Structuring Governance in the NIST AI Risk Framework

This article explores how the National Institute of Standards and Technology (NIST) Artificial Intelligence Risk Management Framework (AI RMF) structures organizational governance. By examining the framework's four core functions—Govern, Map, Measure, and Manage—this piece outlines how organizations can establish a culture of risk management, contextualize AI deployments, evaluate potential impacts, and actively mitigate risks throughout the AI lifecycle.

The Core Structure of the NIST AI RMF

The NIST AI RMF organizes AI risk management into four distinct, actionable functions: Govern, Map, Measure, and Manage. While Map, Measure, and Manage are context-specific and applied iteratively throughout the AI system lifecycle, the Govern function is uniquely positioned as a cross-cutting foundational element. Governance is not a single step in the process; instead, it informs and is embedded within every other function to ensure continuous oversight and accountability.

Govern: The Cross-Cutting Foundation

The Govern function establishes and cultivates an organizational culture of risk management. It is designed to align an organization's technical AI risk management efforts with its broader principles, policies, and strategic priorities.

Key aspects of the Govern function include:

Establishing Policies and Procedures: Creating clear guidelines, legal compliance measures, and ethical standards for AI design, development, and deployment.
Defining Roles and Responsibilities: Ensuring clear lines of accountability from executive leadership down to technical development teams.
Workforce Diversity and Training: Building diverse teams and providing adequate risk management training to identify a broader range of potential biases and harms.
Third-Party Oversight: Implementing processes to manage risks associated with third-party software, hardware, and data providers.

Because Govern is a cross-cutting function, the policies and structures established here dictate how the organization executes the Map, Measure, and Manage functions.

Map: Contextualizing AI Risks

Guided by the rules established in the Govern function, the Map function focuses on establishing the context to frame risks related to an AI system. Before an organization can measure or manage risk, it must understand the environment in which the AI will operate.

The Map function structures governance by requiring teams to:

Understand the Intended Purpose: Clearly document the business value, specific use case, and operational environment of the AI system.
Identify Stakeholders: Engage with internal and external stakeholders, including end-users and potentially impacted communities, to understand diverse perspectives.
Categorize System Capabilities: Assess the technical specifications, assumptions, and limitations of the AI model.
Anticipate Impacts: Identify potential positive and negative impacts of the system, framing the specific legal, reputational, and societal risks involved.

Measure: Assessing and Tracking Risks

Once the context is mapped, the Measure function employs quantitative, qualitative, or mixed-method tools to analyze, assess, benchmark, and monitor AI risk and related impacts. Governance structures dictate the thresholds and metrics used during this phase.

The Measure function drives accountability by focusing on:

Metric Selection: Identifying appropriate methodologies to test for trustworthiness characteristics, such as validity, reliability, safety, fairness, and privacy.
Rigorous Testing: Conducting ongoing evaluations of the AI system’s performance in both controlled environments and real-world conditions.
Documentation of Results: Maintaining transparent records of test outcomes, system limitations, and areas where metrics cannot fully capture complex societal impacts.
Independent Review: Utilizing independent assessors or internal audit teams—established under the Govern function—to validate measurement processes objectively.

Manage: Allocating Resources to Mitigate Risk

The Manage function involves allocating risk resources to mapped and measured risks on a regular basis, as defined by the organization's governance policies. It translates the insights gained from the Map and Measure phases into concrete action plans.

The Manage function operationalizes governance through:

Risk Prioritization: Triaging identified risks based on their projected severity, likelihood, and the organization's established risk tolerance.
Response Implementation: Executing plans to mitigate, transfer, avoid, or accept specific AI risks.
Incident Response and Recovery: Activating pre-established protocols for system failures, security breaches, or unintended harms, including the ability to decommission an AI system if it proves unsafe.
Continuous Monitoring: Tracking deployed systems over time to manage emergent risks, data drift, and changing operational contexts, feeding this information back into the Govern, Map, and Measure functions.