend to confuse. The governance stack is the AI RMF, its Playbook and its profiles. The security stack is the Cybersecurity Framework 2.0 and its profiles. Two documents sit between them.
NIST AI 100-2e2025, finalised March 24, 2025, is the adversarial machine learning taxonomy. It is a reference, not a control standard: a structured vocabulary of attacks on predictive AI (evasion, poisoning, privacy attacks such as membership inference and model extraction) and on generative AI (supply-chain attacks, direct prompting attacks including jailbreaks, indirect prompt injection via retrieved or tool content, and misuse enablement), classified by learning stage, attacker knowledge and objective. In RMF terms it is the catalogue behind the ‘secure and resilient’ characteristic and the GenAI profile’s information-security risk; in practice it is what a bank’s threat model for an LLM application or a fraud model cites.
NIST IR 8596, the Cyber AI Profile, is a profile of CSF 2.0 rather than of the AI RMF. Its preliminary draft of December 16, 2025 (comments closed January 30, 2026; no initial public draft yet) applies the CSF’s six functions to three focus areas: securing AI system components (Secure), using AI for cyber defence (Defend) and thwarting AI-enabled attacks (Thwart). NIST says it is meant to be used with the AI RMF, the AI 100-2 taxonomy and SP 800-53 controls rather than replace them. For a bank whose security programme is already CSF-mapped, which FFIEC tooling encourages, it is the shortest route to extending that mapping to AI systems; it also makes AI-enabled fraud and deepfake social engineering a cybersecurity-programme concern under Thwart, not only a fraud-team one. NIST’s COSAiS control overlays are the SP 800-53 layer beneath both.
The working division of labour: the AI RMF profile is owned by the AI governance or model-risk function and answers ‘should we run this system and is it trustworthy’; the Cyber AI Profile is owned by the CISO and answers ‘is it secured and are we defended’; AI 100-2 is the shared dictionary both teams use in test plans. Treasury’s FS AI RMF sits on the governance side as the sector tailoring.
How do US regulators and state laws reference the NIST AI RMF?
No federal banking regulator requires the RMF. Several reference it, two state statutes name it as an acceptable framework, and the documents that govern model risk do not mention it at all. The table lists every tracked document on this site that references the framework or its profiles, with what the reference does.
| Document | Issuer | Date | What it says about the RMF | Why it matters for a bank |
|---|---|---|---|---|
| Treasury FS AI RMF and AI Lexicon | Treasury / AIEOG | Feb 19, 2026 | Adapts the NIST AI RMF to financial services; first two of six AIEOG deliverables; non-binding and issued in support of the AI Action Plan | The sector profile a US bank can cite; KeyBank has adopted the AIEOG lexicon |
| Treasury AI cybersecurity risks report | Treasury | Mar 27, 2024 | Recommended a financial-sector expansion of the NIST AI RMF, data nutrition labels for vendor AI and an information-sharing forum | The origin of the FS AI RMF workplan |
| NCUA Credit Union AI Resource Center | NCUA | Aug 2025 | Points credit unions to NIST AI resources including the AI RMF, Treasury's AIEOG tools and COSO's AI guidance | Federal supervisor naming the RMF as a reference, not a requirement |
| CFTC TAC Responsible AI report | CFTC | May 2, 2024 | Recommended the Commission consider a sector AI risk management framework aligned with NIST, potentially via a proposed rule | Derivatives-side endorsement of the same scaffold |
| Colorado SB 24-205 | Colorado | May 17, 2024 | Deployers' risk management programme may follow the NIST AI RMF or ISO/IEC 42001 as an acceptable framework | A statute naming the RMF as a safe-harbour framework for high-risk AI |
| Texas TRAIGA (HB 149) | Texas | Jun 22, 2025 | Affirmative defence for a party substantially complying with the NIST Generative AI Profile or another recognised framework | Makes AI 600-1 compliance a legal defence |
| America's AI Action Plan | White House | Jul 23, 2025 | Directs NIST to revise the AI RMF; removes references to misinformation, DEI and climate change | Why AI RMF 1.0 is being revised |
| SR 26-2 / OCC Bulletin 2026-13 | Fed, OCC, FDIC | Apr 17, 2026 | Does not cite NIST; keeps ML models in model-risk scope and leaves generative and agentic AI to broader risk programmes | The gap banks fill with an RMF-aligned programme |
| Critical-infrastructure profile concept note | NIST | Apr 7, 2026 | Concept for a sector profile covering critical infrastructure, including financial services | The next profile to track |
The pattern is worth stating plainly: references cluster in Treasury, the CFTC, the NCUA and state legislatures, while the prudential supervisors that examine banks — the Federal Reserve, the OCC and the FDIC — reference the RMF nowhere in their model-risk guidance. What those supervisors do instead is examine model risk management under SR 26-2 and leave everything outside its scope to the bank’s enterprise risk programme. That is the gap an RMF profile fills, and it is why bank 10-K AI risk factors now routinely describe an enterprise AI governance structure alongside model risk management. For the UK equivalent, the PRA’s SS1/23 covers AI inside its model risk principles without naming it; our SS1/23 guide explains how.
