NIST AI Risk Management Framework

What it helps you do

Place AI system risk work into four functions. Oversight and roles sit under Govern. Hazard framing sits under Map. Evaluations sit under Measure. Response and controls sit under Manage. Chronos-Copilot can use that placement for a high-impact tool action. G3’s closing section, Map it, sorts one control onto those functions. This card does not rewrite G1 through G3, and it does not certify an agent. The labeled explainer at /learn/explainers/nist-ai-rmf/ is the learner literacy home. This card remains the field guide.

A useful way to begin

1. Pin NIST AI 100-1, AI RMF 1.0, published 26 January 2023, DOI 10.6028/NIST.AI.100-1.
2. Read the Core as four jobs: Govern (who is accountable), Map (what the system is and where harm could land), Measure (how you test), Manage (what you do with the result).
3. Point Atlas lessons at a function. Oversight lives in Govern. Hazard framing lives in Map. Evaluations live in Measure. Response and controls live in Manage. The path is G1, then G2, then G3. The sort sits at the end of G3.
4. When a conversation cites the OWASP LLM Top 10, keep it as a separate 2026 awareness list. Prompt injection is LLM01:2026. Excessive agency is LLM03:2026. Neither list replaces AI RMF 1.0.

Other records you might already have

• A Chronos-Copilot record that names the human who must approve a high-impact refund or thruster tool action before it runs.
• A one-row map that places that gate under Govern and the check of the gate under Measure.

Common misconceptions

This is an original educational guide. Use the publisher’s official materials for the authoritative requirements and licensing terms. A relationship between maps is not one-to-one control equivalence. This card complements the six live maps. It is not a row in that comparison.