NIST AI RMF KitNIST AI RMF GOVERN 2
Named people own AI risk decisions, know it, and are trained for it.
What NIST says
Accountability structures are in place so that the appropriate teams and individuals are empowered, responsible, and trained for mapping, measuring, and managing AI risks.
Category statement quoted from NIST AI 100-1 (AI RMF 1.0). Function: GOVERN, a culture of risk management is cultivated and present.
Evidence that shows you're doing it
- Roles and responsibilities (RACI) for AI risk
- Training records for people who build, buy or approve AI
- Executive sign-off on AI risk decisions
Rate yourself
- Not done
- Ad hoc
- Defined
- Operating
- Measured and improving
The AI Governance Toolkit (Professional, $599) has the NIST AI RMF mapping workbook: maturity scoring, evidence, owners and next steps for every category, plus the ISO/IEC 42001 crosswalk.
Other GOVERN categories
- GOVERN 1: You have written, approved rules for how AI risk is handled, and people actually follow them.
- GOVERN 3: Decisions about AI risk draw on a range of backgrounds, skills and viewpoints, including people affected by the system.
- GOVERN 4: Teams talk openly about AI risk, test critically, and share what they find.
- GOVERN 5: You collect and act on input from people outside the team: users, customers, affected groups and experts.
- GOVERN 6: AI you buy or build on (models, APIs, data, plugins) is covered by your policies and contracts.