CAISI: NIST’s Center for AI Standards and Innovation, Explained

CAISI, the Center for AI Standards and Innovation, is the part of the U.S. National Institute of Standards and Technology (NIST) responsible for evaluating commercial AI systems, working with industry on voluntary AI standards, and representing U.S. interests in international AI-standards competition. It was created under a different name and a different mission, and its 2025 rename marked a real change in what the institution does, not just what it is called.

This page covers CAISI as an institution: where it came from, where it sits inside NIST, and what its mandate actually covers. For CAISI’s specific pre-deployment testing agreements with individual AI labs, see our dedicated guide: Pre-Deployment Testing: CAISI and UK AISI’s Agreements with AI Labs.

From the AI Safety Institute to CAISI: the 2025 rename

CAISI began as the U.S. AI Safety Institute (AISI), created following President Biden’s October 2023 executive order on AI. On June 6, 2025, Secretary of Commerce Howard Lutnick announced that the institute would be renamed the Center for AI Standards and Innovation, dropping “safety” from its name entirely.

The rename was framed explicitly as a change in orientation, not just branding. In his statement, Lutnick said CAISI would “evaluate and enhance U.S. innovation of these rapidly developing commercial AI systems while ensuring they remain secure to our national security standards,” arguing that prior framing had let “censorship and regulations” pass under the banner of safety. The institute’s priority focus areas were adjusted alongside the name: from broad AI-safety research toward national-security-relevant testing (cybersecurity, biosecurity, and chemical-weapons risk), voluntary industry standards, and international competitiveness.

CAISI’s role inside NIST

CAISI operates as a center within NIST, itself an agency of the U.S. Department of Commerce. Unlike a standalone regulator, CAISI does not have rulemaking authority; NIST’s traditional role is to develop voluntary standards, guidelines, and measurement science that industry and government can adopt. CAISI extends that model to AI: NIST describes it as “industry’s primary point of contact within the U.S. government to facilitate testing and collaborative research related to harnessing and securing the potential of commercial AI systems.”

CAISI works with other parts of NIST — including NIST’s Information Technology Laboratory — on AI security guidelines rather than operating in isolation. That distinction matters for one common point of confusion: CAISI is not the same office that owns NIST’s AI Risk Management Framework (see below).

What CAISI’s mandate covers beyond lab testing agreements

Media coverage of CAISI often focuses on its testing memoranda of understanding with individual AI developers (covered in our companion guide). Those agreements are one function among several. Per NIST’s own description of the center, CAISI’s mandate also includes:

• Voluntary standards development. Working with NIST organizations and industry to develop guidelines and best practices for measuring and improving the security of AI systems.
• Evaluations beyond bilateral MOUs. Leading unclassified evaluations of AI capabilities that may pose national security risks, including assessments of U.S. and adversary AI systems and the state of international AI competition.
• Security-vulnerability assessment. Assessing foreign AI systems for vulnerabilities, backdoors, or malicious behavior.
• International standards representation. Representing U.S. interests internationally to push back on what NIST characterizes as burdensome or unnecessary foreign regulation of American AI technology, and coordinating with NIST’s Information Technology Laboratory to influence international AI standards.
• Interagency coordination. Working with agencies including the Department of Defense, Department of Energy, Department of Homeland Security, the Office of Science and Technology Policy, and the intelligence community on AI capability assessment.

In short: CAISI’s charter is closer to “NIST’s AI standards and national-security-evaluation arm” than “the office that signs testing deals with AI labs” — the testing agreements are a visible, but partial, piece of a broader mandate.

CAISI and the NIST AI Risk Management Framework: a common mix-up

Because CAISI is NIST’s most visible AI-focused center, it’s often assumed to be the home of the NIST AI Risk Management Framework (AI RMF) — the voluntary framework many organizations use to structure AI governance programs. That assumption is not accurate. NIST states that the AI RMF is “led by the Information Technology Laboratory (ITL) AI Program,” not by CAISI. The two efforts sit within the same NIST structure and CAISI coordinates with ITL, but the RMF’s ownership predates CAISI’s 2025 mandate and is not one of CAISI’s listed responsibilities. If you’re building an AI governance program around the AI RMF’s functions (Govern, Map, Measure, Manage), that work traces to NIST’s ITL AI Program, not to CAISI’s testing or standards activity.

