NIST AI RMF 2.0: what NIST has actually said about a new version

What NIST has said, with dates

1. 26 January 2023. NIST releases AI RMF 1.0 (NIST AI 100-1). Its front matter says a review with formal input from the AI community is expected no later than 2028, and that major revisions change the first number of the version (1.0 to 2.0) while minor ones add “.n” (1.1).
2. 30 March 2023. NIST announces the first complete version of the AI RMF Playbook, covering all four functions.
3. 26 July 2024. NIST releases the Generative AI Profile (NIST AI 600-1), a companion to AI RMF 1.0. It is a profile, not a new version of the framework.
4. 23 July 2025. America's AI Action Plan recommends that the Department of Commerce, through NIST, revise the AI RMF to eliminate references to misinformation, Diversity, Equity, and Inclusion, and climate change.
5. 7 April 2026. NIST releases a concept note for an AI RMF Profile on Trustworthy AI in Critical Infrastructure and opens a community of interest. Again a profile built on the framework, not a revision of it.
6. 10 June 2026. NIST's Playbook page, last updated on this date, says the Playbook will be updated after AI RMF 1.0 is revised.
7. 13 August 2026. NIST's AI RMF FAQ, last updated on this date, answers “When will the Framework be updated?”: it says the AI Action Plan tasked NIST with revising AI RMF 1.0.
8. 1 October 2026. When we checked, NIST's AI RMF page said AI RMF 1.0 “is being revised as part of the White House AI Action Plan”, and the AIRC roadmap page said a revised version is in progress. Neither page listed a draft of the revision, a version number or a release date.

Source: NIST AI 100-1, Artificial Intelligence Risk Management Framework (AI RMF 1.0), January 2023; NIST, AI Risk Management Framework (programme page); NIST, AI RMF FAQs (updated 13 August 2026); NIST, NIST AI RMF Playbook page (updated 10 June 2026); NIST AIRC, Roadmap for the AI RMF; The White House, America's AI Action Plan, July 2025; NIST AI 600-1, Generative Artificial Intelligence Profile, July 2024; NIST, Concept Note: AI RMF Profile on Trustworthy AI in Critical Infrastructure (updated 17 July 2026) (checked 1 October 2026).

Will the revision be called 2.0?

Nobody outside NIST knows yet. The framework itself explains the numbering: the first number is the "generation" of the AI RMF and its companion documents and changes only with a major revision; minor revisions add ".n" after it (1.1, 1.2). All changes are to be tracked in a version control table. So a substantial rewrite would be 2.0, and a narrower edit could be 1.1. NIST has not said which this revision will be, and none of its pages uses the name "AI RMF 2.0".

The same front matter also set a schedule: NIST would review the framework regularly, with a review including formal input from the AI community expected "no later than 2028". The revision announced under the AI Action Plan is happening earlier than that.

Source: NIST AI 100-1, Artificial Intelligence Risk Management Framework (AI RMF 1.0), January 2023 (checked 1 October 2026).

What is expected to change

The only change NIST has been publicly directed to make is in America's AI Action Plan (July 2025), which recommends revising the AI RMF "to eliminate references to misinformation, Diversity, Equity, and Inclusion, and climate change". NIST has not published revised text, so it is not known how any category or subcategory will read afterwards.

For orientation only, here is where AI RMF 1.0 currently touches those topics in the Core. GOVERN 3 reads: "Workforce diversity, equity, inclusion, and accessibility processes are prioritized in the mapping, measuring, and managing of AI risks throughout the lifecycle.". GOVERN 3.1 refers to "a diverse team (e.g., diversity of demographics, disciplines, experience, expertise, and backgrounds)", and MEASURE 2.12 covers the "environmental impact and sustainability of AI model training and management activities". We are not predicting what NIST will do with them; the point is that if you have mapped evidence to these subcategories, check them first when the revision appears.

Everything else in the Core (governance, context, testing, monitoring, third-party risk, incident response) is not mentioned in the Action Plan recommendation. NIST's other published plans point the same way: its Roadmap priorities are alignment with international standards, test and evaluation methods, profiles, guidance on trade-offs and risk tolerance, and measuring how well the framework works, and its newest work is profiles that build on the framework (generative AI in 2024, critical infrastructure from April 2026) rather than replacing it.

Source: The White House, America's AI Action Plan, July 2025; NIST AIRC, AI RMF Core (Tables 1–4 of AI RMF 1.0); NIST AIRC, Roadmap for the AI RMF; NIST, Concept Note: AI RMF Profile on Trustworthy AI in Critical Infrastructure (updated 17 July 2026) (checked 1 October 2026).

What to do in the meantime

1. Keep using AI RMF 1.0. It is the current NIST framework. Customers and auditors asking for "NIST AI RMF alignment" mean 1.0.
2. Organise evidence by subcategory ID, not by page of a PDF. If your evidence is filed under GOVERN 1.1, MAP 5.1 and so on, a revision means re-mapping a list, not rewriting your programme. The Playbook action plan is laid out that way.
3. Record your Current Profile now. Rate yourself on the maturity check and keep the report. When the revision lands you can see exactly which ratings it affects.
4. Don't wait for 2.0 to start ISO/IEC 42001 work. The overlap between the AI RMF categories and ISO/IEC 42001 (see the crosswalk by clause) does not depend on the revision.
5. Watch the source. NIST announces AI RMF changes on its AI RMF page and the AI Resource Center, and accepts comments at [email protected].