The NIST AI RMF for AI agents: a practical guide for US enterprises
There is no single US AI law. Regulators, auditors and enterprise buyers increasingly use the NIST AI Risk Management Framework as the common reference, while states and sector regulators add their own rules. This guide shows how to apply the framework to AI agents and what else to check.
Is the NIST AI RMF mandatory?
No. The NIST AI RMF is voluntary, but it is widely used as the reference for AI risk programmes, and its Generative AI Profile (NIST AI 600-1) adds guidance specific to generative AI. State laws and sector rules apply alongside it.
Updated October 2026
- Framework
- NIST AI Risk Management Framework 1.0 (January 2023) and the Generative AI Profile, NIST AI 600-1 (July 2024)
- Core functions
- Govern, Map, Measure and Manage
- Status
- Voluntary; widely used by regulators, auditors and enterprise buyers
- State laws to check
- Texas Responsible AI Governance Act; Colorado AI Act; California's rules on automated decisionmaking technology; NYC Local Law 144
- Sector rules to check
- NYDFS Part 500; Federal Reserve SR 11-7 model risk guidance; GLBA; HIPAA
What the rules mean for AI agents
| Requirement | What it means for your AI agents |
|---|---|
| Govern | Name an accountable owner for each agent, keep an inventory of agents and copilots, and set policy for what agents may and may not do. |
| Map | Record each agent's purpose, users, data, tools and the decisions it can affect, and rate its risk. |
| Measure | Evaluate accuracy and failure modes, red team against prompt injection and excessive agency, and track the results over time. |
| Manage | Apply guardrails, least-privilege access and human approval for material actions, monitor agents in production and have an incident plan. |
Nine things to have in place
- Inventory every agent, copilot and AI feature in use.
- Name an accountable owner for each one.
- Rate each agent's risk by the decisions and data it touches.
- Test against the OWASP Top 10 for LLM applications.
- Require human approval for payments, customer changes and other material actions.
- Log every agent action and tool call.
- Check which state AI and privacy laws apply to your use cases.
- Bring decision-making agents into model risk management.
- Review agents after every material change.
From rules to agents in production
Governed agents
A four- to eight-week pilot with the controls in this guide built in.
Agentic AI development →Security and red teaming
Agent inventory, guardrails, prompt-injection testing and runtime protection.
AI security →Evidence and governance
Policies, logs and reports that answer regulators, auditors and boards.
AI governance →Frequently asked questions
Does the NIST AI RMF cover AI agents?
Yes. It applies to any AI system. Agents take actions as well as answering questions, so the Manage function, with its guardrails, approvals and monitoring, matters most.
Which US state AI laws should we watch?
Texas's Responsible AI Governance Act took effect on 1 January 2026, Colorado has its own AI Act, California regulates automated decisionmaking technology under the CCPA, and New York City regulates automated hiring tools. Check where your users and decisions are.
How does the RMF relate to ISO/IEC 42001?
They fit together. ISO/IEC 42001 is a certifiable management system standard; the NIST AI RMF is a risk framework. Many organisations use the RMF to shape controls and 42001 to run and certify the programme.
Where should we start?
With an inventory. Most organisations find more agents and copilots in use than they expected, and you cannot govern what you cannot see.
Sources
- NIST AI Risk Management Framework
- NIST AI 600-1: Generative AI Profile
- Moore & Van Allen: Texas enacts the Responsible Artificial Intelligence Governance Act
- California Privacy Protection Agency: regulations
- NYC: Automated employment decision tools
- Federal Reserve SR 11-7: Guidance on model risk management
- OWASP Top 10 for LLM Applications (OWASP GenAI Security Project)
This guide is general information, not legal advice. Check the official texts and take legal advice for your situation.
Talk to us about The NIST AI RMF for AI agents
Get a free consultation from our AI, data and security specialists. Honest advice, clear options and a reply within 6 hours.
Request a callback
Free consultation. Our team replies within 6 hours.