AI Risk Management Framework

Strategic Center Evaluation

Adjacent Publisher Context

The following materials are published by NIST and address topics relevant to the Five Forces, but are not explicitly positioned as components of the AI Risk Management Framework. They are not included in the /25 coverage score above.

Narrative Strengths & Gaps

Internal Pressures & Capabilities. This is a central pillar. The GOVERN function sets out accountability structures, roles and responsibilities, risk-management training for “personnel and partners” (GOVERN 2.2), decision-making “informed by a diverse team” (GOVERN 3.1), and a “critical thinking and safety-first mindset” (GOVERN 4.1). MAP, MEASURE and MANAGE then supply operational disciplines across the lifecycle. The Playbook, updated in June 2026, provides suggested actions for each subcategory, which makes the treatment implementable. AI RMF Profiles give the framework its own map and route within risk management: a Current Profile “indicates how AI is currently being managed and the related risks”, a Target Profile “indicates the outcomes needed to achieve the desired or target AI risk management goals”, and comparing them “likely reveals gaps to be addressed”, with action plans to close those gaps. Both stay inside the risk discipline rather than covering the enterprise’s AI strategy as a whole (Map: Partly met; Course: Partly met). The framework’s lens is risk management, so capability-building for value creation (operating-model redesign for AI-driven growth, use-case portfolios) lies outside its scope.

Global & Geopolitical Dynamics. The framework acknowledges this force through its commitment to align “with applicable international standards, guidelines, and practices” and its stated aim of supporting organisations operating “under applicable domestic and international legal or regulatory regimes”. Translations (Arabic and Japanese) and the Crosswalks extend its international reach. Sovereignty, export controls, cross-border data and geopolitical competition fall outside its scope. NIST’s announced revision under the White House AI Action Plan may change this treatment.

Societal & Regulatory Pressures. This is the framework’s second central pillar. GOVERN 1.1 requires that “legal and regulatory requirements involving AI are understood, managed, and documented”. The trustworthy-AI characteristics anchor ethics expectations, and MAP 5 characterises impacts on “individuals, groups, communities, organizations, and society”. The Crosswalks, updated December 2024, map the framework to other standards and regulatory regimes. The Generative AI Profile, released 26 July 2024, “can help organizations identify unique risks posed by generative AI” (accepted under the recency gate because the anchor page actively promotes it). Regulation, ethics and accountability are built into governance from the first GOVERN category onward.

Industry & Competitive Pressures. The framework addresses the ecosystem dimension directly. GOVERN 6 covers “third-party software and data and other supply chain issues”, including intellectual-property risk and contingency processes for failures in high-risk third-party systems. MANAGE 3 requires that third-party resources and pre-trained models are monitored and controlled. Competitive positioning, market dynamics and industry adoption patterns fall outside its scope, consistent with its sector-agnostic, risk-focused design.

Human Needs & Aspirations. The framework gives this external force meaningful treatment through its mechanisms for listening to people outside the organisation. GOVERN 5.1 requires collecting and integrating “feedback from those external to the team” on individual and societal impacts. MAP 5.1 weighs the likelihood and magnitude of beneficial and harmful impacts, and MEASURE 3.3 establishes “feedback processes for end users and impacted communities to report problems and appeal system outcomes”. The treatment centres on preventing harm and enabling recourse. Positive aspirations such as customer expectations for human-centred AI experiences or talent-market expectations sit outside its scope.

What this framework does not give you. A map of where the organisation stands across its AI strategy as a whole; Current Profiles cover AI risk management. Without a clear picture of where it stands, an enterprise cannot tell which moves matter most. A route for the whole strategy; comparing profiles guides risk-management gaps. Without a route, even a well-chosen destination stays an aspiration. A way to choose your own strategic destination; Target Profiles let the organisation set its risk-management goals within the aim of trustworthy and responsible AI. An enterprise that has not stated its own ambition cannot check whether this destination is the right one for it.

Synthesis. The AI RMF suits chief risk officers, AI governance leads, compliance teams and technology leaders in organisations of any size or sector that need a structured, widely recognised way to govern AI risk, particularly those deploying AI in regulated or high-impact settings. Its destination fits organisations whose ambition includes demonstrably trustworthy and responsible AI. Its depth on internal governance and regulatory accountability makes it a strong companion to a strategy framework. The Five Forces lens adds what a risk framework deliberately leaves to others: a strategy-wide map and route, a way to set the strategic destination, geopolitical exposure, competitive positioning, a declared time horizon, and the strategic choice between automation and augmentation. Readers should watch for the revised version NIST has announced.

Sources

Tier 1 (scored), recency-gate pass unless noted:

1. NIST AI Risk Management Framework (canonical anchor page) – current; states the AI RMF 1.0 is being revised under the White House AI Action Plan
2. Artificial Intelligence Risk Management Framework (AI RMF 1.0), NIST AI 100-1 – January 2023; outside the 24-month window, accepted under exception (a): the canonical page actively links to and promotes it as the current version
3. NIST AI RMF Playbook – updated 10 June 2026
4. Crosswalks to the NIST AI RMF (AI RMF 1.0) – updated 17 December 2024
5. Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile, NIST AI 600-1 – 26 July 2024; outside the 24-month window, accepted under exception (a): actively promoted on the canonical page
6. Concept Note: AI RMF Profile on Trustworthy AI in Critical Infrastructure – released 7 April 2026, updated 17 July 2026; concept note for a forthcoming profile; not used to move any score

Tier 2 (reported in Section 2.75, not scored):

1. AI 100-2 E2025, Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations – March 2025
2. CAISI Issues Request for Information About Securing AI Agent Systems – 12 January 2026

Tier 3 (third-party corroboration, not scored):

1. No Tier 3 sources are cited in this assessment.

Excluded on recency or quality (not scored):

1. A Plan for Global Engagement on AI Standards (NIST AI 100-5) – 26 July 2024; outside 24-month window and not a component of the AI RMF