NIST AI Risk Management Framework

What this skill does

Applies the NIST AI RMF — by name, by Subcategory, by Action ID — to whatever AI use case, governance question, or assessment the user brings. Three modes; pick one based on the user's question, default to consult if unsure.

1. Consult — fast lookup. "What should I do per the AI RMF for X?" Returns applicable risks (for GenAI) and the relevant Suggested Actions / Subcategories, quoted verbatim. Best for quick gut-check questions.
2. Governance plan — structured plan. "What should our governance plan include per the AI RMF?" Organized around the GOVERN function's Subcategories, with GenAI-specific actions layered in where applicable. Best for standing up or auditing an AI governance program.
3. Assessment — full impact assessment. "Run a NIST AI RMF impact assessment for X." Walks all four functions for one specific system. Best when the user wants a documented artifact.

All three modes share the same source-of-truth: verbatim NIST text in references/. Quote the files; don't invent or paraphrase.

Source and scope

Two NIST publications underlie the skill. The verbatim extracted markdown ships in references/; the raw source HTMLs and maintainer-only re-extraction tooling live outside this distribution.

• NIST AI 100-1 (AI RMF 1.0, January 2023) — the Core framework. Applies to any AI system. Defines Govern, Map, Measure, Manage; their Categories and Subcategories; and seven Trustworthy AI characteristics. Extracted into references/core/.
• NIST AI 600-1 (Generative AI Profile, July 2024) — the GenAI-specific overlay. 12 enumerated GAI risks and 211 Suggested Actions coded GV-X.Y-NNN etc., each mapped to a Core Subcategory. Extracted into references/gai-profile/.