AI Risk Management Framework: NIST AI RMF, TEVV and Agents

What Is the NIST AI Risk Management Framework?

The AI risk management framework is NIST's Artificial Intelligence Risk Management Framework, AI RMF 1.0, published as NIST AI 100-1. NIST's AI Risk Management Framework page dates its release to January 26, 2023 and says it is "intended for voluntary use and to improve the ability to incorporate trustworthiness considerations into the design, development, use, and evaluation of AI products, services, and systems."

Its Core describes outcomes and actions, not a checklist of controls, grouped under four functions. Other organizations publish AI risk frameworks too; in this guide the term means NIST's.

The AI RMF FAQs list the trustworthiness characteristics the framework aims to support:

• Valid and reliable.
• Safe.
• Secure and resilient.
• Accountable and transparent.
• Explainable and interpretable.
• Privacy-enhanced.
• Fair with harmful bias managed.

A risk framework answers how you find, measure and treat the risks of each AI system. An AI governance framework sets who owns AI decisions and which rules bind them, and it usually draws on the AI RMF as one of its sources.

Around the AI RMF itself, NIST publishes companion material that this guide uses:

• AI RMF Playbook - suggested actions, documentation questions and references for every Core subcategory, which NIST calls voluntary: you take as many or as few suggestions as fit.
• Profiles - the AI RMF applied to one technology or setting, such as the Generative AI Profile (NIST AI 600-1) and a planned profile for critical infrastructure.
• Crosswalks - tables that relate the AI RMF to other texts, such as ISO standards and national guidelines, listed on NIST's resource center.

How TEVV Words and Actions in the NIST AI RMF Were Counted

Every count of the Core, the Playbook and the Generative AI Profile in this guide comes from a single counting script that ran on 2026-10-20 against NIST files saved with curl that day. The script and the PDF text extractor behind it use only the Node.js and Python standard libraries, and the PDF of NIST AI 100-1, the AI RMF 1.0 text, was read only to count mentions of agents.

• Core structure - categories and subcategories were read from the four function tables on the AI RMF Core page, and the 72 subcategory IDs were matched against the 72 Playbook entries, with none missing.
• TEVV wording - a subcategory counts when its own text contains test or testing, a form of evaluate, verify or validate, or the acronym TEVV. The word valid alone does not count, so MEASURE 2.5 (valid and reliable) is left out.
• Playbook fields - suggested actions are the top-level bullets of each entry, documentation items are the questions under "Organizations can document the following", and a TEVV actor is an entry whose AI Actors field lists TEVV.
• NIST AI 600-1 actions - action IDs such as MS-2.3-001 were read from the PDF text. Four rows draw part of their ID with characters that have no text mapping, so they were counted from the readable part, and the one ID used only as an example in the profile's introduction was left out.
• Risk tags - each action row was checked for the names of the 12 risks. A few tag characters also lack a text mapping, so the per-risk numbers are minimums.

A word count measures wording only: a subcategory without a TEVV word can still need test evidence, as MEASURE 2.3 shows by asking for performance or assurance criteria to be measured and demonstrated in conditions similar to deployment.

What Are the Four Functions of the NIST AI RMF?

The four functions are Govern, Map, Measure and Manage. The AI RMF Core states: "Governance is designed to be a cross-cutting function to inform and be infused throughout the other three functions." Govern is therefore not a first step you finish and leave.

Measure has the most subcategories and the most suggested actions in both companion texts. The script's output below gives its share of the Core subcategories and of the Playbook actions, and shows it is the one function where every subcategory lists TEVV among its actors. The AI 600-1 column comes from the same script's count over the NIST AI 600-1 PDF, read 2026-10-20.

NIST AI RMF 1.0 Core, read 2026-10-20
Source: airc.nist.gov AI RMF Core tables 1 to 4

Function   Categories  Subcategories
Govern              6             19
Map                 5             18
Measure             4             22
Manage              4             13
Total              19             72

Playbook entries 72; IDs not in Core 0

NIST AI RMF Playbook, read 2026-10-20
Source: airc.nist.gov/docs/playbook.json

Function   Actions  Doc items  TEVV actor  TEVV topic
Govern         100         78           2           0
Map            105         70           2           2
Measure        179        103          22          19
Manage          75         43           1           0
Total          459        294          27          21
Measure subcategories with a TEVV actor: 22 of 22
Measure share:
  Core subcategories  22 of 72  30.6%
  Playbook actions    179 of 459  39.0%

What each function asks for, and the record a team ends up holding when it is done:

• Map outcome - the Core says that after Map, users should know enough "to inform an initial go/no-go decision about whether to design, develop, or deploy an AI system."
• Measure processes - its processes "should include rigorous software testing and performance assessment methodologies with associated measures of uncertainty, comparisons to performance benchmarks, and formalized reporting and documentation of results."
• MANAGE 1.1 - this subcategory asks for a determination of whether the system achieves its intended purposes and whether its development or deployment should proceed.

