The NIST AI Risk Management Framework is voluntary, which means the hard part is not compliance but deciding what level of AI risk your organisation will accept. This pack makes that an explicit, documented decision – AI risk tolerance and acceptance criteria sit at the front rather than being implied. 36 editable Word and Excel files, downloadable the moment you check out. On this page:
- What is in the AI risk tolerance and acceptance criteria pack
- Voluntary framework, mandatory-looking expectations
- Who needs AI risk tolerance and acceptance criteria
- How the documents map to the framework
- Frequently asked questions
- Related toolkits
What is in the AI risk tolerance and acceptance criteria pack
Documents carry AIRMF reference codes grouped by the four framework functions:
- GOVERN – AI governance charter and operating model, AI risk management policy, AI acceptable use policy, a separate generative AI acceptable use policy, AI ethics principles and code of conduct, AI roles and responsibilities, AI procurement and third-party AI policy, workforce training and competency plan, the AI risk tolerance and acceptance criteria, and the AI inventory and use case register
- MAP – context establishment, AI system categorisation, impact assessment on individuals and groups, and the data provenance and lineage position
- MEASURE – evaluation methodology, performance and fairness metrics, testing and validation records, and the monitoring of measurement validity over time
- MANAGE – the AI risk register, treatment and prioritisation, AI incident response, decommissioning and the post-deployment monitoring set
- Cross-cutting – the document index, and crosswalks to ISO 42001 and to the EU AI Act for organisations carrying those obligations too
Voluntary framework, mandatory-looking expectations
AI RMF 1.0 was published in January 2023 and remains the current version. NIST added the Generative AI Profile, NIST-AI-600-1, in July 2024, and published a Critical Infrastructure Profile concept note in April 2026. A revision of 1.0 is underway under the White House AI Action Plan, with no published date.
Voluntary does not mean optional in practice. Customers, insurers, investors and boards increasingly ask which AI risk framework you follow, and AI RMF is the common answer in the United States. It is also the framework US federal agencies reference, which makes it the pragmatic choice for anyone selling into that market.
The part organisations skip is the risk tolerance work. AI RMF explicitly states that the framework does not prescribe risk tolerance – that is your decision. Without documented AI risk tolerance and acceptance criteria, every subsequent measurement has nothing to be measured against, and the Measure function becomes data collection without conclusions.
Who needs AI risk tolerance and acceptance criteria
US organisations building or deploying AI who need a recognised framework to point at. Companies selling AI-enabled products to federal agencies. Risk and compliance functions asked by a board what governs AI use. And organisations that have adopted generative AI tools widely and quickly, and now need the acceptable use position and use case register that should have come first.
How the AI risk tolerance and acceptance criteria maps to the framework
The four functions are not sequential stages – Govern runs continuously alongside the other three. The pack reflects that by keeping the Govern documents as living policy and the Map, Measure and Manage material as per-system artefacts, so adding a new AI use case does not mean rewriting governance.
Frequently asked questions
Is AI RMF mandatory?
No. It is a voluntary framework. In practice customers, insurers and federal buyers increasingly expect a recognised AI risk framework, and this is the common US answer.
Does it cover generative AI?
Yes. The Generative AI Profile (NIST-AI-600-1, July 2024) is reflected, and a separate generative AI acceptable use policy is included alongside the general one.
How does it relate to ISO 42001?
AI RMF is a risk framework; ISO 42001 is a certifiable management system. They complement each other and a crosswalk is included. See the ISO 42001 Toolkit.
Is a version 2.0 coming?
A revision of 1.0 is underway under the White House AI Action Plan, but no date has been published. 1.0 remains current.
How many documents are included?
36 editable files – 31 Word documents and 5 Excel workbooks – plus guidance and a licence file.
Related toolkits
AI governance obligations stack quickly. See the ISO 42001 Toolkit for the certifiable management system, the EU AI Act Toolkit for European legal obligations, the Data Governance Toolkit for training data lineage and the ISO 27001 Toolkit for the security layer underneath.
Implementing for clients? The Consultant Package licenses all 86 toolkits and assessment tools on this site for unlimited client engagements, under one firm-wide licence. One payment of $1,399, no subscription and no per-client fee.
Delivery, format and licence
Your AI risk tolerance and acceptance criteria downloads immediately after checkout as native Microsoft Word and Excel files. Nothing is watermarked or locked, so you can rebrand the documents, bring them under your own document control and revise them for as long as you need them.
One-time purchase. No subscription and no annual renewal. Because the source files behind the AI risk tolerance and acceptance criteria are yours, revising a procedure after an audit finding or a change of scope is an internal edit rather than another purchase.
Reviews
There are no reviews yet.