How do you run an NIST AI RMF assessment when a customer asks for one?
When a customer, contract or regulator asks for NIST AI RMF evidence, the first thing to know is that the framework has no certificate and no accredited assessor. NIST does not validate or endorse any organization's use of the AI RMF, so an assessment is either a self-assessment or a privately arranged independent review. Your organization owns its AI risk controls. An implementation partner such as DeployOpen can prepare systems, configurations and evidence for review, but only an independent auditor or assessor you engage can issue a report, and DeployOpen does not issue audit reports, attestations or certifications.
Cost and duration depend on the scope you agree in writing, the number of AI systems in play, and how mature your existing evidence is. A single internal chatbot with a documented inventory entry is a very different job from a portfolio of vendor-supplied models with no records of testing or decisions. Before requesting a quote, confirm exactly what the requesting party wants to see: the scope of AI systems covered, the functions or subcategories they care about, the time period the evidence must cover, and whether they accept a self-assessment or require an independent reviewer. Ask whether the reviewer will be named by you or by them, since that choice changes who pays and who can rely on the result.
Start by writing a Current Profile that records how AI risk is managed today, then decide on a Target Profile that reflects the outcomes your customer or regulator needs. The gaps between the two become your action plan. Confirm with the requesting party whether they expect a specific profile format, because the framework does not prescribe templates. Keep the assessment internal first, then bring in an independent reviewer to test it, which NIST's guidance on independent review supports for reducing internal bias and conflicts of interest.
How the assessment moves from Current Profile to gap report
The sequence turns the AI RMF's 72 subcategories into a prioritized gap report that a customer, regulator or independent reviewer can read. Each step produces a named record, and the order keeps the Current Profile honest before any target is set.
Scope the AI systems and functions in use
Start by listing every AI system, model and function the assessment covers, including systems bought from vendors and features embedded in other products. Owners in the business and engineering teams confirm which systems are in scope and which are excluded, with the reason for each exclusion. The output is a scoped AI inventory that names each system, its owner, its purpose and its lifecycle stage. The step is complete when the scope owner signs off and the inventory matches what the organization actually runs, which is a check you can ask a reviewer to test by sampling systems.
Document the Current Profile using AI 100-1 Section 6
Record how AI risk is managed today for each in-scope system, using the categories and subcategories that apply to it. AI 100-1 Section 6 describes the Current Profile as a snapshot of existing practice, so write down what happens now, not what policy says should happen. Governance, product and security staff supply the evidence, such as existing policies, test records and incident logs. The output is a Current Profile document per system or per group of systems, with each subcategory marked as addressed, partly addressed or not addressed and linked to the evidence that supports the mark.
Define the Target Profile from customer and regulatory needs
Set the desired outcomes by reading the contract clauses, customer security questionnaires, sector rules and regulator expectations that prompted the assessment. Ask the requesting party which subcategories or evidence they need, and record where a requirement is stated in a contract rather than inferred. The framework does not prescribe a Target Profile template, so the organization chooses the format. The output is a Target Profile that lists the outcomes to reach for each in-scope system, with the source of each requirement recorded beside it. Confirm the Target Profile with the party who asked for the assessment before comparing.
Compare the profiles to list gaps
Place the Current and Target Profiles side by side for each system and record every subcategory where the current state falls short of the target. Include partial matches, since a policy that exists but is not applied is a gap in practice. The comparison is a working exercise led by the compliance lead with the technical owners, and it should not be delegated to a single author. The output is a gap register that lists each gap, the subcategory it sits under, the system affected and the evidence that shows the difference. The step is done when every Target Profile line has a matching Current Profile entry.
Prioritize gaps by risk
Rank the gaps using the risks mapped for each system, the likelihood and magnitude of impact, and the commitments in the Target Profile. AI 100-1 leaves prioritization to the user's needs and risk management processes, so record the criteria the organization applies and who approved them. High-impact gaps in systems that affect people or regulated decisions usually come first, but the ranking must come from the organization's own risk assessment. The output is a prioritized gap register with a stated priority and a named risk owner for each gap, approved by the accountable executive.
Record action plans for each priority gap
For each prioritized gap, write an action plan that states the change, the owner, the evidence that will show the gap is closed and the decision point for accepting any residual risk. Plans should cover policy, process, technical controls and documentation as needed. Where the plan depends on an outside party, such as a vendor or implementation partner, name that dependency and the deliverable expected. The output is an action plan register linked to the gap register. The step is complete when each high-priority gap has an owner, a closure test and a recorded decision, and the remaining items have a documented reason for deferral.
