NIST AI RMF for Small Business: A Practical Guide

By Zachariah Crabill, JD · FAIIR, LLC · Updated September 28, 2026

The short answer

The NIST AI Risk Management Framework (AI RMF 1.0, released January 26, 2023) is a voluntary U.S. framework built on four functions: Govern, Map, Measure, and Manage. A small business can apply it without a compliance team by turning each function into a few written artifacts, such as a named AI owner, a use-case register, spot-check monitoring, and an incident playbook, which the FAIIR standard's controls spell out.

Key takeaways

The NIST AI RMF 1.0 was released January 26, 2023, is voluntary, and is organized into four functions: Govern, Map, Measure, and Manage.
NIST's Generative AI Profile (NIST AI 600-1), released July 26, 2024, is a companion resource that names 12 risks unique to or made worse by generative AI.
The framework describes outcomes, not a checklist, so small businesses usually need to translate each function into specific documents and routines.
Colorado's SB 26-189 does not mention NIST or require a risk-management program, but the NIST AI RMF remains the best-recognized U.S. reference for AI risk management.
FAIIR is benchmarked to the NIST AI RMF, and its controls give each NIST function a concrete, checkable deliverable.

What is the NIST AI Risk Management Framework?

The NIST AI Risk Management Framework (AI RMF 1.0, published as NIST AI 100-1) is a voluntary framework from the National Institute of Standards and Technology for managing the risks of designing, developing, deploying, and using AI systems. NIST released it on January 26, 2023, after an open, consensus-driven drafting process.

NIST describes the framework as voluntary, rights-preserving, non-sector-specific, and use-case agnostic, and says it is meant to give flexibility to organizations of all sizes and in all sectors. It is not a regulation. NIST notes that the framework's actions "do not constitute a checklist," and its companion Playbook invites organizations to borrow as many or as few suggestions as fit their use case.

The framework also defines what trustworthy AI looks like. NIST lists seven characteristics: valid and reliable; safe; secure and resilient; accountable and transparent; explainable and interpretable; privacy-enhanced; and fair, with harmful bias managed.

What are the four functions of the NIST AI RMF?

The NIST AI RMF organizes AI risk management into four functions: Govern, Map, Measure, and Manage. Each function is broken into categories and subcategories that describe outcomes an organization should reach.

Govern builds a culture of AI risk management: policies, roles, accountability, and oversight. NIST calls Govern a cross-cutting function that runs through the other three. It has 6 categories.
Map establishes context: what each AI system is for, who it affects, and what could go wrong. It has 5 categories.
Measure uses quantitative, qualitative, or mixed methods to analyze, assess, benchmark, and monitor AI risks and impacts. It has 4 categories.
Manage puts resources against the risks you mapped and measured, including plans to respond to, recover from, and communicate about incidents. It has 4 categories.

NIST says the functions can be applied in whatever order fits, and that the process should be iterative. In practice, most organizations set up basic governance first, then map their AI use, then measure and manage.

What is the NIST Generative AI Profile (NIST AI 600-1)?

NIST AI 600-1, the Generative AI Profile, is a companion to the AI RMF that applies its four functions to generative AI tools like chatbots and text or image generators. NIST released it on July 26, 2024.

The profile identifies 12 risks that are unique to or made worse by generative AI. Examples NIST highlights include confabulation (the model "hallucinating" confident but false output), a lowered barrier to cybersecurity attacks, and the production of misinformation, hate speech, and other harmful content. It then lists just over 200 suggested actions, mapped back to the AI RMF.

For a small business whose AI use is mostly off-the-shelf generative tools, the profile is the more practical of the two documents, because it speaks directly to the tools you actually use.

Why is the NIST AI RMF hard for small businesses to use?

The NIST AI RMF is hard for small businesses to operationalize because it describes outcomes rather than tasks, and it assumes staff who can translate those outcomes into policies and routines. The framework is deliberately flexible, which is a strength for large organizations and a burden for a 10-person firm.

No finish line. The framework has no pass/fail test, so it is hard to know when you have done enough.
Written for builders and buyers alike. Many subcategories speak to teams that design and train models. A business that only uses vendor tools has to work out which parts apply.
Volume. Across the framework and the Generative AI Profile, there are 19 categories, their subcategories, and more than 200 suggested actions, with no built-in priority order for a small team.
No evidence format. NIST does not say what a document or record should look like, so it is hard to prove to a customer, insurer, or regulator that you followed it.

How can a small business apply each NIST function?

A small business can apply each NIST function by producing a handful of short written artifacts and running a few simple routines. The table below maps each function to concrete actions and to the FAIIR controls that define what "done" looks like.