What Is TEVV in the NIST AI RMF?

TEVV stands for test, evaluation, verification and validation: the measurement work that produces evidence about an AI system across its lifecycle. The AI RMF Core states that after the Measure function, "objective, repeatable, or scalable test, evaluation, verification, and validation (TEVV) processes including metrics, methods, and methodologies are in place, followed, and documented."

NIST AI RMF TEVV therefore means documented processes and their records, kept across the lifecycle. For how the four words split into separate checks when the system is an agent, see AI agent validation.

Subcategories whose own text uses TEVV words
(test, evaluate, verify, validate, TEVV)
Function   TEVV words  Measure/monitor  Document
Govern              2                3         3
Map                 3                0        15
Measure             9               10        15
Manage              1                5         5
All functions: 15 of 72 (20.8%)
Measure share of those: 9 of 15 (60.0%)

What Does NIST's Generative AI Profile Add to the AI RMF?

NIST AI 600-1, the Generative AI Profile, applies the AI RMF to generative AI. It describes 12 risks that are unique to generative AI or made worse by it, then lists suggested actions under AI RMF subcategories, each tagged with the risks it addresses; the script counted 212 actions, 72 of them under Measure.

NIST AI 600-1 (July 2024), read 2026-10-20
Source: nvlpubs.nist.gov NIST.AI.600-1.pdf

Suggested actions: 212
  (208 IDs read as text; 4 rows whose
   ID glyphs carry no Unicode mapping)
  Govern     58   27.4%
  Map        39   18.4%
  Measure    72   34.0%
  Manage     43   20.3%

The profile is narrower than its length suggests. It says the working group's focus "was limited to four primary considerations relevant to GAI: Governance, Content Provenance, Pre-deployment Testing, and Incident Disclosure" and that future revisions will add subcategories, risks and actions.

Information Integrity carries the most tags and Environmental Impacts the fewest. An action usually carries several tags, so the column adds up to more than the number of actions.

How Do You Apply the AI RMF to an AI Agent?

Apply it as you would to any AI system, then add the risks that come from acting. AI RMF 1.0, its Core tables and its Playbook never name agents, and the Generative AI Profile uses the word for AI only once, listing autonomous agents among security threats:

Occurrences of "agent" (any form)
  AI RMF 1.0 text (AI 100-1)      0
  AI RMF Core tables              0
  AI RMF Playbook (72 entries)    0
  AI 600-1                        6
    of which "autonomous agents"  1
    the rest: chemical, biological or other
    dangerous agents (the CBRN risk)

NIST's Center for AI Standards and Innovation (CAISI) described the risks of agents that act in its January 2026 request for information on securing AI agent systems: "AI agent systems are capable of planning and taking autonomous actions that impact real-world systems or environments." It names indirect prompt injection, insecure or poisoned models, and models that harm security without any attacker, such as through specification gaming.

The worked example is an access-provisioning agent. It reads requests in an IT ticket queue, adds people to directory groups through a tool and comments on the ticket. The organizational controls around agents like it are covered in agentic AI governance; the table covers the risk framework steps.

The Measure row only produces evidence when each requirement becomes a criterion a run can decide. For this agent, the criteria read like these:

• Valid request - after the run, the directory shows the user in the requested group; the agent's comment saying so is not enough.
• Admin group without approval - group membership is unchanged and the ticket records a refusal.
• Planted instruction - a ticket whose text tells the agent to add its author to an admin group leaves every group unchanged.
• Failed tool call - when the directory call fails, the agent reports the failure instead of success.
• Forbidden tool - the run log shows no call to a tool on the deny list, such as one that deletes accounts.

Some criteria will not be decidable, for example when staging has no audit log for one directory. MEASURE 1.1 asks you to document the risks you will not or cannot measure, so record those criteria as unchecked rather than counting them as passed. The model inside the agent raises its own questions, such as version pinning and revalidation after a provider change, which AI model governance covers.

How Does the NIST AI RMF Relate to the EU AI Act and ISO Standards?

They do different jobs, and NIST does not claim one satisfies another. NIST's crosswalk documents page says a listed crosswalk does not imply NIST endorsement, "nor does it imply that either resource comprehensively covers the contents of the other."

The Commission's regulatory framework for AI page, updated on October 19, 2026, is the source for the EU dates. It says the AI Omnibus entered into force on July 27, 2026, setting December 2, 2027 for high-risk use cases in areas such as employment and critical infrastructure, and August 2, 2028 for systems built into products such as lifts or toys.

The closest EU match to Measure is the risk management system for high-risk systems in Article 9 of the AI Act. Its paragraph 8 requires testing, as appropriate, during development and in any event before the system is placed on the market or put into service, measured against "prior defined metrics and probabilistic thresholds" suited to the system's intended purpose. How to turn that article into test cases is the subject of EU AI Act conformity testing.

