NIST says it is revising its AI Risk Management Framework 1.0. Its framework page also records an April 7, 2026 concept note for an AI risk management profile focused on critical infrastructure. These are developments in NIST’s framework work; they should not be described as a completed new framework or a certification for a particular product.
Source: NIST’s AI Risk Management Framework page, reviewed for this brief.
The buying question remains practical
Our view: a developing framework is a reason to improve the questions in a requirements brief. It is not a reason to delay every useful pilot, and it does not establish that a vendor’s product is suitable for your business.
Before a provider demonstration, ask the team to describe the workflow, the information involved and the person responsible for the result. That gives the discussion a concrete starting point.
Four questions to take into the conversation
- What is the system allowed to do? Distinguish drafting or recommendations from actions that change records or reach customers.
- What information will it use? Ask about permitted data, access, storage and deletion responsibilities.
- How will you test the result? Agree review criteria and include difficult cases in the pilot.
- What happens when it fails? Identify the escalation route, human reviewer and fallback process.
Separate evidence from a claim
If a provider refers to a framework, ask which practices it has implemented and what evidence it can share. A reference in a presentation is a starting point for follow-up. Your requirements and review process still need to address the way your team will use the system.
For a broader, lasting buying checklist, read Before buying an AI tool, define the work it needs to do. For a live requirement, bring the workflow and constraints to an introductory technology conversation.