Arrange independent review of the gap report
Assemble the scoped inventory, both profiles, the gap register and the action plans into a gap report, then arrange a review by people who did not build or operate the systems. AI 100-1 Section 5.3 notes that independent review can improve testing and reduce internal bias and conflicts of interest, and MEASURE 1.3 describes assessments by internal experts who were not front-line developers and or independent assessors. Confirm with the reviewer whether the review is an internal check, a privately arranged independent review or a third-party attestation, because NIST does not certify AI RMF use. The output is the gap report with a dated reviewer statement that describes the review performed and its limits.
Who owns the controls, who prepares evidence and who reviews it
The organization that builds, buys or operates the AI system owns the AI RMF outcomes and every decision that follows from them. NIST describes the framework as voluntary and does not assign it to any outside party, so the accountability for risk tolerance, the go or no-go determination and residual risk stays with leadership. Outside help can shape the work, but it cannot make these calls.
- Risk tolerance and go or no-go: Leadership sets the risk appetite and decides whether an AI system may be deployed, which maps to the MANAGE 1 outcomes.
- Current and Target Profiles: The organization records how AI risk is managed today and signs off the Target Profile that defines the desired state.
- Accountable roles: Named owners, reporting lines and AI risk training, covered under GOVERN 2.
- Policies and the AI inventory: The organization approves its own policies, documentation and inventory of AI systems.
- Independence of testing: Separating development from testing, as the Playbook suggests under GOVERN 2.1, is a design choice the organization makes.
Check that each Target Profile item has a named executive owner and that the sign-off record is dated and kept with the assessment file.
An implementation partner such as DeployOpen prepares the systems, documentation and evidence that the organization's assessment relies on. Its work is scoped in writing before it starts, and the organization stays responsible for what the evidence says. A partner does not decide whether a subcategory is met and does not issue reports or attestations.
- Systems and platforms: Setting up self-hosted tooling for logging, model registries, evaluation pipelines and access controls inside the client's own infrastructure.
- Documentation: Drafting the transparency and documentation items that the Playbook lists for each subcategory, for the organization to review and adopt.
- Security testing: Running application, API, cloud, AI system and red team testing where the scope includes it, with findings delivered to the organization.
- Evidence packs: Organizing outputs, such as test results and change records, so an independent reviewer can trace them.
- Limits: The partner does not validate the organization's approach to the AI RMF and does not issue any certificate or report.
Ask the partner to state in the written scope which deliverables are documents, which are test results and which, if any, the organization must approve before use.
An independent reviewer tests the assessment and, where the customer or regulator asks for one, issues a report. NIST's materials describe no accredited assessor or conformity assessment program for the AI RMF, so the reviewer is a privately arranged party whose independence and scope are set by the contract. AI 100-1 notes that independent review can improve testing and reduce internal bias and conflicts of interest.
- Independence: The reviewer should not have built or operated the system under review, which matches the distinction AI 100-1 draws between verification and validation actors and those who test.
- Scope of testing: The reviewer samples evidence against the chosen subcategories and reports what it found.
- Reports: Only the reviewer, not the organization or partner, issues any written opinion on the assessment.
- Standards for the review: Ask whether the reviewer uses a documented method and whether its reports state the limits of their scope.
- Credentials: Confirm the reviewer's qualifications and professional standing, since no AI RMF credential exists.
Confirm who will receive the reviewer's report and whether the customer accepts a privately arranged review in place of a certification.
What independence NIST suggests for the review
NIST does not require an outside auditor for an AI RMF assessment, but its guidance repeatedly asks that the people judging AI risk be separated from the people building the system. The four points below show where that separation appears in the framework and how an assessor or customer can check for it.
Internal experts outside the build team
MEASURE 1.3 describes regular assessments carried out by internal experts who were not front-line developers, and/or by independent assessors. In an assessment, ask who ran the last evaluation of each AI system and whether that person wrote or tuned the model. If the answer is the same team, the evidence is weaker than it looks. Confirm the reviewer's role, reporting line and the date of each assessment record.
Independent review limits bias
AI 100-1 Section 5.3 says independent review can improve testing and help mitigate internal biases and conflicts of interest. The point is practical: teams tend to test for the failures they already expect. Look for review records that show a reviewer challenged assumptions, documented disagreements and whether findings changed a go or no-go decision. Where no outside party is involved, document why the internal reviewer is considered independent.
