At a Glance
The NIST AI RMF is a voluntary framework that sorts AI risk work into four functions: Govern, Map, Measure and Manage. A mid-market company makes it real by tying each subcategory to a control that produces evidence. On a lakehouse, that means Unity Catalog lineage, attribute-based access, audit system tables, MLflow records and a governed AI gateway.
- Cost: most controls ship with the platform you already pay for; the spend is engineering time and named owners.
- Effort: a 400-person company can cover the high-value subcategories with about five part-time owners, not a new department.
- Risk: the RMF is not a law, so the danger is a binder nobody runs, not a fine.
- Fit: it pays off first where AI touches customer data, a consequential decision or an agent with tool access.
NIST released AI RMF 1.0 on 26 January 2023, as a voluntary structure for managing AI risk. It carries no penalty. What it carries is vocabulary: when a customer questionnaire asks about “GOVERN 1.6” or “MANAGE 2.4,” you either have an answer backed by data or you have a paragraph.
Eighteen months later, on 26 July 2024, NIST added the Generative AI Profile, NIST AI 600-1, which names 12 risks that generative AI creates or makes worse. Confabulation, data privacy, information security and value chain integration are the four a data team meets first.
The trouble for a mid-market company is that most RMF guidance assumes headcount you do not have: an AI ethics board, a model risk team, a dedicated internal audit function. You have a data platform lead, a security lead, counsel on retainer and an operations executive who owns the AI budget. The map below is written for that team.
How Is This Different From a General AI Governance Program?
We already published an eight-control program in our AI governance framework, with each control tagged to an RMF function. That answers “what should we build.” This article answers the next question a reviewer asks: “show me, subcategory by subcategory, where the evidence lives.”
By our count of the listing on the NIST AI Resource Center, the RMF Core has 19 categories and 72 subcategories across the four functions. You do not need all of them on day one. NIST says framework users apply the functions “as best suits their needs” given their resources. For a data-platform-led company, about 16 subcategories carry most of the weight, because they describe things a data platform either records or does not.
Which RMF Subcategories Map to Which Lakehouse Controls?
The table is our mapping, not NIST’s. NIST does not name tools. The subcategory wording is paraphrased from the AI Resource Center; the control and evidence columns are what we build on Databricks.
| RMF subcategory | What it asks for | Lakehouse control | Evidence a reviewer can see | Owner at 400 people |
|---|---|---|---|---|
| GOVERN 1.1 | Legal and regulatory requirements are understood and documented | Governed tag on each AI system naming the rules that apply to it | Query of systems by applicable rule | Counsel |
| GOVERN 1.6 | Mechanisms to inventory AI systems | Models in Unity Catalog plus an agent inventory Delta table | One list of models, versions, agents and owners | Data platform lead |
| GOVERN 1.7 | Safe decommissioning of AI systems | Retire flag on the inventory row, grants revoked by job, model alias removed | Retired systems with revoke timestamps | Data platform lead |
| GOVERN 2.1 | Roles and responsibilities are documented | Object owners set to groups, business-owner governed tag | Owner per table, model and agent | AI risk owner |
| GOVERN 6.1 | Policies for third-party AI risk | External models and MCP servers routed through Unity AI Gateway only | Gateway endpoint list with approved providers | Security lead |
| MAP 1.1 | Intended purpose, users and context documented | Purpose, users and decision type columns on the inventory row | System card generated from the inventory | Business owner |
| MAP 2.2 | Knowledge limits and human oversight documented | Model description and limitations stored with the registered model version | Version-level documentation | Model owner |
| MAP 4.1 | Risks of components, including third-party data, mapped | Automatic column-level lineage from source to feature table to model | Lineage graph per model input | Data platform lead |
| MEASURE 1.1 | Metrics selected for the most significant risks | Metric definitions in a governed control table | Metric list with thresholds | AI risk owner |
