theLLMs

Last checked: 2026-05-25

Scope: Global. Sources checked as of 2026-05-24.

AI draft model: llm-author

AI review model: llm-editor (deepseek-v4-pro)

Key terms:

>_ function calling / tool use >_ VRAM (Video RAM) >_ EU AI Act >_ AI RMF (AI Risk Management Framework)

NIST AI RMF and GenAI guidance: practical use for small teams

Short answer: NIST’s AI Risk Management Framework (AI RMF) and its Generative AI profile are the most practical ready-made risk frameworks for small teams deploying LLMs. They are not compliance mandates — they are structured questions that help you identify blind spots before they become incidents. The four core functions (Govern, Map, Measure, Manage) translate directly into a product launch checklist.

What it means

The AI RMF is a voluntary framework published by the US National Institute of Standards and Technology. It is not regulation — it is guidance designed to help any organisation that develops or deploys AI systems understand and manage risk. The GenAI profile, published in 2024, adapts the framework specifically for generative AI’s unique risk characteristics: hallucinations, jailbreaks, data leakage, copyright ambiguity, and output unpredictability.

The framework structure is simple:

  1. Govern — establish risk management processes, assign roles, set policies
  2. Map — understand your AI system’s context, intended uses, and potential harms
  3. Measure — test and evaluate the system against identified risks
  4. Manage — act on findings, monitor continuously, respond to incidents

For a small team, this is not a 200-page compliance document. It is a set of questions to answer before you ship.

Where teams misuse it

“NIST RMF is for big enterprises with compliance teams.” The framework is designed to be scaled. A one-person startup can complete a valid AI RMF assessment in a few hours by answering the mapping and measurement questions for each feature.

“We are not in the US, so NIST does not apply.” The AI RMF is not US-specific. It was developed through an international consensus process and is referenced by regulators worldwide, including the EU AI Act’s harmonised standards. It applies wherever you need a structured risk approach.

“GenAI is too fast-moving for a risk framework.” The GenAI profile was specifically designed for this objection. It acknowledges that the technology changes quickly and recommends iterative risk assessment — reassess when the model changes, when the use case changes, or when new risks are identified.

“We already do testing — that counts as measurement.” Testing for functionality is not the same as measuring for risk. The Measure function in the RMF asks you to test specifically for the identified risks from the Map phase, not just whether the feature works.

Practical decision check

Use the GenAI profile’s core actions as a lightweight pre-launch checklist:

Govern checks:

  • Is there a named person responsible for AI risk decisions? (Even if it’s the solo founder.)
  • Is there a documented policy for when to escalate an AI incident?
  • Are third-party model providers assessed for data handling and security?

Map checks:

  • Can you describe in one paragraph what the AI system does, who uses it, and what could go wrong?
  • Have you identified the types of harm relevant to your use case (accuracy, safety, privacy, fairness, transparency, accountability)?
  • Have you documented what data flows through the system and where it is stored?

Measure checks:

  • Do you have quantitative tests for each identified risk? (E.g., hallucination rate, refusal rate, PII exposure rate.)
  • Have you tested with adversarial or edge-case inputs?
  • Are your test results documented with enough detail to compare against a future model version?

Manage checks:

  • Do you have a process to update the risk assessment when the model or use case changes?
  • Is there a documented incident response plan for AI-specific failures?
  • Are users or stakeholders informed about the AI system’s limitations?

Lightweight implementation plan

  1. Start with Map — create a one-page document for each LLM feature describing its purpose, user, data flows, and three things that could go wrong (e.g., hallucination, data leakage, incorrect classification).
  2. Add Measure — for each identified risk, define one quantitative test and run it. Document the test setup, the model version, the date, and the results. This can be a single table.
  3. Establish Govern basics — name a person (even if yourself), set a policy for when to stop the feature if a test fails, and keep a simple incident log.
  4. Iterate Manage — review the risk assessment when you change models, add new features, or when a new risk category becomes relevant (e.g., copyright claims in your domain).

Evidence and caveats

  • Sources:
  • Date checked: 2026-05-25. NIST may publish additional profiles for specific sectors (healthcare, finance). The GenAI profile is current as of this date.
  • Caveats: The AI RMF is voluntary. It does not replace legal advice or sector-specific compliance requirements (e.g., GDPR, HIPAA, EU AI Act). A completed RMF assessment does not guarantee regulatory compliance. It reduces risk — it does not eliminate it.
  • What would update this: A new NIST AI RMF version, publication of additional sector profiles, or regulatory decisions that adopt the RMF as a compliance safe harbour.

Change log

  • 2026-05-25 — Initial audit revision. Added direct source URLs to evidence section; changed source listing from named-only references to linked citations. No material changes to claims or guidance.