NIST AI RMF 1.0

GOVERN — AI Risk Culture

Establish organisational policies, accountability structures, and culture for responsible AI — define AI risk tolerance, assign roles, and build AI governance processes.

GOVERN — AI Workforce & Training

Ensure staff involved in AI have appropriate skills and training for responsible AI development — including bias awareness, fairness principles, and AI ethics.

MAP — AI Context Classification

Identify and classify AI systems by risk level, deployment context, affected populations, and potential harms — both technical and societal.

MAP — AI Risk Identification

Identify risks at each lifecycle stage — data acquisition, model development, deployment, monitoring, and decommissioning — for each classified AI system.

MEASURE — AI Risk Quantification

Assess the likelihood, severity, and breadth of identified risks using quantitative or qualitative metrics — bias audits, explainability tests, adversarial robustness.

MEASURE — Trustworthiness Evaluation

Evaluate AI systems against the 7 trustworthy AI properties — using benchmarks, red-team testing, fairness metrics, and transparency audits.

MANAGE — Risk Response

Implement risk treatments for identified AI risks — mitigation, transfer, acceptance, or avoidance — with documented decisions and residual risk tracking.

MANAGE — Incident & Feedback Loops

Establish AI incident management, user feedback collection, and continual improvement loops — informing ongoing risk assessments and model updates.