Framework explainer · Malaysia & Singapore
NIST AI RMF Explained for Malaysian and Singapore Companies (2026)
The NIST AI Risk Management Framework is the most widely used method for assessing AI risk. This is what it says, what its four functions mean in practice, how it compares with ISO/IEC 42001, and how to start using it alongside Malaysian and Singapore rules in 60 days.
Short answer
What is NIST AI RMF?
The NIST AI Risk Management Framework (AI RMF 1.0) is voluntary guidance from the US National Institute of Standards and Technology, released on 26 January 2023, for managing the risks of AI systems. It organises the work into four functions, Govern, Map, Measure and Manage, and applies to any sector and organisation size.
Key facts · checked November 2026
NIST AI RMF at a glance
- Publisher
- US National Institute of Standards and Technology (NIST)
- Current version
- AI RMF 1.0, released 26 January 2023 (NIST AI 100-1)
- Status
- Voluntary: NIST says it is “intended for voluntary use”
- Certification
- None. NIST’s AI RMF pages describe no certification programme
- Generative AI
- Generative AI Profile, released 26 July 2024 (NIST AI 600-1)
- Companion
- The AI RMF Playbook of suggested actions per function
- What’s next
- NIST says AI RMF 1.0 “is being revised as part of the White House AI Action Plan”
- Cost
- Free to download from nist.gov
Sources: NIST AI Risk Management Framework, NIST AI 100-1 and NIST AI 600-1, checked November 2026.
The core
The four functions: Govern, Map, Measure, Manage
NIST splits AI risk management into four functions. Govern runs through everything; after it, NIST notes most users start with Map and move on to Measure and Manage, repeating as systems change. The right-hand column shows which Anchor Sprint AI Governance Kit document does that job.
| Function | What NIST says | What it means in practice | Kit document |
|---|---|---|---|
| Govern | What NIST says“A cross-cutting function that is infused throughout AI risk management”: culture, policies, accountability and an inventory of AI systems. | What it means in practiceName an AI sponsor and an AI Governance Lead, agree the risk appetite in one paragraph, approve the staff AI policy, and keep one register of every AI system in use. | Kit document
|
| Map | What NIST says“Establishes the context to frame risks related to an AI system”: purpose, users, data, who is affected and what could go wrong. | What it means in practiceFind the AI already in use, including shadow AI, then put each new use case through one intake form: what it does, which data it touches, which vendor runs it, and who it affects. | Kit document
|
| Measure | What NIST says“Employs quantitative, qualitative, or mixed-method tools, techniques, and methodologies” to analyse, assess, benchmark and monitor AI risk. | What it means in practiceRate each use case, run a risk and impact assessment for the medium and high ones, check the vendor and model, and test the system before it goes live. | Kit document
|
| Manage | What NIST says“Entails allocating risk resources to mapped and measured risks on a regular basis”: treat, respond, recover and communicate. | What it means in practiceDecide what to do about each risk, log and respond to incidents (including the 72-hour personal data breach clock in Malaysia), and review each AI system on a schedule. | Kit document
|
Quotes from NIST AI 100-1, section 5, checked November 2026. NIST adds that the actions “do not constitute a checklist”. Kit mapping from the kit pre-read (v1.2). Linked documents are free to preview; the others are in the Member kit.
The one control to start with
Govern 1.6 asks for “mechanisms … to inventory AI systems”. Without a list of the AI in use, none of the other functions has anything to work on. The free AGK-TPL-01 v1.0 AI System Register is that inventory.
Generative AI Profile · NIST AI 600-1
The Generative AI Profile in brief
Released on 26 July 2024, the profile applies AI RMF 1.0 to generative AI such as ChatGPT, Claude, Copilot and Gemini. It names 12 risks that generative AI creates or makes worse, and suggests actions for each under the four functions.
- 01
CBRN Information or Capabilities
Easier access to dangerous chemical, biological, radiological or nuclear information.
- 02
Confabulation
Confidently stated but false content, often called hallucinations.
- 03
Dangerous, Violent, or Hateful Content
Easier production of violent, inciting or hateful content.
- 04
Data Privacy
Leakage or unauthorised use of personal or sensitive data.
- 05
Environmental Impacts
High compute use in training and running models.
