NIST AI RMF in Practice

How agencies and companies apply the NIST AI Risk Management Framework.

56 federal agencies reported 3,611 AI use cases for 2025, double the 2024 count, and flagged 445 as high-impact. Texas treats substantial compliance with NIST's generative AI profile as an affirmative defense under TRAIGA.

Federal AI use cases, 2025

3,611

Growth from 2024

105%

Cyber AI Profile focus areas

3

TRAIGA uncurable penalty

$200,000

Evidence

NIST added profiles while state laws began to reference it

Developments: NIST AI RMF
Date	Development	Country	What happened	Source
Dec 15, 2025	NIST IR 8596 Cyber AI Profile draft	United States	Secure, defend and thwart focus areas	Source
Jan 1, 2026	Texas TRAIGA in force	United States	NIST AI 600-1 compliance is an affirmative defense	Source
Apr 7, 2026	Critical infrastructure profile concept note	United States	First sector profile	Source
Apr 2026	2025 federal use case inventory	United States	3,611 use cases, 445 high-impact	Source
Sep 15, 2025	AI Safety Governance Framework 2.0	China	Graded, risk-tiered governance broadly comparable to the AI RMF	Source

Rules

Voluntary nationally; a legal defense in Texas

Key rules and standards: NIST AI RMF
Rule	Jurisdiction	What it requires	Status
NIST AI RMF 1.0	US federal	Govern, map, measure and manage	Revision under way
NIST AI 600-1 Generative AI Profile	US federal	Generative AI risks and actions	Jul 26, 2024
OMB M-25-21	US federal	Agency AI governance and use case inventories	Apr 2025
Texas TRAIGA	Texas	NIST-based affirmative defense; complaint portal from Sep 2026	In force Jan 1, 2026

Status colors: green in force, blue voluntary standard or framework, amber adopted and phasing in, gray draft or pending, red withdrawn.

Record

Page Record

Datasets: ai_compliance_evidence.csv (5 rows)
Key sources: NIST IR 8596 Cyber AI Profile draft
Texas TRAIGA in force
Critical infrastructure profile concept note
2025 federal use case inventory
AI Safety Governance Framework 2.0
Last verified: October 2026