AI glossary · Basic · Safety & alignment · AI security
AI risk management
AI risk management is the organization-wide practice of identifying, assessing and reducing in advance the harms an AI system can cause (discrimination, malfunctions, privacy violations, security incidents and so on). The AI RMF published by the US NIST is a leading reference framework.
About this term
- Level
- Basic · Technical terms you often meet in AI news
- Category
- Security & safety
- Fields
- Safety & alignment, AI security
- Added
- 2026-10-09
How it works
The NIST AI RMF divides risk management into four functions. First, Govern sets owners, principles and procedures to lay the foundation of the organization's culture. Map identifies the context: where the AI is used and whom it might affect, and how. Measure tests risks such as accuracy, bias and security and checks them with metrics, and Manage sets priorities and makes decisions to reduce risks, accept them, or stop using the system. This process does not end after one pass; it repeats continuously from AI development through operation.
The four functions of the NIST AI RMF
Govern
- 1Map
- 2Measure
- 3Manage
- 1. Map Understand uses and impacts
- 2. Measure Test and quantify risks
- 3. Manage Decide to reduce, accept or stop
Why it matters
AI is rapidly entering areas that directly affect people, such as hiring, loan screening, healthcare and customer support. Wrong decisions, hallucinations or data leaks can cause serious harm and shake trust in a company. As regulations like the EU AI Act impose obligations based on risk level, having a system that can record and explain how risks were managed has become important. Even when not mandatory, frameworks like the AI RMF serve as a common language that helps organizations decide what to check first.
Things to know
Risk management is not just a job for technical teams; it works only when legal, security and business teams take part. Since not every risk can be eliminated, the key is setting a threshold for how much risk to accept. Practical techniques such as red teaming, evals and human-in-the-loop are used within this framework as tools for 'Measure' and 'Manage'. If an organization only prepares documents without monitoring actual operations, the process easily becomes a formality.
Example
When a company introduces an internal support chatbot, it follows this framework by first laying out what questions the chatbot will receive and what data it will access (Map), testing for off-target answers or personal data exposure through red teaming before launch (Measure), and designing guardrails for risky questions and handoffs to humans (Manage). Defining the owners and approval procedures for this entire process is governance.