Separate development from testing
The Playbook's suggested actions for GOVERN 2.1 include separating AI system development functions from AI system testing functions so that course correction can be independent. In practice, the people who tune prompts, retrain models or change guardrails should not be the only people who sign off on the test results. Check the access rights in your model registry and ticketing system, and confirm that test sign-off requires a named person outside the development group.
Distinct verification and validation actors
Appendix A of AI 100-1 says verification and validation actors should ideally be distinct from the actors who perform test and evaluation. Verification asks whether the system was built as specified, and validation asks whether it does what it is meant to do in context. An assessor should see separate owners for each activity in the RACI or governance record, and separate evidence for each, so one person cannot both run a test and certify its outcome.
Where outside assurance fits
Independence inside the organization does not replace an external opinion. Because there is no AI RMF certification, any outside review is a privately arranged engagement, and the scope, criteria and report format are agreed with the client. Ask the reviewer to state which subcategories they tested, what evidence they examined and what they did not cover. An implementation partner can prepare the evidence, but only the organization or its chosen independent reviewer can issue the conclusion.
Which documentation the Playbook points to as evidence
The NIST AI RMF Playbook is the most practical place to see what documentation NIST expects an organization to keep, but it is a menu, not a test script. The Playbook is free to download in PDF, CSV, Excel and JSON formats from NIST's AI Resource Center, and NIST states that it is neither a checklist nor an ordered list of steps. Users are not expected to review or implement every suggestion. For an assessment, that means the evidence file should be built from the subcategories you chose to cover in your Current and Target Profiles, not from every entry in the Playbook. Each of the 72 subcategory entries includes a transparency and documentation section that lists what an organization can document to show it addressed that subcategory. Treat these lists as prompts for your own records. A reviewer will expect to see the policy, meeting record, test report, inventory entry or monitoring output that the prompt describes, with an owner, a date and a version. Map each prompt to the artifact that already exists in your environment, and mark the gaps as findings for your action plan. Where a prompt asks for something you do not produce, decide whether the subcategory is in scope before you document it as not applicable.
Before you rely on the Playbook's wording for an audit or a customer questionnaire, confirm the current guidance. NIST's audit log shows the last content update in August 2023, and AIRC has said the Playbook will be updated after the AI RMF is revised. The White House AI Action Plan recommends revising the framework, and NIST has not yet published a revised version as of October 2026. Check the NIST AI RMF page for the current release status, and record in your assessment file which Playbook version you used and the date you used it, so the evidence can be traced if the wording changes later.
Self-assessment, independent review or third-party certification: which to choose
This table compares the three ways an organization can evidence its NIST AI RMF work: an internal self-assessment, a privately arranged independent review and an accredited third-party certificate. Read each row for who performs the work and what it produces, then match the option to the assurance your customer or regulator actually asks for. For most buyers, the main takeaway is that no AI RMF certificate exists, so any certificate you are offered will come from a different scheme.
| Option | Who performs it | What it produces | When it fits |
|---|---|---|---|
| Internal self-assessment | Compliance lead with input from AI, security and product owners, ideally including staff who were not front-line developers of the system | Internal Current and Target Profiles, gap register, action plans and documentation drawn from the Playbook's transparency and documentation sections | Early readiness work, internal governance reporting, or a first answer to a customer questionnaire that asks how you use the framework |
| Privately arranged independent review | An assessor the customer accepts in writing, with no role in building the AI system, selected by the organization and agreed on scope | A review report or findings memo that the assessor signs. It is not a NIST certificate and NIST does not validate it | Contracts or procurement that ask for outside assurance, or internal testing where the team needs independence to address conflicts of interest |
| Accredited third-party certificate (ISO/IEC 42001 route) | An accredited certification body that is audited against ISO/IEC 42006:2025 requirements, after an organization implements ISO/IEC 42001 | A certificate against ISO/IEC 42001, which is a different management system standard. The AI RMF has no equivalent scheme | When a customer or regulator requires a certified AI management system. Confirm the exact standard named in the requirement before you choose this route |
| Who can issue a report or certificate | Only an independent auditor, assessor or certification body. DeployOpen prepares systems and evidence but does not issue reports or certificates | Depends on the option above. Ask any provider to state in writing who signs the output | Use this row to check vendor claims before you accept a 'NIST certified' or 'NIST approved' label |
| Cost and effort drivers | Internal staff time for self-assessment; assessor fees and scope for independent review; certification body fees and implementation work for the certificate route | One-time setup plus recurring reviews. Scope size, number of AI systems and the depth of evidence drive effort in every option | Ask each provider for a fixed-scope written quote that separates assessor fees, implementation work and any recurring reassessment |
| Independence expectation | NIST suggests separating development from testing and using independent assessors where practical | Independent review can improve testing and reduce internal bias. Document how the assessor was chosen and what access they had | Choose independent review when the people who built the system cannot objectively test it |
Questions to ask an assessor or consultant before signing
No body certifies organizations against the NIST AI RMF, so the firm you hire will be preparing your evidence or giving an independent opinion, not issuing a certificate. The questions below test whether the firm is independent of the work it reviews, whether it has real AI governance experience, and whether the scope is written down before money changes hands.
