NIST AI RMF
The US risk-management framework for AI. Voluntary guidance, organised around four functions — Govern, Map, Measure, Manage — and the de facto baseline US enterprises and regulators expect.
A framework, not a law — but the baseline buyers and regulators expect.
NIST AI RMF is voluntary and carries no certification path, yet it has become the common language for AI risk in the US. It is organised around four functions — Govern, Map, Measure, Manage — each broken into categories and subcategories.
Enterprise procurement and US regulators increasingly treat a credible RMF profile as table stakes. The work is not a certificate; it is demonstrable practice across the four functions, evidenced.
The files this framework actually requires.
NIST names practices, not paperwork. Hael turns each function into evidenced, versioned records.
GRC tools tell you these are missing. Hael generates them — from each system's real configuration.
A checklist tells you what's missing. Hael puts it on record.
NIST tells you what good practice looks like. Hael produces the evidence that you do it.
Discover, classify, produce — for NIST AI RMF.
Find the systems in NIST AI RMF scope, including embedded third-party AI.
Assess each against NIST AI RMF's risk tiers and obligations.
Generate the NIST AI RMF records, versioned and current.
Every obligation, mapped to the control that satisfies it.
Rows are the framework's clauses.
Columns are the controls and files that satisfy them.
Cells update as the underlying configuration changes.
Clause by clause.
Author once. Satisfy many.
An RMF profile shares most of its substance with ISO/IEC 42001's management system and the EU AI Act's risk-management process. Author the practice once; evidence it against all three.
On record before the buyer asks, not after the deal stalls.
Hael turns the four NIST functions into evidenced, versioned records — ready for enterprise procurement and as a defensible baseline under emerging state laws.