Financial institutions are adopting AI faster than they are governing it, and the request we now hear on calls is specific: "we need a credible AI governance framework, and we think it is the NIST AI RMF. Where do we start?" Boards are asking for a baseline, examiners are asking AI questions through existing lenses, and nobody wants to invent a framework from scratch.
The NIST AI Risk Management Framework is the right answer, and it comes with one catch this guide will fix: it tells you what to do but almost never how. Here is the whole framework in plain language, where it actually requires a risk assessment, and how to run one at a bank or credit union.
Quick answer: The NIST AI RMF organizes AI risk management into four functions: Govern (policies, accountability, risk tolerance), Map (inventory your AI systems and their context), Measure (assess likelihood and impact of AI risks), and Manage (prioritize and treat them). For a financial institution, the practical path is: build an AI inventory including vendor AI features, adopt an AI security policy, run a risk assessment scoped to the four functions, score the gaps, and turn the results into a written benchmark and roadmap the board can act on.
Built for lean security teams at credit unions and banks
Definition: The NIST AI Risk Management Framework (AI RMF 1.0) is a voluntary framework published by NIST in January 2023 for managing the risks of designing, developing, deploying, and using AI systems. It defines risk the same way the rest of risk management does: the probability of an event combined with the magnitude of its consequences.
Two things make it the natural choice for financial institutions. First, it is NIST, and your examiners, auditors, and board already trust the name from the Cybersecurity Framework. The NCUA's own website currently points institutions to the NIST AI RMF, and on our annual RISO panel, examiners named NIST and CISA frameworks as the ones they lean on themselves. Second, it is structured like the risk work you already do, so it extends your program rather than starting a new one. In practice, AI risk enters an existing risk model in one of three ways: as a capability added to a system you already assess, as a new discrete system, or as a change to the risk elements you already measure, like new data types or shifted likelihoods. Framing it that way, which is the model in our Definitive Guide to Managing AI Risk, keeps AI inside the program instead of spawning a parallel one. The AI RMF is not a regulation and no agency mandates it yet, but it is the standard examiners and courts will reach for when they ask what reasonable AI governance looked like.
Govern is the foundation the other three functions sit on. It asks for AI policies and procedures, defined roles and accountability, workforce awareness, and a documented risk tolerance for AI. GOVERN 1.3 says it directly: risk management activity should scale to your documented risk tolerance. For a credit union, this function usually translates into three artifacts: an AI security policy, an accountable owner or committee, and a statement of what AI uses you will and will not accept.
Map is the inventory function. You cannot govern AI you have not found, and at most institutions the honest inventory is longer than anyone expects, because AI arrives inside vendor products between reviews. Map asks you to catalog each AI system, its purpose, its context, who it affects, and, in MAP 5.1, to identify and document the likelihood and magnitude of each potential impact. That subcategory is the closest thing in the framework to a classic risk assessment requirement, and it is where most first-time assessments start.
If you have not built the inventory yet, start with our guide to finding the shadow AI already inside your institution. It covers the three discovery sources that catch what a survey alone misses.
Measure turns the inventory into assessed risk. MEASURE 1.1 asks you to select approaches and metrics for the AI risks you mapped, starting with the most significant. This is the function that intimidates teams, because AI risks feel new and historical data feels thin. The next section covers how to score anyway.
Manage closes the loop. MANAGE 1.2 requires prioritizing risk treatment by impact, likelihood, and available resources, and MANAGE 1.3 gives you the same four responses as any risk program: mitigate, transfer, avoid, or accept. The output examiners and boards want from this function is simple: a prioritized roadmap with owners and dates.
One requirement threads through Measure and Manage that deserves its own mention: ongoing testing, evaluation, verification, and validation, TEVV in the framework's language. AI models drift as training, inputs, and underlying data change, so a rating set at deployment goes stale in a way a firewall rating does not. Plan for continuous testing of accuracy and behavior, and plan for the business to be involved, because the branch staff and power users are the ones who notice a wrong answer, not IT. Examiners are heading the same direction: expect exams to ask how the business, not just IT, validates AI outputs.
Worth stating plainly, because the framework never says "now perform a risk assessment" in one place. The requirement is assembled from three subcategories: MAP 5.1 (identify and document likelihood and magnitude of each impact), MEASURE 1.1 (measure the enumerated risks, most significant first), and MANAGE 1.2 (prioritize treatment by impact and likelihood). Put together, that is a risk assessment. What the framework does not give you is a method, which is why teams stall here.
The objection is fair: there is no twenty-year loss history for chatbot hallucinations. But cyber risk quantification solved this problem years ago, and the same discipline applies.
Anchor what you can in published data. Breach frequency and cost data from sources like the Verizon DBIR and the IBM cost-of-a-breach research still govern the data-exposure side of AI risk, because a model leaking member data is still a data breach. For the newer failure modes, decompose the risk into parts you can estimate: how often the system runs, what fraction of outputs could be wrong, what a wrong output costs when it reaches a member or a loan decision. Calibrated ranges beat false precision, and a Monte Carlo simulation across those ranges produces a defensible dollar figure with honest uncertainty attached.
That is the dollar move that makes AI governance land with a board. "Our member-facing chatbot carries a modeled expected annual loss of $180,000, driven by response accuracy" starts a budget conversation. "AI risk: high" ends one. If you want the full argument for why quantified numbers hold up, we made it in Is a Quantified Cyber Risk Number Defensible?
Our team has run dozens of these assessments with financial institutions, and Rivial Software is built around this exact flow: the AI inventory, the framework assessment, and the scoring live in one place, gaps become tracked findings with owners, and the whole thing rolls up into the same dollar-denominated risk reporting your board already sees for cyber risk. AI governance stops being a side project and becomes another view of the risk program.
After enough of these, the pattern is consistent. Expect to find: an inventory that misses vendor-embedded AI features, no documented AI risk tolerance, an acceptable-use policy but no AI security policy, no committee or named owner for AI decisions, vendor contracts silent on training data and model changes, and no incident plan for an AI failure that is not a breach, like a model making a wrong decision about a member. None of these are expensive to fix. All of them are uncomfortable to have found by an examiner first.
Worth knowing what the exam version of this looks like, because it is already happening. We have seen examiners request everything from an AI acceptance policy at minimum up to full AI inventories, and the evidence set that satisfies them maps exactly to the gaps above: the policy and acceptable-use updates, a committee charter, the inventory, and samples of AI risk assessments and vendor AI reviews. A team that can say "we are tracking 44 AI use cases" has already changed the tone of the conversation.
The fastest way to start is to see where you stand. Our free NIST AI RMF Gap Assessment benchmarks your current program against the four functions and hands you the prioritized gap list, so your roadmap starts from evidence instead of guesswork. No cost, and no sales call required to get your results.
Here are the key takeaways from this blog:
Built for lean security teams at credit unions and banks