| MEASURE 2.1 | Test sets, metrics and tools documented | MLflow evaluation runs linked to a versioned gold-layer test set | Run history with dataset version | Model owner |
| MEASURE 2.4 | Behavior monitored in production | Gateway traces landed in Delta tables and read by a monitoring job | Drift and error trend on a dashboard | Model owner |
| MEASURE 2.7 | Security and resilience evaluated | Gateway guardrails for PII and prompt injection, rate limits | Blocked-request counts by endpoint | Security lead |
| MEASURE 2.10 | Privacy risk examined | ABAC column masks and row filters driven by governed tags | Policy list and masked-column coverage | Security lead |
| MANAGE 2.4 | Ability to disengage or deactivate a system | Gateway endpoint disable plus service principal revoke, rehearsed | Drill log with time to disable | Security lead |
| MANAGE 4.1 | Post-deployment monitoring, appeal, incident response | Decision record table written by the scoring job, appeal status column | Per-decision record with reviewer | Business owner |
| MANAGE 4.3 | Incidents tracked, communicated and recovered | Audit events from system.access.audit copied to a retained table | Who read, changed or granted what, and when | Security lead |
Four facts hold that table together. Unity Catalog captures lineage automatically for queries run on Databricks, down to the column level, which is what makes MAP 4.1 a query instead of an interview. Attribute-based access control, governed tags and automated data classification reached general availability on 13 May 2026, according to Databricks’ announcement. Unity AI Gateway reached general availability on 4 August 2026 and governs models, agents, MCP servers and tools with identity-aware access, rate limits, spend caps, guardrails and unified tracing. MLflow records the parameters, metrics and artifacts of each evaluation run. And the audit log system table is in Public Preview with a 365-day default retention.
What Does the Generative AI Profile Add for a Data Team?
NIST AI 600-1 does not replace the Core. It is a companion profile that names generative AI risks and suggests actions against the same four functions. Of its 12 risks, the ones below land on the data platform rather than on the model vendor.
| GenAI Profile risk | Where it shows up in your data | Lakehouse control |
|---|---|---|
| Confabulation | A retrieval step returns stale or wrong gold rows, and the model states them confidently | Freshness checks on retrieval tables, MLflow evaluations against known-correct answers |
| Data Privacy | Prompts and retrieved context carry personal data to a model endpoint | ABAC masks before retrieval, gateway PII guardrail |
| Information Security | An agent with tool access is steered by injected text | Narrow service principal grants, gateway prompt-injection guardrail |
| Value Chain and Component Integration | Third-party models and data enter without traceable origin | Gateway as the only route to external models, lineage on every ingested source |
| Intellectual Property | Licensed content is indexed for retrieval without a record of its terms | License governed tag on source tables, filter in the retrieval query |
| Human-AI Configuration | Staff accept agent output without review | Reviewer field in the decision record, sampled review metric |
NIST’s agent work is still forming. Its Center for AI Standards and Innovation launched an AI Agent Standards Initiative on 17 February 2026, organised around industry standards, open protocols and agent identity and security research. It has not published binding standards, so treat agents as AI systems under the existing Core for now.
Where Do RMF Programs Stall in a Mid-Market Company?
The inventory lives in a spreadsheet
GOVERN 1.6 is the subcategory everything else hangs on, and it is usually a spreadsheet updated before an audit. A spreadsheet drifts the week after it is filled in. The fix is to make registration the deployment path: a model that is not in Unity Catalog cannot be served, and an agent without an inventory row cannot get a service principal. Then the inventory is a byproduct of shipping, not a chore.
Measurement starts before the process is stable
Teams pick MEASURE metrics for a workflow nobody has mapped. As a Lean Six Sigma Master Black Belt, I see the same defect in AI programs that I saw on factory floors: you cannot set a control limit on a process with no baseline. Map the decision, measure the human error rate today, then measure the model against it. Our mid-market AI readiness assessment covers that baseline step.