- 06
Harmful Bias or Homogenization
Amplified bias and performance gaps between groups or languages.
- 07
Human-AI Configuration
Over-reliance, automation bias or misplaced trust in the AI.
- 08
Information Integrity
Content that blurs fact and fiction, or feeds misinformation.
- 09
Information Security
Lower barriers to hacking, malware and phishing, and attacks on the AI itself.
- 10
Intellectual Property
Use or reproduction of copyrighted or protected material.
- 11
Obscene, Degrading, and/or Abusive Content
Easier production of abusive imagery and content.
- 12
Value Chain and Component Integration
Third-party models, data and components that are not transparent.
Risk names from NIST AI 600-1, section 2; summaries are ours. checked November 2026.
For a company that uses AI tools rather than builds them
- Confabulation: a human reviews AI output before it reaches a customer or a decision, and owns it.
- Data privacy: staff follow one data × AI tool matrix for what may be pasted where.
- Information security: connectors and agents stay off until approved, and write actions need a human.
- Value chain: each AI vendor is checked for data use, retention and where data is processed.
The first three are set out in the AI acceptable use policy template (AGK-POL-02 v1.1) and its data matrix.
Comparison
NIST AI RMF vs ISO 42001
They answer different questions. ISO/IEC 42001 tells you what an AI management system must contain and lets you prove it with a certificate. NIST AI RMF tells you how to find, assess and treat AI risk. Most organisations do not have to choose.
| NIST AI RMF 1.0 | ISO/IEC 42001:2023 | |
|---|---|---|
| Published by | NIST AI RMF 1.0NIST, a US government agency | ISO/IEC 42001:2023ISO and IEC, international standards bodies |
| What it is | NIST AI RMF 1.0A voluntary risk management framework | ISO/IEC 42001:2023An AI management system standard with requirements |
| Structure | NIST AI RMF 1.0Four functions: Govern, Map, Measure, Manage | ISO/IEC 42001:2023Plan–do–check–act management system with 38 Annex A controls |
| Certification | NIST AI RMF 1.0None: NIST publishes it as voluntary guidance | ISO/IEC 42001:2023Certifiable by an accredited certification body |
| Access | NIST AI RMF 1.0Free to download from NIST | ISO/IEC 42001:2023Purchased from ISO or a national standards body |
| Best for | NIST AI RMF 1.0The method for finding, assessing and treating AI risk | ISO/IEC 42001:2023Proving to customers and auditors that AI is governed |
The AI Governance Kit uses both: ISO/IEC 42001 for its structure and Statement of Applicability, NIST AI RMF for the risk method in its procedures. Read our ISO 42001 guide for Malaysia and Singapore or see how the kit maps each framework.
Malaysia & Singapore
Using NIST AI RMF alongside Malaysian and Singapore rules
NIST is not law in either country. Treat it as the method, and local rules as the obligations the method has to satisfy. The Govern and Map functions are where those rules come in.
Malaysia
- The PDPA 2010, as amended, applies whenever AI processes personal data, including breach notification.
- The national AIGE guidelines are voluntary principles; map them under Govern.
- The AI Governance Bill and the JPDP AI and personal data framework are drafts under consultation.
- BNM-regulated firms add their sector requirements on top.
Singapore
- The PDPA applies to personal data used with AI.
- The Model AI Governance Frameworks, including the one for agentic AI, are voluntary and in effect.
- AI Verify is a voluntary testing framework; useful evidence for Measure.
- The MAS AI Risk Management Guidelines are final and apply to financial institutions from 2027.
Status and dates for each instrument are kept current in the AI governance guide for Malaysia and Singapore.
Starting plan
A 60-day plan to start using NIST AI RMF
One function per fortnight, each ending in a record you can show a customer or auditor. This is a starting point for a company using vendor AI tools; firms that build AI or are regulated need longer.
Weeks 1–2 · Govern
Name owners and set the rules
AI sponsor, AI Governance Lead and a three-person committee. One paragraph of risk appetite. Approve the staff AI policy and collect acknowledgements.
AGK-001 · POL-02 · TPL-07
Weeks 2–4 · Map
Find and register the AI in use
Staff survey, expense data and network discovery with a 30-day amnesty. Every tool and use case goes into the AI system register through the intake form.