Implementer or independent reviewer
Ask whether the firm would build or configure the AI systems, policies or evidence it later reviews. If it does both, the review inherits the same blind spots the framework warns about. AI 100-1 notes that independent review can reduce internal bias and conflicts of interest, and the Playbook suggests separating development from testing in GOVERN 2.1. Ask who on the team has never worked on the system under review, and whether that person signs the findings. A firm that builds your controls should not also be the only party judging them.
Named AI RMF or AI governance experience
Ask for two or three completed engagements that involved the AI RMF, ISO/IEC 42001 or AI governance evidence, described in terms of the artifacts produced: inventories, impact assessments, test records, monitoring logs and risk decisions. Ask how the firm maps those artifacts to the four functions Govern, Map, Measure and Manage. Client names may be confidential, so ask for anonymized descriptions and a named senior person who did the work.
A written statement of what the firm will not issue
Ask the firm to state in writing that it will not issue an AI RMF certificate, attestation or conformity report. NIST does not validate or endorse any organization's use of the framework, so any document presented as a NIST certificate is a warning sign. Ask what the deliverables are called, who signs them, and whether they describe the organization's own self-assessment rather than a third-party opinion.
Fixed scope with written deliverables
Ask for a written scope that names the AI systems in scope, the functions and categories covered, whether the work produces a Current Profile, a Target Profile, a gap list or all three, and the deliverables with their owners. Ask how changes to scope are priced and approved. Because the framework lets users choose which of the 72 subcategories to apply, a vague scope makes it impossible to tell later what was actually assessed.
Position on the Playbook's voluntary status
Ask how the firm will treat the Playbook, which NIST describes as neither a checklist nor an ordered set of steps, and whose suggestions users are not expected to implement in full. A firm that scores your organization by counting unimplemented Playbook suggestions is applying a method NIST does not prescribe. Ask which suggestions the firm will treat as in scope, how it will record the ones you decline with a reason, and how it will document that choice.
Source of any certification claim
If the firm says it is certified, accredited or approved for AI RMF work, ask it to name the certifying or accrediting body and the program. The AI RMF has no accredited assessor scheme, so a claim of this kind needs a named body you can verify. Accredited third-party certification in AI governance runs through ISO/IEC 42001 and the requirements in ISO/IEC 42006:2025 for bodies that audit it. Ask the firm to say which of those routes, if any, it is actually part of.
Questions buyers ask about NIST AI RMF assessments
Is there a NIST AI RMF certificate?
No. The NIST AI RMF has no certification, accreditation or conformity assessment program. NIST's use cases page states that it does not validate or endorse any individual organization or its approach to using the framework, and its framework pages, FAQ, Playbook and Roadmap describe no certificate. An assessment against the AI RMF is therefore a self-assessment, or a privately arranged independent review. When a customer asks for a certificate, ask which scheme they mean. If they need a certifiable AI governance standard, the relevant route is ISO/IEC 42001, which has an accredited third-party certification route under ISO/IEC 42006:2025, and the AI RMF can be used alongside it.
Who can issue an AI RMF assessment report?
The organization itself issues its own assessment results, and it owns its risk decisions. An independent reviewer can examine the work and write a report, but no body is accredited to certify AI RMF conformity. AI 100-1 notes that independent assessors and internal experts who were not front-line developers can improve testing and reduce internal bias and conflicts of interest. DeployOpen prepares systems, documentation and evidence for these reviews, but it does not issue audit reports, attestations or certifications. Ask any reviewer to state in writing what their report covers, which Current and Target Profiles it tested and what standard, if any, it measures against.
How long does an NIST AI RMF assessment take?
