NIST

NIST is an agency of the US Department of Commerce. Its task sounds unspectacular: it defines how measurements are taken in the USA. How long exactly is a meter, how warm is a degree, how accurate is the country’s official clock? NIST answers such questions and operates its own laboratories for this purpose. Over the decades, a second role has grown out of this: the agency writes technical frameworks that companies voluntarily orient themselves by. The full name is National Institute of Standards and Technology, and the institution was founded back in 1901.

Why a measurement agency shows up in AI news

In artificial intelligence, a neutral yardstick is often missing. Every provider claims its system is safe and powerful. Without shared testing procedures, this is hardly verifiable. NIST fills this gap because the agency does not sell its own products and is therefore considered impartial.

Particularly important is the AI Risk Management Framework from 2023. This is a guide describing how organizations can identify and limit risks from AI systems. It is not a law, and no one is punished for ignoring it. Nevertheless, many companies use it as a template for internal rules, because there is hardly anything better available.

There is also a practical reason: anyone wanting to sell software to US government agencies often has to comply with NIST requirements. A recommendation thus effectively becomes a condition for doing business. That’s why major providers closely follow what the agency publishes.

From measurement standards to frameworks

The classic part of the work is genuine physics. NIST maintains reference samples for quantities such as mass or time. A laboratory can have its own measuring instrument checked against this reference. This creates a chain: from the supermarket scale to the research laboratory, all measurements ultimately trace back to the same origin.

With software, this works differently, because there is no prototype meter for security. Here, NIST works with documents and open procedures. A draft is published, companies, researchers, and associations comment on it, and a revised version follows. This lengthy consultation process is the reason why the results are widely accepted.

A well-known example are encryption competitions. NIST called on research groups worldwide to submit methods that even future quantum computers cannot break. Over the years, the submissions were publicly attacked and tested. The winners have been official standards since 2024. Similarly, the agency has been testing facial recognition systems for years and publishes how reliably they work across different groups of people.

Where NIST rules have an effect in everyday life

You rarely see the agency directly. Indirectly, you encounter it often: the encryption protecting your banking app usually follows a procedure defined by NIST called AES. Many password policies at companies also stem from NIST recommendations. The fact that modern advice recommends long passphrases instead of forced special characters traces back to one of these guidelines.

NIST comes up in business news when it comes to AI regulation. In 2024, a dedicated institute for testing AI safety was created within the agency, which entered into testing agreements with providers such as OpenAI and Anthropic. Such news is interesting for investors because it hints at what requirements are coming for the industry.

It is important to distinguish this from the EU. The European AI Act is a binding law with fines. NIST documents are recommendations with no threat of penalty. A common misconception is to equate the two. The difference is practical: a company can operate in compliance with NIST and still violate EU law.