Nist AI Rmf

Common Workflows

1. GOVERN Gap Assessment

1. For each of the 6 GOVERN categories (and their subcategories where granularity is needed), rate status: 🔴 Not Started / 🟡 Partial / 🟢 Implemented
2. For each 🔴/🟡, identify the specific gap and the evidence needed to close it (policy document, RACI chart, escalation procedure, etc.)
3. Produce a prioritized remediation roadmap (Quick Wins → Medium Term → Long Term), noting that GOVERN gaps typically block progress in MAP/MEASURE/MANAGE
4. Flag whether GOVERN is "complete on paper but not operationalized" — a common gap pattern where policies exist but aren't reflected in day-to-day MAP/MEASURE/MANAGE activity (see references/rmf-profiles.md)
5. Deliver these mini-templates in the answer itself (fill them with the organization's specifics):
   • AI risk policy outline (GOVERN 1.2): 1. Purpose & scope · 2. Definitions & AI system inventory criteria · 3. Risk tolerance statement · 4. Roles & accountability (RACI) · 5. Lifecycle requirements (MAP/MEASURE/MANAGE gates per stage) · 6. Third-party AI requirements · 7. Incident response & escalation · 8. Review cadence
   • AI governance committee charter (RACI skeleton) (GOVERN 2.1): Accountable — executive sponsor/CAIO; Responsible — AI product owners, data science leads; Consulted — legal, privacy, security, HR for employment uses; Informed — audit, board risk committee; quorum, meeting cadence, decision rights (approve/deny deployment, accept residual risk)
   • Risk tolerance statement examples (GOVERN 1.3): "We do not deploy AI that makes fully automated adverse decisions about individuals without human review"; "Disaggregated performance gaps above X% between demographic groups block deployment until remediated"
   • AI inventory minimum fields (GOVERN 1.6): system name/owner · purpose & users · model type/provenance (built/bought/fine-tuned) · data categories · lifecycle stage · risk tier · last TEVV date

2. Hiring / Employment AI Risk Assessment

1. MAP: Document intended use (MAP 1.2), affected populations — applicants, current employees (MAP 1.4), and prohibited uses (e.g., no fully automated rejection without human review)
2. MAP: Build the stakeholder risk/benefit matrix (MAP 3.1) — employer efficiency benefit vs. applicant risk of disparate impact
3. MEASURE: Run disaggregated performance and disparate-impact-ratio testing across protected classes (MEASURE 2.2); document explainability approach for adverse decisions (MEASURE 2.3)
4. MANAGE: Define treatment for any subgroup below the 4/5ths threshold — retraining, human-in-the-loop review, or use restriction (MANAGE 2.1)
5. Populate the AI Risk Register (above) with one row per identified hiring-stage risk
6. Cross-reference sector considerations: EEOC, NYC Local Law 144, and EU AI Act high-risk classification for employment AI (see references/rmf-profiles.md)

3. Credit Scoring Risk Register

1. MAP: Document context of use (MAP 1.2/1.3) — loan origination, limit decisions, pricing — and legal constraints (ECOA, Fair Housing Act, EU AI Act high-risk classification)
2. MAP: Identify affected stakeholders and prioritize risks that are irreversible or affect a protected class (MAP 4.1)
3. MEASURE: Test fairness metrics (demographic parity, equalized odds, disparate impact ratio) and explainability sufficient to produce adverse-action notices (MEASURE 2.2/2.3)
4. MANAGE: Document treatment — model adjustment, threshold changes, or human review escalation — and residual risk acceptance by an accountable officer (MANAGE 1.3)
5. Build the risk register using the template above, with "Characteristic at Risk" typically Fair with Harmful Bias Managed or Accountable & Transparent

4. Incident Response (MANAGE 3)

• Trigger conditions: model accuracy degradation, bias threshold breach, adversarial attack, data drift
• Response steps: Contain → Assess impact → Notify stakeholders → Remediate → Document → Update risk register → Feed lessons learned into GOVERN (MANAGE 4.3)
• Classify severity (low/medium/high/critical) and pre-define notification thresholds: internal escalation, customer notice, regulatory disclosure

AI Risk Profiles

An AI Risk Profile is an organization's customization of the AI RMF to reflect its specific AI use cases, applicable laws, defined risk tolerance, and the trustworthiness characteristics most relevant to its systems. The AI RMF defines two profile types:

The gap between Current and Target Profile drives the risk management roadmap:

1. Scope — Define which AI systems are in scope (all AI, specific high-risk systems, or a single system)
2. Assess Current State — Rate each of the 19 categories: Not Started (0) / Partial (1) / Implemented (2) / Optimized (3)
3. Set Target State — Define desired maturity per category based on risk tolerance and regulatory requirements
4. Gap Analysis — Categories where Target > Current are gaps requiring action
5. Prioritize — Weight gaps by the risk they represent; address highest-risk gaps first
6. Roadmap — Assign owners, timelines, and resources to close each gap

NIST also uses cross-sectoral and use-case profiles as companions to the core AI RMF (for example, a Generative AI Profile addressing risks specific to generative AI systems). When a user's question concerns generative-AI-specific risk, apply the same GOVERN/MAP/MEASURE/MANAGE structure and trustworthiness characteristics above, and note explicitly that generative-AI-specific subcategory detail should be verified against the current NIST publication rather than assumed.

Cross-Framework Mapping

NIST AI RMF ↔ EU AI Act (Regulation (EU) 2024/1689)

Key difference: The EU AI Act is mandatory for in-scope providers and deployers; the NIST AI RMF is voluntary. Organizations subject to the EU AI Act should use the NIST AI RMF as the risk management methodology that satisfies Art. 9's "appropriate risk management system" requirement.

NIST AI RMF ↔ ISO/IEC 42001:2023

For NIST CSF 2.0 and NIST Privacy Framework mappings, sector-specific risk considerations (healthcare, financial services, HR/recruitment, criminal justice, government, education, autonomous systems), implementation tiers, and common gap patterns, read references/rmf-profiles.md.

Reference Files

For deeper content, read these files as needed:

• references/rmf-core.md — All 19 categories with full subcategory descriptions and Playbook-style suggested actions for GOVERN, MAP, MEASURE, and MANAGE
• references/rmf-profiles.md — AI Risk Profiles, trustworthy AI metrics and indicators, sector-specific guidance, cross-framework mapping (ISO 42001, EU AI Act, NIST CSF, NIST Privacy Framework), implementation tiers, and common gap patterns

This skill provides general compliance information, not legal advice. Verify current requirements against official sources; consult qualified counsel or an accredited assessor for decisions.