CAISI and the UK AI Security Institute

CAISI has a close institutional parallel in the United Kingdom. The UK’s AI Safety Institute was renamed the AI Security Institute (UK AISI) on February 14, 2025 — several months before CAISI’s own rename — announced by UK Technology Secretary Peter Kyle at the Munich Security Conference. Like CAISI, the UK institute’s rebrand came with a narrower, security-focused remit: AI-enabled cyberattacks, automated fraud, child sexual abuse material, and chemical or biological misuse, rather than open-ended AI safety research.

The two institutions are organizationally independent — CAISI sits inside NIST under the U.S. Department of Commerce, while UK AISI is a research organization under the UK’s Department for Science, Innovation and Technology — but they coordinate directly, including a joint testing agreement first struck in April 2024 (while both were still named “safety” institutes) and expanded since. The mechanics of that testing relationship are covered in depth in our companion guide, linked above.

Why the distinction matters

For teams tracking AI governance infrastructure, conflating “CAISI the testing partner” with “CAISI the institution” leads to two common errors: assuming CAISI’s authority is limited to the handful of labs it has signed agreements with (its standards and evaluation mandate is broader), and assuming CAISI owns frameworks like the AI RMF that actually sit elsewhere in NIST. Getting the institutional map right matters for anyone citing NIST in a compliance or vendor-assessment context — including work like CASRAI’s NIKOLAI, which maps AI-research terminology and mechanisms (including regulatory bodies and their specific functions) to a shared, disambiguated reference.

Where NIKOLAI fits

CAISI’s own independence from the labs it evaluates is exactly the kind of question NIKOLAI, CASRAI’s open, versioned dictionary of elements for frontier-AI safety documentation, tries to give a shared vocabulary for. Its N8 track (Transparency and review) includes an Evaluator Independence and Conflict of Interest element, defining a record of declared financial, organisational, and personal relationships between an evaluator and the developer being evaluated, plus the independence test applied to clear the evaluator for engagement — the same category of question a government testing institute like CAISI has to answer for every lab it works with. NIKOLAI’s crosswalk of that element cites language from Anthropic’s Responsible Scaling Policy, the EU GPAI Code of Practice, METR, and the proposed FRONTIER Act — none of which name CAISI directly. It is CASRAI’s own reading of how independence gets defined across frameworks, not an endorsement or assessment of CAISI itself.

Frequently asked questions

Is CAISI a regulator?

No. CAISI does not have rulemaking or enforcement authority. Consistent with NIST’s traditional role, it develops voluntary standards, guidelines, and evaluations rather than binding regulations.

When did CAISI stop being called the AI Safety Institute?

The rename was announced by Secretary of Commerce Howard Lutnick on June 6, 2025. The institute had operated as the U.S. AI Safety Institute since its creation following an October 2023 executive order.

Does CAISI own the NIST AI Risk Management Framework?

No. NIST states the AI RMF is led by its Information Technology Laboratory (ITL) AI Program. CAISI coordinates with ITL but the RMF is not listed among CAISI’s own responsibilities.

Is CAISI the same as the UK AI Security Institute?

No, they are separate national institutions — CAISI is part of the U.S. NIST under the Department of Commerce, and UK AISI is a UK government research organization under the Department for Science, Innovation and Technology. They coordinate on testing but are not the same body.

What does CAISI actually do day to day?

Per NIST, CAISI’s mandate spans voluntary AI-security standards development, unclassified evaluations of U.S. and adversary AI capabilities, assessment of foreign AI systems for vulnerabilities, international standards representation, and interagency coordination — in addition to its testing agreements with individual AI labs.

Why This Matters for Research Administration

University offices that maintain an institutional AI-governance or responsible-AI-use policy — often housed in the CIO’s office, a research-computing unit, or a provost-level AI task force — frequently cite “the NIST AI framework” as their policy’s basis. This guide’s central finding is exactly what those offices need before citing NIST by name: the AI RMF is owned by NIST’s Information Technology Laboratory, not by CAISI, even though CAISI is now NIST’s most visible AI-facing unit. A policy or grant-compliance document that cites “NIST’s AI safety center” as the source of the AI RMF is citing the wrong office.