NIST AI Risk Management Framework (AI RMF 1.0)
An Ethotechnics critique of the NIST AI RMF: voluntary, it asks for feedback, monitoring, and impact mapping and lets the operator decide what counts as done.
Ethotechnics critique
Where the framework falls short
The RMF organizes risk management inside an organization. The gaps are in what it asks that organization to show anyone outside it.
- Feedback has no deadline and no record. The RMF is voluntary. It asks organizations to regularly incorporate adjudicated feedback into system design (GOVERN 5.2), but sets no deadline and names no record that shows a given piece of feedback changed the design.
- Authority to run does not expire. It asks for post-deployment monitoring plans, including appeal and override (MANAGE 4.1), and processes to decommission a system safely (GOVERN 1.7). Nothing sets a date on which the authority to keep running lapses unless it is renewed on evidence.
- Impacts are characterized, not counted. It asks organizations to characterize impacts on individuals and communities (MAP 5). It does not ask them to measure, while the system runs, the time and effort it costs those people, or to publish that measure.
Failure mode
Excellent process evidence + slow repair
The harmed person still carries the time and coordination burden.
The failure mode is a well-documented process that still leaves people exposed while the institution “manages risk” on a slow clock.
Subcategories to clauses
Where an Ethotechnics clause answers a subcategory
Each row names the subcategory, the clause that bears on it, and what the clause requires that the subcategory leaves open.
| Subcategory | What it asks | Clause | What the clause adds |
|---|---|---|---|
| GOVERN 5.2 | Mechanisms to regularly incorporate adjudicated feedback from relevant AI actors into system design and implementation. | STD-07 §4.2 | An objection accepted on the declared channel gets a revision or a reasoned refusal, itself a record, within the reversal clock. The feedback has a deadline and a record of what it changed. |
| GOVERN 1.7 | Processes and procedures for decommissioning and phasing out AI systems safely. | STD-06 §5.6 | The withdrawal path is rehearsed on a published cadence and before any expansion, and the rehearsal reports what it showed at the technical, operational, and institutional levels. |
| MANAGE 2.4 | Mechanisms applied, and responsibilities assigned, to supersede, disengage, or deactivate AI systems whose outcomes are inconsistent with intended use. | STD-06 §1.3 , STD-06 §2.3 | One accountable owner who can halt the deployment, not a committee that can recommend halting it. Time to halt is measured against a clock, not attested by the team that owns the control. |
| MAP 5.1 | The likelihood and magnitude of each identified impact are identified and documented. | STD-01 §7.1 | The time a system costs the public is measured, not only characterized, and published on a schedule. |
| None | No subcategory sets a date on which the authority to keep running lapses. | STD-08 §1.1 , STD-08 §1.2 | Authority is a grant that expires. Renewal needs evidence named before the review period, and a quiet period alone does not renew it. |
Subcategory text from NIST AI 100-1, paraphrased. The framework map lists the subcategories each Ethotechnics control cites.
Cite this page · APA, MLA, Chicago, BibTeX, RIS
APA
Ethotechnics Institute. (2026). NIST AI Risk Management Framework (AI RMF 1.0). Ethotechnics Institute. https://ethotechnics.org/standards/critiques/nist-ai-rmf
MLA
Ethotechnics Institute. "NIST AI Risk Management Framework (AI RMF 1.0)." Ethotechnics Institute, 2026, https://ethotechnics.org/standards/critiques/nist-ai-rmf.
Chicago
Ethotechnics Institute. "NIST AI Risk Management Framework (AI RMF 1.0)." Ethotechnics Institute. Oct 6, 2026. https://ethotechnics.org/standards/critiques/nist-ai-rmf.
BibTeX
@misc{ethotechnics_standards_critiques_nist_ai_rmf,
title={NIST AI Risk Management Framework (AI RMF 1.0)},
author={Ethotechnics Institute},
year={2026},
howpublished={Ethotechnics Institute},
url={https://ethotechnics.org/standards/critiques/nist-ai-rmf},
version={v1.2.0}
}
RIS
TY - WEB TI - NIST AI Risk Management Framework (AI RMF 1.0) AU - Ethotechnics Institute PY - 2026 UR - https://ethotechnics.org/standards/critiques/nist-ai-rmf ER -