AGK-PRC-07 · TPL-01 · TPL-03
Weeks 4–6 · Measure
Rate the risks
Give each register entry a risk rating. For anything medium or high (AI that decides about people, faces customers or touches restricted data), assess the impact and check the vendor.
AGK-STD-A02 · PRC-02 · PRC-03
Weeks 6–8 · Manage
Treat, log and review
Record a treatment and owner for each risk, set up the incident log and who to call, then hold a day-60 committee review of the register, incidents and next steps.
AGK-PRC-04 · TPL-06 · PRC-05
The Lite pack below holds the free documents for weeks 1 to 4. The full template library lets you preview each one first.
Free AI Governance Lite pack
The documents an organisation starting out needs to govern AI tools in its first 90 days. Word and Excel, ready to edit.
- Lite Quick Start and Control Checklist AGK-001 · Word
- AI Governance Framework and Document Architecture AGK-000 · Word
- AI Acceptable Use Policy AGK-POL-02 · Word
- AI Data Handling Standard AGK-STD-A02 · Word
- AI Discovery and Shadow AI Procedure AGK-PRC-07 · Word
- AI Adoption Roadmap and Use-Case Prioritisation Guide AGK-GDL-C02 · Word
- AI System Register AGK-TPL-01 · ExcelPreview AI System Register
- AI Use Case Intake Form AGK-TPL-03 · Word
- AI Incident, Nonconformity and CAPA Log AGK-TPL-06 · ExcelPreview AI Incident, Nonconformity and CAPA Log
- AI Acceptable Use Acknowledgement AGK-TPL-07 · Word
- Pengakuan Penggunaan AI (Bahasa Melayu) AGK-TPL-07-BM · Word
- AI Use-Case Prioritisation and Benefits Tracker AGK-TPL-12 · ExcelPreview AI Use-Case Prioritisation and Benefits Tracker
Template release v1.0 · ZIP · 990 KB
Download AI Governance Framework and Document Architecture and the Lite pack
Templates for governance purposes, not legal advice.
NIST AI RMF FAQ
What is NIST AI RMF?
The NIST AI Risk Management Framework (AI RMF 1.0) is voluntary guidance from the US National Institute of Standards and Technology, released on 26 January 2023, for managing the risks of AI systems. It organises the work into four functions, Govern, Map, Measure and Manage, and applies to any sector and organisation size.
Is there a NIST AI RMF certification?
No. NIST publishes the AI RMF as voluntary guidance, and its AI RMF pages describe no certification programme (checked November 2026). A firm can be assessed against the framework by a consultant or auditor, but that is not a NIST certificate. If you need a certifiable standard, use ISO/IEC 42001.
Is the NIST AI RMF mandatory in Malaysia or Singapore?
No. It is a US framework and voluntary even in the US. Malaysian and Singapore companies use it as a method for assessing AI risk, while their obligations come from local rules such as Malaysia's PDPA, Singapore's Model AI Governance Frameworks and, for financial institutions, the MAS AI Risk Management Guidelines.
What are the four functions of the NIST AI RMF?
Govern sets the culture, policies, roles and AI inventory. Map establishes the context and risks of each AI system. Measure analyses, tests and monitors those risks. Manage treats them, responds to incidents and reviews. NIST calls Govern cross-cutting and says the functions are not a checklist and can run in any order.
What is the NIST Generative AI Profile?
The Generative AI Profile (NIST AI 600-1), released on 26 July 2024, is a cross-sectoral companion to AI RMF 1.0 for generative AI. It names 12 risks unique to or made worse by generative AI, including confabulation, data privacy, information security and intellectual property, and suggests actions for each.
What is the difference between NIST AI RMF and ISO 42001?
NIST AI RMF is a free, voluntary risk management framework built on four functions. ISO/IEC 42001 is an AI management system standard with requirements and 38 Annex A controls, and organisations can be certified against it. Many use ISO 42001 for the management system and NIST for the risk method.
What is AI risk management?
AI risk management is how an organisation finds, assesses and treats the ways its AI can cause harm, such as wrong answers, leaked data, unfair decisions or security gaps. In practice it means an AI register, a risk rating for each use case, controls matched to that rating, an incident process and regular review.
Part of the AI governance guide for Malaysia and Singapore. Read the framework itself at nist.gov.