How does the RMF relate to SR 11-7 and SR 26-2 model risk management?
The two frameworks overlap heavily in substance and differ in unit of analysis. Model risk management is per model: a definition of ‘model’, an inventory, development standards, independent validation, ongoing monitoring and governance, applied with intensity proportional to the model’s risk tier. The RMF is per system and per programme: context, categorisation and impact assessment (Map), evaluation of seven characteristics (Measure) and treatment decisions (Manage), under an enterprise governance layer (Govern). A credit scoring model built on machine learning sits inside both; a customer assistant built on a vendor foundation model sits inside the RMF and, after April 2026, mostly outside formal model-risk scope.
The mapping banks actually use runs roughly as follows. Govern 1 and 2 correspond to the MRM policy, risk appetite and the board and committee structure already required by SR 26-2; most banks extend the same committee rather than build a second one. Map 1 to 3 correspond to the model purpose and design documentation of the development standard; Map 4 and 5 add the component and impact assessments that model documentation usually lacks. Measure 2 is independent validation plus fairness, security and privacy testing that validation typically does not cover. Measure 3 and Manage 4 are ongoing monitoring. Manage 3 and Govern 6 are the third-party model expectations. The surplus the RMF adds over MRM is therefore concentrated in four places: impact assessment, security and privacy testing, human-oversight design, and vendor foundation-model governance. Those are also the four places where the GenAI profile’s actions concentrate. For the comparison with ISO/IEC 42001, the certifiable management-system standard that Colorado accepts alongside the RMF, see NIST AI RMF vs ISO/IEC 42001.
What should a bank's RMF evidence pack contain?
A written profile, first: the selected Core subcategories, the tailoring decisions, and a mapping from each outcome to the bank’s existing control, policy or procedure. NIST calls this the organisational profile and it is the document an examiner or auditor reads. Second, the governance artefacts behind Govern: the AI policy and standard, the risk appetite statement with AI risk indicators, the charter and minutes of the AI governance body, the board committee that receives AI reporting, and the AI inventory with a named owner per system. Third, a per-system record for Map: intake form, purpose, users, components, third-party dependencies, impact assessment and the decision to proceed. Fourth, the Measure evidence at a depth set by tier: validation report, fairness and explainability tests, security testing against the AI 100-2 attack classes, privacy review, and red-team results for generative systems. Fifth, the Manage evidence: monitoring plan with thresholds, incident and override procedures, vendor monitoring, decommissioning criteria and the record of risk-acceptance decisions.
Three practical rules from the profiles on this site. Cite the documents by number, not by summary: AI 100-1 for the framework, AI 600-1 for generative systems, AI 100-2e2025 for the threat vocabulary, and the FS AI RMF for the sector tailoring. Use the Playbook’s suggested actions as the checklist for each subcategory, because it is the closest thing to an implementation guide NIST provides. And track the revision: when the revised framework is published, re-map the profile before the next examination cycle. The AI governance in banking hub shows which banks have published which of these pieces; the model risk management hub covers the per-model half.
Is the NIST AI RMF mandatory for banks?