Third-party AI sits outside the catalog
GOVERN 6 and MANAGE 3 fail when a team wires a SaaS assistant straight to the CRM with a personal API key. Lineage stops at the catalog boundary, and so does every control in the table. Route external models through the gateway, and treat MCP-server governance there as Beta until your current release notes say otherwise.
Nobody has pulled the plug in practice
MANAGE 2.4 asks for the ability to disengage a system. Most teams believe they could. Few have timed it. Run a quarterly drill: disable the gateway endpoint, revoke the agent’s service principal, confirm the dependent job fails cleanly, and record the minutes it took.
Audit retention is assumed, not checked
The audit system table defaults to 365 days and is still Public Preview. If a contract or a state rule asks for longer, copy the events you need into your own Delta table on a scheduled job, as our data lineage guide describes for lineage records.
How Should a 400-Person Company Staff and Sequence the Work?
Five part-time roles cover the owner column: an AI risk owner at executive level (GOVERN 2.3 asks leadership to take responsibility), a data platform lead, a security lead, counsel and one business owner per AI system. Meet monthly for 45 minutes and review one dashboard built from the control table.
Sequence it in three passes. First, inventory and ownership: GOVERN 1.6, 1.7 and 2.1. Second, access and lineage: MAP 4.1, MEASURE 2.10 and GOVERN 6.1. Third, measurement and response: MEASURE 2.1 and 2.4, MANAGE 2.4, 4.1 and 4.3. Each pass produces evidence the next one reads. If you want help building that sequence on Databricks, our AI governance and compliance work starts from your current inventory.
None of this makes you compliant with any law. The RMF is voluntary, and a lakehouse produces evidence, not a verdict. This article is general information, not legal advice; your counsel or a qualified assessor makes the compliance call.
Readiness Signals: When You Are Ready, and When You Are Not
You are ready to adopt the RMF as your operating structure when most of the data feeding your models already sits in Unity Catalog, every production model has a group owner, and you can list your agents without asking around. At that point the table above is a two-quarter build, not a transformation.
You are ready for the GenAI Profile overlay when a retrieval or agent workload is in production or within a quarter of it. Before then, the profile is reading material.
You are not ready if your AI data still moves through exports, personal tokens and shared drives. Consolidate into one governed lakehouse first. Mapping subcategories onto silos produces documents, and the first incident will show that nothing underneath them records what happened.
You are not ready if nobody at executive level will own the AI risk decision. The RMF puts accountability in GOVERN for a reason, and no catalog setting substitutes for it.
Frequently Asked Questions (FAQs)
Is the NIST AI RMF mandatory?
No. NIST published it for voluntary use, and the Generative AI Profile is voluntary too. Companies adopt it because it gives customers, auditors and internal teams one shared structure for AI risk.
What are the four functions of the NIST AI RMF?
Govern, Map, Measure and Manage. Govern is cross-cutting and sets policy, roles and accountability; Map frames context and risk, Measure analyzes and monitors it, and Manage prioritizes and responds.
What is NIST AI 600-1?
It is the Generative AI Profile of the AI RMF, released 26 July 2024. It names 12 risks that generative AI creates or worsens, such as confabulation and data privacy, and suggests actions mapped to the four functions.
Does Databricks map directly to the NIST AI RMF?
NIST does not name tools. Unity Catalog, audit system tables, MLflow and Unity AI Gateway produce the evidence many subcategories ask for, but the mapping is yours to design and defend.
How many subcategories should a mid-market company start with?
Start with the ones a data platform can evidence directly: inventory, ownership, third-party routing, lineage, privacy controls, production monitoring, deactivation and incident records. That is roughly 16, and it expands as the program matures.
How does the RMF relate to ISO/IEC 42001?
The RMF is a voluntary risk framework with no certificate. ISO/IEC 42001 is a management system standard that an external certification body audits against. The same lakehouse controls supply evidence for both.