The framework is intended for "AI actors" across all sectors and AI applications - from AI developers and deployers to procurement officials and end users. It's particularly valuable for organizations developing, deploying, or using AI systems in high-risk contexts.

What is an AI Actor?

According to the NIST AI Risk Management Framework (AI RMF), an AI actor is an individual or entity that actively participates in the AI system lifecycle, playing a role in the design, development, deployment, or use of AI systems. These actors include a wide range of stakeholders from various sectors, such as data scientists, software developers, system integrators, end-users, regulatory experts, and even impacted individuals and communities.

Examples of AI Actors:

• Technical Roles: Data scientists, data engineers, modelers, and systems integrators.
• Users and Operators: End users, system operators, and practitioners.
• Governance and Impacted Parties: Legal and privacy experts, human factors experts, socio-cultural experts, advocacy groups, and the general public.

Why the AI RMF Focuses on Actors:

• Broad Perspective: The framework recognizes that managing AI risks requires a broad set of perspectives, as AI systems are socio-technical in nature and impact individuals, organizations, and society.
• Lifecycle Involvement: AI actors are considered at every stage of the AI lifecycle, from initial data preparation and model building to deployment, operation, and the potential impact of the AI system.
• Contextual Risk Management: By including diverse AI actors, the framework encourages comprehensive risk mapping, considering potential negative impacts and ensuring responsible and trustworthy AI use.

No, it's a voluntary framework. However, it may become referenced in future regulations, procurement requirements, or industry standards. Some organizations are already incorporating it into their governance frameworks.

Former President Biden's Presidential Executive Order 14116, "Safe, Secure, and Trustworthy Development and Use of AI," drove the US Office of Management & Budget (OMB) to issue OMB Memorandum M-24-10. The memo established the binding requirements for federal agencies to manage the risks of artificial intelligence, and many agencies have aligned with the NIST AI RMF to meet those obligations. 

In 2025, however, President Trump rescinded Executive Order 14116 and its corresponding OMB memoranda M-24-10 and M-24-18 within 48 hours of taking office in January 2025. Biden's EO 14116 was replaced by Trump's own own executive order 14179, "Removing Barriers to American Leadership in Artificial Intelligence". This order set the stage for a broader policy agenda, leading to the "America's AI Action Plan" released in July 2025 along with three additional executive orders: 

1. Preventing Woke AI in the Federal Government: This order mandates that AI models procured by federal agencies must prioritize "truth-seeking" and "ideological neutrality". It specifically targets perceived biases related to "diversity, equity, and inclusion" (DEI).
2. Accelerating Federal Permitting of Data Center Infrastructure: This order aims to speed up the construction of AI data centers by fast-tracking permitting, easing environmental reviews, and using federal lands for development.
3. Promoting the Export of the American AI Technology Stack: This order establishes a program to promote the export of "full-stack" American AI technologies, including hardware and software, to allied nations.

NIST AI RMF covers a broad spectrum of risk including bias and fairness issues, privacy violations, safety risks, security vulnerabilities, transparency and explainability concerns, and broader societal impacts.

Specifically, the NIST AI RMF guides organizations to map and identify risk across the entire AI lifecycle.

1. Establish formal AI Management Function leadership, authority, and subject-matter expertise. One of the most critical first steps is to establish clear accountability and governance by defining who is responsible for managing AI risks. Organizations can create a cross-functional committee with representatives from legal, IT, compliance, and relevant business units. A team of cross-functional leaders (e.g., directors, vice presidents, officers, and managers) with sufficient organizational authority must be designated and trained to establish a formal AI governance and risk management Function/Department/Office. Optimally,the organization should even consider appointing a Chief AI Officer to lead the effort.
   • Contact us for an initial consultation to discuss team development
2. Leadership authorizes, initiates, and plans the organization's AI management system to support the organization's greater enterprise governance, risk, and compliance management.
3. The NIST AI Risk Management Framework is used to improve AI risk governance, assessment, and treatment practiced within the formal AI Management system.