Duration depends on scope and readiness rather than on a fixed framework timeline. The main drivers are how many AI systems are in scope, how many of the 72 subcategories you select, whether an AI inventory and documented risk tolerance already exist, how many teams hold evidence, and whether systems must be tested or only documented. A gap assessment that compares a Current Profile with a Target Profile can move faster than one that also requires testing evidence from Measure. Agree on the duration in the written scope, and ask the provider to list the dependencies they expect from your team.
What does an NIST AI RMF assessment cost?
The framework and its core documents are free. NIST AI 100-1, NIST AI 600-1 and the Playbook downloads carry no fee. Cost comes from people and work: internal staff time for interviews, inventories and evidence collection, any implementation work on logging, testing or documentation, and any independent review you commission. Recurring costs include periodic reassessment and monitoring. Costs rise with the number of AI systems, the number of third-party models you buy, and the depth of testing expected. Ask any provider for a fixed-scope quote that separates assessment, remediation, testing and retainers, and that lists which deliverables each line produces.
What does the work need from our team?
Expect contributions from several roles. Governance owners approve the Govern policies and accountability structures. AI product and engineering leads describe each system, its intended purpose and its data and model dependencies. Risk, legal and privacy staff review the Map and Manage decisions. Security staff supply evidence for the secure and resilient characteristic. Procurement supplies contracts for third-party AI under GOVERN 6 and MANAGE 3. Someone with authority must accept residual risk. The Playbook is not a checklist, so your team must decide which subcategories apply and record why others do not.
Can we run an NIST AI RMF assessment ourselves?
Yes. Because the AI RMF is voluntary and has no accredited assessor, an organization can run the assessment internally, using the Playbook's documentation prompts and an AI inventory. NIST's AI 100-1 encourages periodic evaluation of whether the framework has improved your ability to manage AI risk. Internal assessments work best when the team separates development from testing, as GOVERN 2.1 suggests, and when someone outside the build team reviews the results. Outside help is useful for building the Current and Target Profiles, preparing evidence, and running independent review. Make the choice based on who will defend the results to a customer or regulator.
Is the NIST AI RMF mandatory?
No. NIST's AI RMF FAQ states that no private or public sector organization is required to use the framework. NIST produced it as a voluntary framework after Congress directed it to develop one with the private and public sectors. The practical pressure comes from elsewhere: a customer contract, a procurement questionnaire, or a state law that refers to the framework. Before you commit to an assessment, confirm which clause, contract or regulation names the AI RMF and what that text asks for. Note that NIST has said AI RMF 1.0 is being revised, so confirm which version a requirement cites.
What should we ask a provider before hiring one?
Ask for a written scope that names the AI systems, the subcategories covered and the deliverables, including the Current Profile, the Target Profile and the gap action plan. Confirm which parts the provider prepares and which parts your organization owns, such as risk acceptance and attestations. Ask who performs the independent review and whether that person is distinct from the implementers. Request a list of documentation the Playbook points to that will be produced. A reputable provider will say plainly that it does not issue AI RMF certificates or assessment reports.
How DeployOpen prepares AI RMF evidence for your assessor
DeployOpen prepares the systems, documentation and evidence that an organization uses in its own NIST AI RMF assessment, including self-assessments and privately arranged independent reviews. We do not issue assessment reports or certificates, because the AI RMF has no certification scheme and that work belongs to the organization and its chosen reviewer.
How we scope
- We agree in writing which AI systems, functions and subcategories of the AI RMF Core the engagement covers.
- We set up a Current Profile and a Target Profile so the gap assessment has a defined starting point and end state.
- We confirm which documentation the Playbook points to for each in-scope subcategory, and which of those your team will keep.
How we build
- We deploy self-hosted open-source platforms inside your own cloud accounts, data centers or air-gapped networks.
- We configure logging, inventory, evaluation and monitoring tooling so the evidence is generated as the systems run.
- We separate development and testing roles where the scope requires it, reflecting the Playbook's GOVERN 2.1 suggestion for independent course correction.
How we hand over
- We deliver the documentation, gap findings and evidence set in a form your internal assessors or an independent reviewer can test.
- We document configuration, ownership and the procedures your team needs to keep the evidence current after handover.
- We state plainly which findings remain open, so your organization can assign owners and decide on action plans.
How we support
- Engagements are fixed-scope, with scope, deliverables and timelines agreed in writing before work starts.
- Ongoing support, upgrades and continuous testing are available as a retainer if your Target Profile moves over time.
- Quotes follow from the written scope, so ask us to itemize the work for each in-scope function and subcategory.
