The NIST AI Risk Management Framework (AI RMF 1.0) is the most widely referenced standard for managing AI risk in the United States, and it is not a law, a regulation, or a certifiable standard. It is voluntary guidance. That combination explains both its rapid adoption and the confusion around it: regulators cite it, enterprise buyers ask about it in security questionnaires, and AI governance programs are built on it, yet no auditor will ever hand you an AI RMF certificate. This article explains what the framework actually contains, how its four core functions work, and where it fits alongside ISO/IEC 42001 and the EU AI Act. What Is the NIST AI RMF 1.0? Background and Purpose of the Framework The AI RMF is a structured approach for identifying, assessing, and managing the risks that AI systems create across their entire lifecycle, from design and data collection through deployment, monitoring, and decommissioning. Its stated goal is to help organizations build and use AI systems that are trustworthy: valid, reliable, safe, secure, accountable, transparent, explainable, privacy-enhanced, and fair. The framework treats AI as a socio-technical system, meaning risk does not come from models and data alone. It also comes from how