The NIST AI Risk Management Framework (AI RMF) is a governance framework, not a technical control. It defines what outcomes to achieve, govern, map, measure, and manage AI risk, but it does not enforce any of them on live AI traffic. Mapping NIST AI RMF controls to real-time enforcement is what turns the framework from a written program into an operating one. The framework names the risk; runtime controls act on it.

Regulated enterprises are standardizing on the AI RMF as their AI governance backbone, and NIST keeps extending it with the Generative AI Profile and the new Cyber AI Profile draft. But adoption mostly produces policies, committees, and risk registers, while the actual AI usage and agent actions go ungoverned where it counts: in the interaction. This guide maps each function, and the framework’s generative-AI risks, to concrete controls that act in real time.

Last updated: June 2026.

What the NIST AI RMF is, and what it is not

NIST released the AI RMF as NIST AI 100-1 in January 2023. It is voluntary, and it is organized around four functions: GOVERN, MAP, MEASURE, and MANAGE. GOVERN sets the policies, roles, and accountability for how an organization uses AI. MAP establishes the context and identifies the AI systems in use and their risks. MEASURE assesses and tracks those risks over time. MANAGE treats, responds to, and documents them (NIST, 2023).

In July 2024, NIST added the Generative AI Profile (NIST AI 600-1), a cross-sectoral companion that lays out 12 generative-AI risk categories with suggested actions mapped back to the AI RMF Core. The categories include information security and value chain and component integration, both of which matter for agents and the tools they call (NIST, 2024).

The key point: the AI RMF is a framework of outcomes and recommended actions, not a product and not an enforcement engine. It tells you what good governance looks like. It does not inspect a prompt, stop a risky response, or block an agent’s tool call.

Why a framework is not enforcement

GOVERN and MAP can be satisfied in documents and inventories. MEASURE and MANAGE cannot. Measuring the risk in an AI interaction means reading the actual prompt and response. Managing it means responding in the moment, before sensitive data leaves or a tool call executes. A policy, a governance committee, or an annual audit cannot read a model’s response or stop an agent mid-action. That work happens at runtime or it does not happen at all.

This is where most programs stall. They implement the framework on paper while the interaction stays ungoverned. In a 2025 study, 63 percent of organizations had no AI governance policy, and among those that did, only 34 percent ran regular audits for unsanctioned AI (IBM, 2025). For agents the gap is wider: only one in five organizations has a mature governance model for autonomous AI agents (Deloitte, 2026). The framework’s intent rarely reaches the point where risk actually occurs.

Map the four functions to real-time enforcement

Each function has a runtime counterpart. The table pairs what the function requires with the enforcement that delivers it on the live interaction (Aurascape, 2026).

NIST AI RMF function	What the function requires	Real-time enforcement that delivers it
GOVERN	Policies, roles, and accountability for how AI is used.	Author and enforce AI-use policy centrally, with role-based access control (RBAC) over AI activity and a way for business functions to help set policy while security keeps global control.
MAP	An inventory of AI systems, their context, and their risks.	Continuous discovery of the AI and agents in the environment, known and long-tail, with risk attribution, so the inventory reflects reality rather than a list of approved tools.
MEASURE	Ongoing assessment and tracking of AI risk.	Interaction-level visibility with full-conversation context, plus pre-deployment testing of the AI you build, so risk is measured against real usage instead of a questionnaire.
MANAGE	Treating, responding to, and documenting AI risk.	Inline policy actions that allow, coach, warn, block, or redact, governance of agent tool calls so a risky action cannot execute, and audit-ready interaction records governed by RBAC.

The mapping changes what each function means in practice. GOVERN becomes a policy that fires on the next interaction, not a document. MAP becomes a live inventory. MEASURE becomes visibility into what people and agents are really doing. MANAGE becomes an action taken before harm, with a record to prove it.

Map the Generative AI Profile’s risks to controls

The Generative AI Profile’s risks are where the framework gets specific, and where runtime enforcement matters most. Section 2.9 on Information Security names prompt injection and data poisoning directly, and Section 2.12 covers value chain and component integration, the supply-chain risk that now includes the tools and servers agents call (NIST, 2024). The table pairs each with a control that acts in the interaction (Aurascape, 2026).

