nist-ai-rmf

Rate each of the six GOVERN categories as Not Started, Partial, or Implemented, then identify the evidence needed to close each gap. The Skill delivers a prioritized remediation roadmap plus pasteable templates for AI risk policies, governance committee charters, and risk tolerance statements.

The four functions are GOVERN (organizational accountability and risk tolerance), MAP (risk identification and context), MEASURE (risk analysis via TEVV activities), and MANAGE (risk treatment and incident response). GOVERN is cross-cutting and underpins the other three functions.

GOVERN 1 maps to Article 9 risk management systems, MEASURE 2 to Articles 10 and 15 on data governance and accuracy, and MANAGE 3 to Article 73 incident reporting. The EU AI Act is mandatory for in-scope providers, while the AI RMF is voluntary and can serve as the methodology satisfying Article 9.

The seven characteristics are valid and reliable, safe, secure and resilient, accountable and transparent, explainable and interpretable, privacy-enhanced, and fair with harmful bias managed. Each has associated metrics such as demographic parity, SHAP/LIME explanations, adversarial accuracy, and differential privacy epsilon.

No, the AI RMF is voluntary, outcome-based, and not a compliance checklist. Organizations subject to mandatory regimes like the EU AI Act can use it as the risk management methodology to satisfy legal requirements such as Article 9.

Use columns for AI system, lifecycle stage, TEVV activity, characteristic at risk, likelihood and impact, treatment, and owner. Include a dedicated row for third-party or vendor-model dependencies, and update entries whenever MEASURE activities produce new evidence.