NIST AI RMF · Companion guidance

The NIST AI RMF Playbook explained

Updated 6 July 2026 · 5 min read

Key takeaway

The Playbook is NIST's companion to the framework: for each function and subcategory it offers suggested actions, references and documentation prompts. The framework says what outcomes to aim for; the Playbook suggests how, without adding obligations. It is voluntary, and you take from it what fits.

The Playbook is companion guidance on the NIST AI Resource Center, mapped one to one onto the framework's subcategories.
It is entirely voluntary and offers suggested actions, not obligations.
Do not attempt it end to end: prioritise the subcategories carrying your highest risk and use the Playbook's prompts there.
Think in three layers: framework (structure), Playbook (suggested practice), profile (lens for a particular technology).
General information, not legal advice. Current as of July 2026.

What the Playbook is

The AI RMF 1.0 defines the four functions, Govern, Map, Measure, Manage, and the categories and subcategories beneath them, but it deliberately stays at the level of outcomes. The Playbook, hosted on the NIST AI Resource Center, sits underneath that structure and, for each subcategory, suggests concrete actions an organisation might take, documentation it might keep, and references it might consult. It is guidance about guidance: entirely voluntary, and meant to be filtered to your context.

How it is organised

The Playbook follows the framework's own spine. Pick a function, say Govern, drill into a subcategory, and the Playbook offers suggested actions phrased as practical steps, along with prompts for what to record and pointers to related standards. Because it maps one to one onto the framework's structure, you can adopt the framework as your skeleton and use the Playbook to flesh out whichever subcategories matter most to you first.

How to actually use it

Do not attempt the Playbook end to end; it is a reference, not a checklist to complete. The productive pattern is to prioritise the subcategories that carry your highest risk, read the Playbook's suggested actions for those, and adopt the ones that fit your size and sector, recording what you did and why. A ten-person company and a bank will take very different actions from the same subcategory, and both are using the Playbook correctly. The value is in the prompting, not in exhaustive completion.

Where it fits with everything else

Think of three layers: the framework is the structure, the Playbook is the suggested practice, and any profile, such as the Generative AI Profile, is a lens that prioritises particular risks for a particular technology. Used together they let you govern to a recognised method without inventing your own from scratch, which is precisely why the RMF has spread as far as it has despite being voluntary.

Key terms

Playbook: NIST's companion to the AI RMF: suggested actions, references, and documentation prompts against each subcategory.
Suggested actions: Practical steps the Playbook offers under each subcategory; voluntary, not required.
Subcategory: The most granular level in the AI RMF Core, sitting beneath categories inside each function.
AI Resource Center: NIST's online knowledge base that hosts the AI RMF Core, the Playbook, and related resources.
Voluntary practice: Guidance an organisation chooses to adopt, tailored to its context rather than applied wholesale.

References

Related guides