No. It is a voluntary framework and no federal banking regulator has incorporated it into guidance. Colorado SB 24-205 and Texas TRAIGA name it, or its Generative AI Profile, as acceptable frameworks or as the basis of an affirmative defence, and Treasury has published a financial-services adaptation. Banks use it because SR 26-2 leaves generative and agentic AI outside model-risk scope and examiners expect to see something equivalent.
How many categories and subcategories does the AI RMF have?
Nineteen categories and 72 subcategories across four functions: Govern has six categories and 19 subcategories, Map five and 18, Measure four and 22, Manage four and 13. The counts come from the Core tables in NIST AI 100-1.
What are the seven characteristics of trustworthy AI?
Valid and reliable; safe; secure and resilient; accountable and transparent; explainable and interpretable; privacy-enhanced; and fair with harmful bias managed. NIST treats valid and reliable as the baseline and accountable and transparent as cross-cutting.
What is the difference between NIST AI 100-1 and AI 600-1?
AI 100-1 is the AI RMF 1.0 itself, published January 26, 2023. AI 600-1 is the Generative AI Profile, published July 26, 2024: a tailoring of the Core that names twelve generative-AI risks and lists 211 suggested actions mapped to RMF subcategories. A bank running LLM assistants uses both.
What is NIST AI 100-2 used for in banking?
NIST AI 100-2e2025 (March 24, 2025) is the adversarial machine learning taxonomy: a vocabulary of attacks on predictive and generative AI, from evasion and poisoning to prompt injection and model extraction, with mitigations. Bank security and model-validation teams cite it in threat models for fraud models, credit models and LLM applications; it is the reference behind the RMF's secure-and-resilient characteristic.
Is NIST IR 8596 part of the AI RMF?
No. IR 8596, the Cyber AI Profile, is a profile of the Cybersecurity Framework 2.0, not of the AI RMF. Its preliminary draft of December 16, 2025 covers securing AI components, using AI for cyber defence and thwarting AI-enabled attacks, and is meant to be used alongside the AI RMF and AI 100-2. Comments closed January 30, 2026; an initial public draft is expected.
Which banks say they use the NIST AI RMF?
Among the profiles tracked here: Truist (AI programme 'foundationally based' on the RMF, 2025 10-K), KeyBank (AI risk framework follows the four functions), Capital One (in-house model development mapped to the RMF and its GenAI profile), Columbia Banking (ServiceNow AI Control Tower aligned to the RMF), Ally (the RMF as reference frame for four-layer governance) and Arvest (security maturity model assessed against the RMF and CSF 2.0).
Is the AI RMF being updated?
Yes. NIST states that AI RMF 1.0 is being revised as part of the July 2025 America's AI Action Plan, which directs it to remove references to misinformation, diversity, equity and inclusion, and climate change. No revised draft had been published as of October 2026; the Playbook will be updated after the revision.
- NIST AI 100-1 — Artificial Intelligence Risk Management Framework (AI RMF 1.0), official PDF — NIST, Jan 26, 2023 (nvlpubs.nist.gov)
- NIST AI RMF landing page and revision notice — NIST, Oct 15, 2026 (nist.gov)
- NIST AI RMF Playbook (NIST AI Resource Center) — NIST, Jan 26, 2023 (airc.nist.gov)
- NIST AI 600-1 — AI RMF: Generative Artificial Intelligence Profile, official PDF — NIST, Jul 26, 2024 (nvlpubs.nist.gov)
- NIST AI 100-2e2025 — Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations — NIST, Mar 24, 2025 (csrc.nist.gov)
- NIST IR 8596 (preliminary draft) — Cybersecurity Framework Profile for Artificial Intelligence — NIST, Dec 16, 2025 (csrc.nist.gov)
- US Treasury — Financial Services AI Risk Management Framework and AI Lexicon (AIEOG) — US Treasury, Feb 19, 2026 (home.treasury.gov)
- Federal Reserve SR 26-2 — Revised Guidance on Model Risk Management — Federal Reserve, Apr 17, 2026 (federalreserve.gov)
- White House — America's AI Action Plan — The White House, Jul 23, 2025 (whitehouse.gov)
When this rule moves, the next morning's brief says so
when one of these regulators moves, the next morning's brief says so · six sourced stories · 7 am ET · free
plus every tracker, bank and agent page update, the morning after · leave any morning