# NIST AI RMF: How Growth Companies Selling to the US Meet American Customers' AI Requirements

> NIST AI RMF is showing up in US procurement checklists. How growth companies meet it alongside the EU AI Act with a working system, not slides.

- Published: 2026-09-21
- Author: Master Mind
- Canonical: https://aimaster.fi/en/artikkelit/nist-ai-rmf-nain-usahan-myyva-kasvuyritys-vastaa-amerikkalaisen-asiakkaan-tekoal

NIST, the US National Institute of Standards and Technology, released version 1.0 of its Artificial Intelligence Risk Management Framework (AI RMF) on 26 January 2023 (NIST, 2023). Three years later, it is showing up in a growing number of American buyers' security and procurement questionnaires — including for Finnish SaaS and technology companies selling into the US.

The problem is not that the framework is unfamiliar. The problem is that it gets mixed up with the EU AI Act, even though the two are fundamentally different: one is binding law, the other a voluntary framework. A growth company selling into both markets needs an answer for both — not two separate projects.

## What is NIST AI RMF?

NIST AI RMF (Artificial Intelligence Risk Management Framework) is a voluntary framework published by NIST, an agency of the US Department of Commerce, to help organizations manage risks tied to AI systems from design through deployment (NIST, January 2023). It is not a law. It is a standard that American companies increasingly require from vendors as a contractual condition — much like ISO 27001 in security.

In July 2024, NIST published a dedicated generative AI profile, NIST-AI-600-1, addressing risks specific to generative models (NIST, July 2024). This shows the framework is actively maintained — NIST updates it as AI risks evolve.

## What four functions make up AI RMF?

AI RMF organizes AI risk management into four interconnected functions: Govern, Map, Measure, and Manage. Govern covers organizational accountability and policy. Map identifies the context in which a system is used and the risks it introduces. Measure assesses those risks quantitatively. Manage prioritizes and remediates the risks found.

Of the four, Govern is the foundation — NIST describes it as the function that cuts across and supports the other three. In practice: before a company can map or measure AI risk, it needs clear ownership of who is accountable for what.

## Why is an American customer asking you about this?

The US has no comprehensive AI law equivalent to the EU AI Act. In its place, buyers build their own requirements on top of NIST AI RMF, since it is the only widely recognized, free, and vendor-neutral framework on the market. When an American enterprise customer buys software with an AI feature, its own security and procurement team increasingly asks: how do you manage AI risk in line with the RMF?

This is not regulation you can sidestep by pointing out you're Finnish. It's a commercial condition that decides whether the deal moves forward. Most AI projects don't fail because of the technology — they fail because nobody did the homework before the buyer's legal team asked for it.

## How does NIST AI RMF relate to the EU AI Act?

The EU AI Act is binding regulation with penalties for non-compliance. NIST AI RMF is a voluntary framework with no regulatory enforcement. Both, however, follow the same logic: identify the risk, document it, manage it, monitor it continuously. A company that has already completed the risk classification and documentation the EU AI Act requires has done most of the NIST work too — the structure differs, the substance is nearly identical.

| Feature | EU AI Act | NIST AI RMF |
| --- | --- | --- |
| Nature | Binding regulation | Voluntary framework |
| Enforcement | National market surveillance authorities | No regulatory enforcement |
| Scope | Systems placed on the EU market | Any organization using AI |
| Structure | Risk tiers (prohibited, high, limited, minimal) | Four functions (Govern, Map, Measure, Manage) |
| Consequence of non-compliance | Administrative fine | Loss of commercial contract |

## How does a growth company build a practical response?

The first step isn't writing a document — it's mapping: where AI is actually used in the product, and what risk it introduces for the customer. This maps directly onto the RMF's Map function, and it's the same work we do in our [Master Plan](https://aimaster.fi/tuotteet/master-plan) sprint: mapping where AI creates value and what it demands, measured in euros and in risk.

