NIST AI Risk Management Framework

The NIST AI Risk Management Framework, or AI RMF 1.0, is a voluntary framework published by the US National Institute of Standards and Technology in January 2023. It is not an accessibility standard and it is not law. It is useful here because it gives a clear shape for the ongoing governance that accessible AI needs, and accessibility fits neatly inside it as one of the risks you manage.

Key points

The NIST AI RMF is a voluntary US framework, not law, and accessibility fits inside it as one of the risks you manage.
Accessibility runs through its trustworthy-AI traits, since a system that excludes disabled users is not fair and one that hides uncertainty is not transparent.
Its four functions are Govern, Map, Measure, and Manage, and they repeat continuously rather than run once.
Those functions match this site’s evaluation loop, so a model or prompt change is a trigger to run them again.
Govern is the highest-leverage move, naming accessibility as a tracked risk with an owner like security or privacy.

Trustworthy AI characteristics

NIST describes a set of traits that trustworthy AI should have. A system should be valid and reliable, safe, secure and resilient, accountable and transparent, explainable and interpretable, privacy-enhanced, and fair with harmful bias managed. Accessibility runs through several of these at once. A system that excludes disabled users is not fair. A system that hides its uncertainty is not transparent. A model that scores disability-related language as more negative, as researchers at Penn State found, is carrying exactly the kind of harmful bias the framework asks you to manage.

The four functions

The framework is built around four functions that run continuously rather than once. They are meant to repeat as the system and its context change.

Govern. Set the culture, roles, and policies for managing AI risk. For accessibility, this means naming it as a real risk with an owner, not leaving it as an afterthought.
Map. Understand the context and who could be affected. Identify your disabled users and the ways the system could exclude them. Microsoft’s Inclusive Tech Lab offers a prompt that uses AI to brainstorm potential barriers, grouped by whether content is perceivable, operable, or understandable, as candidates to validate with real people.
Measure. Assess and track the risk with real methods. For accessibility this is the testing loop of automated checks, manual testing, real assistive technology, and real users. See Testing methodology.
Manage. Act on what you find and keep watching. Feed fixes back into prompts, guardrails, and rendering, and re-test after a model or prompt change.

Why this maps onto accessibility

The evaluation loop from the foundations of this site has the same shape as Map, Measure, and Manage running on a schedule. Because AI output is generated fresh each time and shifts when the model or prompt changes, accessibility is something you keep true rather than certify once. Treating a model or prompt change as a trigger to run the loop again is the practical heart of both the NIST framework and this site’s approach.

Explainability

NIST has also published four principles for explainable AI in a companion document. An explanation should be given, it should be meaningful to the person receiving it, it should accurately reflect how the system reached its result, and the system should stay within the limits of what it can reliably explain. These connect directly to the Understandable principle and to the work of communicating uncertainty. An explanation that a screen reader user cannot perceive is not meaningful to them. See WCAG Understandable and Decision outputs.

Audience: Product Manager

The most useful move the framework suggests is Govern. Name accessibility as a tracked AI risk with a named owner, the same way you treat security or privacy. That single decision is what turns accessibility from a launch-day scramble into something that gets mapped, measured, and managed on a schedule. The framework is voluntary, but it gives you a recognized structure to point at when you argue for the budget and the owner.

Audience: Accessibility Specialist

Read Measure as your home. The framework gives you language to argue that accessibility measurement for a generative system has to be ongoing and sampled, not a one-time audit, because the output is a moving population. Tie your testing plan to the Manage function so that a model change, a prompt change, or a new data source triggers a fresh measurement, and document that trigger so it is not forgotten.

Audience: Engineer

Manage is where the work lands for you. Build the re-test triggers into the same pipeline that ships model and prompt changes, so an accessibility check runs whenever generation behavior could shift. The enforcement-prompt approach, where a reusable instruction makes an AI coding tool check keyboard access, focus, and labeling as it generates, is one concrete way to push fixes back into the loop early.