This article is part of our AI Agents for Business hub. Want help applying it? Talk to eSEOspace.
Yes, a small business can use the NIST AI Risk Management Framework without a compliance team. It is voluntary, and NIST says users may choose how much of it to apply.
The framework says it gives flexibility to "organizations of all sizes and in all sectors." Its main page does not mention agents. This guide is part of our AI agents for business hub, and it shows how to apply the framework on a small scale. It was checked against NIST's pages on 9 November 2026.
This is general information, not legal advice.
Key Takeaways
- NIST released the AI RMF on 26 January 2023, and NIST says it is intended for voluntary use.
- It has four functions: Govern, Map, Measure and Manage.
- NIST says organizations may borrow as many or as few Playbook suggestions as apply.
- NIST says the AI RMF 1.0 is being revised, and its main page does not mention agents.
- Following it can reduce risk, but do not assume it satisfies any law. Some state AI laws may refer to NIST's framework, so ask a qualified attorney.
What the AI RMF is
NIST is the US National Institute of Standards and Technology. Its AI RMF page says: "The NIST AI Risk Management Framework (AI RMF) is intended for voluntary use and to improve the ability to incorporate trustworthiness considerations into the design, development, use, and evaluation of AI products, services, and systems."
It is a set of outcomes to aim for, not a checklist with a pass mark. Nobody issues you a NIST AI RMF certificate on the pages we read.
NIST also publishes a companion Playbook with suggested actions. The Playbook page says: "Organizations may utilize this information by borrowing as many – or as few – suggestions as apply to their industry use case or interests."
Why it fits a small business
The framework's core section says: "Framework users may apply these functions as best suits their needs for managing AI risks based on their resources and capabilities."
It continues: "Some organizations may choose to select from among the categories and subcategories; others may choose and have the capacity to apply all categories and subcategories." A 15-person firm can use the structure and skip the rest.
The four functions, in plain English
The left column uses NIST's terms. The small business version is our own translation.
| Function | What NIST says | Small business version |
|---|---|---|
| Govern | "Governance is designed to be a cross-cutting function to inform and be infused throughout the other three functions." | Name an owner, and write down the rules |
| Map | "The map function establishes the context to frame risks related to an AI system." | List the AI you use, and what could go wrong |
| Measure | "AI systems should be tested before their deployment and regularly while in operation." | Test it, and keep checking it |
| Manage | "The manage function entails allocating risk resources to mapped and measured risks on a regular basis and as defined by the govern function." | Decide what to fix first, and plan for incidents |
On order, the framework says: "After instituting the outcomes in govern, most users of the AI RMF would start with the map function and continue to measure or manage." In practice, that means start with an owner and a list.
A one-page version to start with
Here is a practical starting point. It is our own suggestion and is not a NIST document.
Govern: an owner and a few rules
- Name one person responsible for AI use.
- Write down what staff may and may not put into AI tools.
- Decide who must approve a new AI tool.
Our guide to shadow AI explains why that list matters. The AI acceptable use policy article gives you a base to adapt.
Map: a simple inventory
For each AI tool or agent, record:
- What it does, and who uses it.
- What data it can see.
- What it can change or send.
- Who could be harmed if it goes wrong.
Measure: tests and logs
- Test it with real examples before launch. Our guide to agent evals shows how.
- Keep logs of what it does. See agent observability.
- Review a sample of its work each month.
Manage: decide and respond
- Rank the risks and fix the worst first.
- Remove access the tool does not need.
- Write down what you will do if it causes harm, including how to switch it off.
What about AI agents?
NIST's main AI RMF page does not address agents, so you need to apply it yourself. Agents make the Map step more important, because they can take actions and not just produce text.
NIST has started separate work on agents. On 17 February 2026 it said: "Today, the Center for AI Standards and Innovation (CAISI) at NIST announced the launch of the AI Agent Standards Initiative."
NIST's summary of responses to its request for information was published on 18 May 2026. It says: "Commenters widely agreed that AI agents present novel security threats and that these security concerns present a barrier to adoption."
Until NIST publishes agent-specific guidance, OWASP's work is a practical supplement. See our plain-English take on the OWASP Agentic Top 10.
Things to keep in mind
It is being revised. NIST's page says: "The AI RMF 1.0 is being revised as part of the White House AI Action Plan." Check that page for the latest version before you put much work into it.
Generative AI has its own profile. NIST released a Generative AI Profile (NIST-AI-600-1) on 26 July 2024. It is worth reading if you rely on chat tools or agents built on language models.
Do not treat it as a legal shield. The framework alone does not tell you what the law requires of you. State and federal rules on AI are changing, so ask a qualified attorney how they apply to your business.
Next step
Start with the inventory, because you cannot manage tools you have not listed. If you need an agent built with these limits in mind, see our AI agent development service.
Frequently asked questions
Is the NIST AI RMF mandatory?
NIST says it is intended for voluntary use. A contract or a regulator could still ask you to follow it, so check your own contracts and ask an attorney about your situation.
Does following NIST satisfy AI laws?
Do not assume so. It is a voluntary risk management framework, and the NIST pages we read do not say it satisfies any law. Some state AI laws may refer to it, so ask a qualified attorney what applies to you.
Can I get certified in the NIST AI RMF?
The NIST pages we read describe no certification program for organizations. Be careful with anyone offering an official NIST certificate, and ask exactly who issues it.
How much does the NIST AI RMF cost?
NIST publishes the framework and the Playbook on its public website. Your real cost is the staff time to apply it, which you can limit by starting small.
How long does it take to start?
We don't have a verified figure for this. A first inventory of your tools is a small job, because it is only a list. Testing and logging take longer and depend on what you run.
Does the NIST AI RMF cover AI agents?
Its main page does not mention them, though you can apply the same functions to agents. NIST launched a separate AI Agent Standards Initiative in February 2026, so watch for new guidance.
