NIST's AI Risk Management Framework page says AI RMF 1.0 is being revised. It also identifies an April 7, 2026 concept note for a profile on trustworthy AI in critical infrastructure. These are important developments, but a revision process is not the same as a replacement framework already finalized.
Maintain a stable operating baseline
Continue using the current framework and relevant published profiles where they fit your organization. Record which version informed your controls. Avoid quietly mixing draft language into a policy that claims to follow a final standard.
The framework is intended for voluntary use. Referencing it does not by itself establish legal compliance or confer a NIST certification.
Plan for change without freezing delivery
Assign someone to monitor official updates and identify which changes could affect your risk assessment, documentation, or review process. Evaluate a draft as an input to planning, not an automatic instruction to rewrite every procedure.
For critical infrastructure, distinguish a concept note's intended direction from detailed requirements that may emerge later.
Review the substance of your controls
Can the organization identify its AI systems, describe who may be harmed, measure relevant failures, and respond when a deployment behaves unexpectedly? Those practical questions remain useful while standards evolve.
Keep a short decision record when adopting new guidance: what changed, why it matters, which systems are affected, and who owns the response. Standards monitoring should improve risk management, not become a reason to delay basic oversight until the next document is published.
Sources & further reading
Reviewed October 26, 2026. Product availability and regulatory guidance can change. Vendor performance claims are not independent Rovio AI benchmarks.
Found this useful? Share it.