Generative AI Profile risk	Real-time control
Information security (prompt injection, data poisoning)	Inspect the prompt and the response, not just the destination. Govern agent tool calls so an injected instruction cannot trigger an action, and stop sensitive data from leaving in a response.
Data privacy and sensitive-data exposure	Classify sensitive data inline across text and other modalities with near-zero false positives, then redact or block it before it reaches an unapproved model.
Value chain and component integration	Discover and govern the agent tool supply chain, including Model Context Protocol (MCP) servers and tools, so an agent cannot reach an unapproved or risky component.
Human-AI configuration	Coach the user in the moment and route usage to an approved enterprise tenant instead of a personal account, so sanctioned tools are used the sanctioned way.

The framework family is moving toward enforcement

NIST is extending the AI RMF toward operational, control-level guidance. The Cyber AI Profile (NIST IR 8596), released as a preliminary draft in December 2025, applies the NIST Cybersecurity Framework (CSF) 2.0 to AI and is designed to be used together with the AI RMF. NIST also released a discussion draft of control overlays for securing AI systems. The direction is clear: from principles toward enforceable controls (NIST, 2025).

The AI RMF also pairs with a certifiable standard. ISO/IEC 42001:2023 is the first AI management system standard, and it complements the framework cleanly: the AI RMF is the risk operating model, and 42001 is the management-system standard that auditors and customers recognize (ISO/IEC, 2023). Regulation raises the stakes further. The EU AI Act’s obligations for general-purpose AI models have applied since August 2025, with full applicability in August 2026, which means organizations increasingly have to prove governance, not just describe it (European Commission, 2025).

How Aurascape turns the NIST AI RMF into runtime enforcement

Aurascape gives each function an enforcement point on the live interaction. Discovery satisfies MAP by finding the AI and agents in the environment and scoring their risk. Interaction-level visibility and pre-deployment testing satisfy MEASURE by assessing real usage. Inline actions that allow, coach, warn, block, or redact, together with governance of agent tool calls, satisfy MANAGE. Policy authoring and records governed by role-based access control satisfy GOVERN and produce the audit trail. The Zero-Bypass MCP Gateway governs the tool-execution channel so an unapproved tool call cannot reach the tool or the model, with the Model Context Protocol as one mechanism it secures. All of this is additive to the security stack you already run (Aurascape, 2026).

The result shows up in regulated deployments. In one Aurascape deployment at a credit union, the platform’s controls mapped to the NIST AI Risk Management Framework alongside GLBA, FFIEC, and NCUA expectations, delivering a projected 83 percent reduction in AI-related risk and a projected 27 percent productivity gain (Aurascape, 2026). For the wider standards landscape, see our guide to AI compliance frameworks and governance.

---

Aurascape turns the NIST AI Risk Management Framework from a written program into enforced, runtime controls: discovery for MAP, interaction visibility and testing for MEASURE, inline action and agent tool-call governance for MANAGE, and policy with role-based records for GOVERN. A short demo shows how the framework maps to real-time enforcement on your own AI traffic.

See how Aurascape turns AI governance frameworks into runtime enforcement →

Frequently asked questions

Is the NIST AI RMF mandatory?

The NIST AI Risk Management Framework is voluntary. It is widely adopted as the reference for AI governance in US federal agencies and regulated industries, and it underpins newer NIST guidance such as the Cyber AI Profile, so in practice it functions as a baseline that regulators, customers, and auditors increasingly expect organizations to meet.

What are the four functions of the NIST AI RMF?

GOVERN, MAP, MEASURE, and MANAGE. GOVERN sets policies, roles, and accountability for AI. MAP identifies the AI systems in use and their risks. MEASURE assesses and tracks those risks. MANAGE treats, responds to, and documents them. The first two can live in documents; the second two require acting on live AI activity.

How do you enforce the NIST AI RMF in real time?

Map each function to a runtime control. Discover the AI and agents in your environment to satisfy MAP. Inspect interactions with full-conversation context to satisfy MEASURE. Apply inline actions and govern agent tool calls to satisfy MANAGE. Author policy and keep interaction records governed by role-based access control (RBAC) to satisfy GOVERN and provide audit evidence.

Does the NIST AI RMF cover AI agents and the Model Context Protocol?

The Generative AI Profile addresses information security and value chain risks that apply to agents and the tools they call, and NIST’s newer drafts extend toward operational controls. Enforcing those risks at runtime means governing agent tool calls and the tool supply chain, including Model Context Protocol (MCP) servers and tools, not only writing policy.