NIST AI RMF functions mapped to small-business actions and FAIIR controls
NIST function	What it asks	Small-business actions	FAIIR controls (pillar)
Govern	Who owns AI risk, and what are the rules?	Name one person responsible for AI governance; publish an AI acceptable use policy and collect employee acknowledgments; have the owner sign an annual statement that the business follows its own rules.	A1 — AI Officer Designated (Accountability); U1 — AI Acceptable Use Policy (Informed Use); R8 — Annual Compliance Attestation (Risk Management)
Map	What AI do you use, for what, and on what data?	List every AI tool and the tasks it is approved for; write down what each tool must not be used for; classify your data as public, internal, confidential, or regulated.	F1 — Use-Case Register; F2 — Out-of-Scope Boundaries (Fitness for Purpose); I1 — Data Classification Map (Integrity of Data)
Measure	How do you know the AI is working and fair?	State the accuracy level required for any customer-facing or decision-affecting output; run and document a simple bias check; spot-check outputs on a schedule.	F3 — Accuracy Threshold Documented; F4 — Bias Check Performed (Fitness for Purpose); R4 — Monitoring in Place (Risk Management)
Manage	What do you do about the risks you found?	Keep a risk register reviewed quarterly; define what counts as an AI incident; write a 1–2 page incident playbook; plan for a vendor outage or model change; write down what staff do when the AI is down or wrong.	R1 — Risk Register; R2 — Incident Definition; R3 — Incident Response Playbook; R5 — Vendor Uptime & Failure Plan (Risk Management); F7 — Fallback Procedure (Fitness for Purpose)

A practical order of operations

Govern first (week 1). Name the AI owner (A1) and circulate a short acceptable use policy (U1). Without an owner, nothing else gets maintained.
Map next (weeks 1–2). Build the use-case register (F1) with out-of-scope rules (F2), and classify your data (I1). Most small businesses find tools they did not know staff were using.
Measure the tools that matter (weeks 2–4). Set accuracy expectations (F3), run a documented bias check (F4) where outputs affect people, and schedule spot checks (R4).
Manage what you found (week 4 onward). Record risks in a register (R1), define incidents (R2), write the playbook (R3), and plan fallbacks (R5, F7). Revisit quarterly.

None of these steps requires software. A shared spreadsheet and a folder of one- to two-page documents is enough for most firms, as long as each document has an owner and a review date.

Does Colorado law still require a NIST-based risk-management program?

No. Colorado's ADMT Act (SB 26-189), effective January 1, 2027, does not require a risk-management program and does not mention the NIST AI RMF. The 2024 law it replaces took a different approach.

SB 24-205 required deployers of high-risk AI systems to implement a risk-management policy and program, and said that program had to be reasonable considering the latest NIST AI RMF, ISO/IEC 42001, or another recognized framework. It also offered an affirmative defense tied to compliance with those frameworks. SB 26-189 repeals and reenacts C.R.S. §§ 6-1-1701 to -1709, and the risk-management-program mandate is gone, along with impact assessments and the duty of care regarding algorithmic discrimination.

What remains are five deployer duties: pre-use notice, adverse-outcome disclosure within 30 days, consumer data access and correction, meaningful human review "to the extent commercially reasonable," and records kept 3 years after each consequential decision (§ 6-1-1703). See our ADMT Act compliance checklist for detail.

Even without a statutory hook, the NIST AI RMF remains the best-recognized U.S. reference point for AI risk management. It gives a small business a common vocabulary with customers, insurers, and larger partners, and a documented risk process makes the five statutory duties easier to meet and to prove.

Where FAIIR fits

FAIIR is benchmarked to the NIST AI RMF and turns its four functions into 41 pass/fail controls a small business can document and an outside reviewer can check. FAIIR complements NIST rather than replacing it; see What is FAIIR certification? and how FAIIR compares to ISO/IEC 42001 and SOC 2.

Frequently asked questions

Is the NIST AI Risk Management Framework mandatory?

No. NIST describes the AI RMF as intended for voluntary use, and its companion Playbook says organizations may borrow as many or as few suggestions as apply. Customers, contracts, or other rules may still reference it, so check what your own agreements say and talk to counsel about your situation.

When was the NIST AI RMF released?

NIST released AI RMF 1.0 (NIST AI 100-1) on January 26, 2023. NIST released the companion Generative AI Profile, NIST AI 600-1, on July 26, 2024.

Is there a NIST AI RMF certification for small businesses?

The AI RMF does not set out a certification process of its own; it is a voluntary framework whose actions NIST says are not a checklist. A business can document how it follows the framework, and some private standards, including FAIIR, are benchmarked to it. FAIIR certifies an organization's AI practices against FAIIR's own controls, not NIST conformance.

Which NIST function should a small business start with?

Start with Govern: name one person responsible for AI and publish an acceptable use policy. NIST lets organizations apply the functions in any order, but without a named owner, the Map, Measure, and Manage work tends not to be maintained.

Does Colorado's ADMT Act require the NIST AI RMF?

No. SB 26-189, effective January 1, 2027, does not mention the NIST AI RMF and does not require a risk-management program. The 2024 law, SB 24-205, did reference NIST and ISO/IEC 42001, but SB 26-189 repeals and replaces it.

Do I need the Generative AI Profile if I only use ChatGPT-style tools?

The Generative AI Profile, NIST AI 600-1, is often the more useful document for businesses that mainly use off-the-shelf generative tools. It names 12 generative-AI risks, such as confabulation, and suggests actions for each, mapped to the four AI RMF functions.

Sources

This article is general information from FAIIR, LLC, which is not a law firm, and is not legal advice. Colorado law does not require or recognize any third-party AI certification, and FAIIR certification is not a government approval or a guarantee of compliance. For advice about your situation, consult a licensed attorney.