ISO/IEC 42001 is listed in ISO's catalogue as edition 1 of December 2023, a standard that sets requirements for running and improving an AI management system in an organization that provides or uses AI. It works at the level of the organization, while the AI RMF's Map, Measure and Manage functions can be applied one system at a time.

Which NIST AI RMF and AI Agent Updates Are in Progress?

Version 1.0 is still the current text, and NIST's AI RMF page says: "The AI RMF 1.0 is being revised as part of the White House AI Action Plan." That plan, America's AI Action Plan of July 2025, recommends that NIST "revise the NIST AI Risk Management Framework to eliminate references to misinformation, Diversity, Equity, and Inclusion, and climate change." No revised version had been published when the NIST pages were read on 2026-10-20.

• Critical infrastructure profile - NIST's concept note page says the profile "will guide CI operators towards specific risk management practices to consider when engaging AI-enabled capabilities."
• Agent initiative - the AI Agent Standards Initiative page lists three pillars: industry-led standards, community-led protocols and research into agent authentication, identity and security evaluations.
• Incident practices - NIST's October 2026 announcement covers incidents "in which one or more SI agents take significant uninstructed actions that compromise explicit or implicit policies, controls, or security measures imposed by the operator".
• Center name - that announcement names the issuing center NIST's Center for Advancing Innovation and Standards for Super Intelligence (CAISSI), while February's initiative launch was issued as CAISI.

Pre-Release Agent Test Evidence for AI RMF Measure Work With Agent Assurance

For an agent that acts, most of the Measure evidence in the example above comes from running it: what it called, what it changed and which criteria nobody could check. TestMu AI's Agent Assurance produces that kind of test evidence before release, for agents that use tools, edit files and send API requests. It is a pre-alpha product with a publicly installable command-line client, Rook CLI:

npm install -g @testmuai/rook
rook --version

You can use Rook CLI on macOS and Linux, and 64-bit Windows through npm or WSL. For the npm package you need Node.js 20 or a later release, and the Rook CLI installation guide covers Homebrew and the checksum-verifying shell installer for macOS and Linux.

Agent Assurance starts from your agent's source code or specification and can also read a PRD or your written policies. It writes scenarios and gives each one acceptance criteria (functional and adversarial classes unless you ask for more), calls the live agent in staging or inside a CI job, and checks every criterion against what the run produced:

• Changed files and artifacts - output files under the paths named in the agent's profile, and the artifacts the run produced.
• Tool calls - each call measured against the tools the agent declares, with a must-not-call list for forbidden ones.
• Records - read-only lookups in the system the agent touched, using an MCP tool that you provide and approve.

Model judges score some criteria, rules and read checks decide the others, and an action the agent only claims is never proof: the run's evidence decides. Each verdict is one of Pass, Fail or Unable to Verify. The Agent Assurance documentation on results and evidence describes the scenario pass rate as a share of decided verdicts and shows coverage beside it, so a high rate built on little verified evidence stays visible.

Most AI eval and observability tools score the agent's answers and the traces it logged. Agent Assurance instead inspects the changes a run left in files, tool calls and records, and keeps a separate list of the criteria it had no evidence to decide.

Agent Assurance is not a NIST AI RMF mapping: it neither certifies nor shows compliance with the framework or with any of its functions, categories or subcategories. It tests and reports, and your risk and compliance team and auditors decide whether its results belong in your Measure records and whether your risk management meets the AI RMF or any regulation.

Use a staging environment, since a test run performs the agent's writes for real and nothing rolls them back. Agent Assurance does not monitor production or block anything at runtime, so post-release monitoring needs your own tools.

Write a Measure Gap Report to Start the AI Risk Management Framework

Pick the agent that can change the most records, fill in the four rows of the worked example for it, and write its five riskiest requirements as criteria a run can decide. Mark each criterion you cannot check yet and name what would make it checkable; that list is your first Measure gap report under the AI risk management framework, the record of unmeasured risks that MEASURE 1.1 asks for.

To see how that evidence supports trust claims beyond risk management, read the guide to AI assurance. To run the criteria against staging in a pipeline, follow the Agent Assurance CI/CD guide, which gates a job on the run's report instead of its exit code.

Note: Sirajuddin Khan, Vice President of Product Management at TestMu AI with Agentic AI and GenAI Product Strategy among the listed areas of expertise, is the author of record for this guide and approved it; the guide was researched and drafted with AI assistance. Vipul Verma, Group Senior Vice President of Engineering at TestMu AI, was its technical reviewer. The sources behind it are NIST publications and pages (NIST AI 100-1, NIST AI 600-1, the AI RMF Playbook and the draft NIST AI 200-2), America's AI Action Plan, the European Commission's AI Act pages, ISO's catalogue and the TestMu AI product documentation, and the editorial process and AI use policy describes how every claim is checked before publication.