The NIST AI Risk Management Framework in Plain English

In January 2023, the National Institute of Standards and Technology published something unusual: a risk management framework for AI that reads like it was written for normal people. It's voluntary. Nobody will fine you for ignoring it. But it has quietly become the shared language for talking about AI risk in the United States.

The whole thing rests on four functions. Govern means setting up who decides what: roles, policies, and a culture where somebody is accountable. Map means understanding the AI you're using — what it's for, who it affects, and what could go wrong. Measure means testing and watching it, the way you'd test anything that touches real people. Manage means having a plan for when things go sideways, including pulling the plug.

That's it. Four verbs. If your organization can honestly say it governs, maps, measures, and manages its AI, you're ahead of most.

I explain frameworks; I don't give legal counsel.