After mapping, data needs to be consolidated so risk can actually be measured continuously, not just reported once. That's the technical precondition for the Measure and Manage functions, and it's why we've written before about [preparing document data for an AI agent's RAG pipeline](https://aimaster.fi/en/artikkelit/dokumenttidata-ei-ole-viela-tietoa-nain-kasvuyritys-rakentaa-ocr-ja-pilkkomisput) — fragmented data can't produce continuous risk monitoring.

The Govern function requires a named owner. Without one, Map, Measure, and Manage remain one-off exercises that get forgotten until the next customer questionnaire arrives. Once AI runs in production as an agent, you also need a technical oversight layer — that's what [Master Mind](https://aimaster.fi/tuotteet/master-mind) does: agents run on top of Master Layer's data in a controlled, traceable way, with a human in the loop.

## What evidence should you give an American buyer?

A written description rarely suffices. The buyer's security team wants to see a concrete map: which AI components exist in the product, what data they can access, who monitors them, and how anomalies are detected. This is the same work we've productized into a 3-day sprint model — the first concrete answer arrives quickly, not after months of discovery.

## Should a growth company pursue NIST AI RMF certification?

NIST AI RMF is not a certification scheme, and it cannot be obtained as a certificate. NIST explicitly states the framework is intended for voluntary use to guide risk management, not for audits. Instead, a company demonstrates alignment by documenting how it covers the four functions — that document is what an American buyer typically requests.

## Is NIST AI RMF mandatory for a Finnish growth company?

Not directly. NIST AI RMF isn't law in Finland or the EU, and it doesn't replace EU AI Act obligations. It becomes practically mandatory when an American customer or partner requires it as a contract condition — and that has become common in enterprise software deals since 2024.

## Does EU AI Act documentation also cover a NIST response?

Most of it, but not all. Both frameworks require identifying and documenting risk, but NIST AI RMF places more weight on continuous measurement and organizational governance (Govern), while the EU AI Act focuses on the product's risk tier. A growth company with EU AI Act documentation in place still needs a clear description of who in the organization owns AI risk on an ongoing basis — not just at launch.

## How do you know your response is sufficient for a buyer?

A response is sufficient when it concretely covers all four functions: who owns the risk (Govern), where AI is used and what it affects (Map), how risk is measured continuously (Measure), and how anomalies get fixed (Manage). A generic security overview isn't enough, because the buyer's team compares your answer directly against these four headings.

The first step isn't wording a document — it's building its substance on real data and real processes. Book a [free Master Mind analysis](https://aimaster.fi/analyysi) to map what AI risk management requires in your specific product, and in what order to build it.

## Frequently asked questions

### Is NIST AI RMF mandatory for a Finnish growth company?

Not directly. NIST AI RMF isn't law in Finland or the EU, and it doesn't replace EU AI Act obligations. It becomes practically mandatory when an American customer or partner requires it as a contract condition — common in enterprise software deals since 2024.

### Does EU AI Act documentation also cover a NIST response?

Most of it, but not all. Both require identifying and documenting risk, but NIST weighs continuous measurement and governance (Govern) more heavily, while the EU AI Act focuses on product risk tier. Existing EU documentation still needs a clear description of who owns AI risk on an ongoing basis.

### Should you pursue NIST AI RMF certification?

You can't, because it isn't a certification scheme. NIST states the framework is meant to guide voluntary risk management, not audits. Alignment is demonstrated by documenting how you cover the four functions: Govern, Map, Measure, Manage.

### What four functions make up NIST AI RMF?

Govern (accountability and policy), Map (context and risk identification), Measure (quantifying risk), and Manage (prioritizing and remediating risk). Govern is the foundational function that NIST describes as supporting the other three.

### How do you know your response is sufficient for a US buyer?

It's sufficient when it concretely covers all four functions: who owns the risk, where AI is used, how risk is measured continuously, and how anomalies get fixed. A generic security overview falls short because buyers compare your answer against these exact four headings.