GUIDANCE · 7 MIN READ

NIST AI RMF: Why Voluntary Guidance Still Matters.

Voluntary frameworks can influence procurement, assurance and governance expectations even where they are not law, making NIST an important reference for organisations managing AI risk.

INTAI Research · Published 9 June 2026

Read the Update

Voluntary in Name, Increasingly Binding in Practice

The NIST AI Risk Management Framework, released in 2023, is explicitly voluntary at the federal level, no US law requires a private organisation to adopt it. That description understates its practical reach considerably.

For US federal contractors supplying AI products or services, alignment with the NIST AI RMF is effectively mandatory in practice, showing up directly as a procurement requirement. It has extended similarly into regulated sectors more broadly: for organisations in healthcare, financial services or government contracting, being able to demonstrate alignment with the framework is increasingly expected by counterparties and auditors, whether or not any specific statute names NIST directly.

The Framework Has Kept Expanding to Match the Technology

NIST has not treated the 2023 framework as finished. In July 2024, it published NIST AI 600-1, the Generative AI Profile, extending the base framework specifically to large language models and generative AI systems, covering twelve risk categories including confabulation, prompt injection and data privacy risks unique to generative systems.

The expansion has continued through 2025 and into 2026: a March 2025 update addressed generative AI risks, supply chain vulnerabilities and third-party model assessment more directly, an April 2026 concept note introduced a planned profile on trustworthy AI in critical infrastructure, and NIST has launched a further initiative to develop voluntary guidelines specifically for AI agents, with an agent-focused profile planned for late 2026, tracking the same shift toward agentic systems that is driving governance conversations across every sector this series has covered.

Central Insight

Voluntary guidance influences behaviour through channels other than legal obligation: procurement checklists, insurer questionnaires, customer due diligence and courtroom arguments about what a reasonable standard of care looked like at the time. A framework does not need force of law to become the reference point against which an organisation’s AI risk management is actually judged, and NIST AI RMF has, for many US and internationally exposed organisations, already reached that status.

Why Adoption Still Lags Despite the Framework’s Influence

The gap between influence and formal adoption is real and worth naming honestly: 77% of organisations report actively building AI governance programmes, yet only 36% have adopted a formal framework such as NIST AI RMF specifically.

That gap is a practical opportunity rather than only a governance shortfall. An organisation building its AI risk management approach without reference to an established framework is, in effect, reinventing structure that NIST has already built, tested against real-world feedback, and continued to update as the technology has moved, from the base framework through the Generative AI Profile to the forthcoming agent-specific guidance. For organisations still assembling their AI governance approach, mapping it against NIST AI RMF from the outset is one of the more efficient ways to arrive at something that will hold up against both procurement scrutiny and future regulatory expectation.