05 — frameworks & standards

NIST AI RMF

The US National Institute of Standards and Technology's voluntary AI Risk Management Framework, organised around four functions — Govern, Map, Measure, Manage — plus a Generative AI profile. It is not certifiable and prescribes no specific controls; its value is as a shared structure for deciding what to measure and for showing that risk decisions were made deliberately rather than by default.

Related terms

ISO/IEC 42001 Frameworks & standards
The certifiable management-system standard for artificial intelligence — the AI equivalent of ISO 27001.
EU AI Act Frameworks & standards
The European Union's risk-tiered regulation of AI systems, with obligations scaling from minimal to unacceptable risk.

Frameworks & standards

What auditors, buyers and regulators reference. See the compliance crosswalk for the control-by-control mapping.

NIST AI RMF is term 7 of 8 in this part of the glossary.

AMTSO OWASP LLM Top 10 OWASP Agentic Top 10 MITRE ATLAS EU AI Act ISO/IEC 42001NIST AI RMFAIUC-1

This page is one entry from the agentic AI security glossary, which defines 60 terms in the same style. Where a term belongs to a published taxonomy or standard — the HackAgent attack families, the OWASP lists, AMTSO's guidelines, MITRE ATLAS, ISO/IEC 42001, the NIST AI RMF, the EU AI Act — the authoritative wording is the source document's, not ours, and specifics should be verified there. "Lethal trifecta" is Simon Willison's term. OWASP® is a trademark of the OWASP Foundation; ATT&CK® and ATLAS™ are trademarks of The MITRE Corporation. Naming a framework here is description, not a claim of certification or endorsement.