Two Frameworks, One Gap: How the US Is Structuring AI Governance for Critical Infrastructure

The US is developing a layered AI governance strategy for critical infrastructure, combining the broad NIST AI RMF with the role-specific DHS framework. A new NIST AI RMF Profile for Critical Infrastructure is forthcoming to provide tailored operational guidance.

Sofia Rodriguez

October 20, 2026 · 4 min read

The United States is building a layered, voluntary approach to governing artificial intelligence in critical infrastructure. The foundation is the National Institute of Standards and Technology's AI Risk Management Framework (AI RMF), a broad, industry-agnostic tool for managing AI risks across the full system lifecycle. On top of it sits the Department of Homeland Security's Roles and Responsibilities Framework, which assigns tailored duties to specific players in the AI supply chain. Now NIST is filling the remaining gap: on April 7, 2026, it released a concept note for a dedicated AI RMF Profile on Trustworthy AI in Critical Infrastructure, intended to translate high-level principles into operational guidance for the energy, transportation, financial, and other critical sectors.

NIST AI RMF: A Foundational Approach to Trustworthy AI

The AI RMF, published in 2023 by NIST's Information Technology Laboratory in collaboration with the private and public sectors, was developed to manage risks to individuals, organizations, and society associated with AI. NIST, a non-regulatory agency of the U.S. Department of Commerce, designed the framework to define and promote trustworthiness in AI systems through a repeatable, full-lifecycle approach that organizations can use to unlock AI's benefits while appropriately managing risks.

Its strength is breadth: any organization that designs, develops, deploys, or uses AI systems can adopt it. That breadth is also its limitation. Because the framework is high-level and industry-agnostic, it requires tailoring for specific contexts. Legal analysts at Morrison Foerster characterize it as a "higher-level educational tool" meant to help all kinds of organizations frame AI risks and put governance mechanisms in place—useful, but not a set of sector-specific measures.

NIST AI RMF versus DHS Roles and Responsibilities Framework
Dimension	NIST AI RMF	DHS Roles and Responsibilities Framework
Issuing agency	NIST, a non-regulatory agency of the U.S. Department of Commerce	DHS, developed in collaboration with industry leaders
Primary goal	Define and promote trustworthiness in AI through a repeatable, full-lifecycle risk management approach	Provide tailored recommendations for key players in the AI ecosystem to protect critical infrastructure
Target audience	Organizations of all kinds that design, develop, deploy, or use AI systems	Entities at each layer of the AI supply chain in critical infrastructure: cloud and compute providers, AI developers, and owners and operators
Approach to risk	Flexible, high-level framework for identifying, assessing, and managing AI risks; industry-agnostic and requires tailoring	Role-based recommendations across five areas: securing environments, responsible model and system design, data governance, safe and secure deployment, and monitoring performance and impact

Bridging the Gap: The New NIST AI RMF Profile for Critical Infrastructure

The need for the new profile is well documented. Researchers at Georgetown's Center for Security and Emerging Technology reported in 2024 that organizations struggle to operationalize AI risk management: ambiguity between AI safety and AI security poses substantial challenges, organizations are often unsure how to apply the AI RMF alongside NIST's cybersecurity framework, and tailoring and prioritizing guidance would make it more accessible to less well-resourced providers with bespoke needs.

NIST's concept note, released April 7, 2026, responds directly to that gap. The profile will guide critical infrastructure operators toward specific risk management practices to consider when engaging AI-enabled capabilities. NIST says it aims to align with, contextualize, reference, interpret, adapt, and facilitate the operationalization of existing and upcoming guidance at the intersection of AI, IT, operational technology, industrial control systems, software development, cybersecurity, and critical infrastructure.

The initiative remains a concept note under development, so its full operational impact is not yet realized. NIST states that working collaboratively with industry, regulators, policymakers, and academia, it will develop a profile that gives critical infrastructure sectors increased confidence to deploy AI tools, and offers developers and vendors greater certainty to catalyze innovative solutions worthy of trust. Separately, NIST is revising AI RMF 1.0 as part of the White House AI Action Plan.