NIST AI RMF KitNIST AI RMF MAP 2
Each AI system is classified: what task it performs, how it works, and how much risk it carries.
What NIST says
Categorization of the AI system is performed.
Category statement quoted from NIST AI 100-1 (AI RMF 1.0). Function: MAP, context is recognized and risks related to context are identified.
Evidence that shows you're doing it
- Risk classification per system (for example, under the EU AI Act)
- Record of the model type, methods and task
Rate yourself
- Not done
- Ad hoc
- Defined
- Operating
- Measured and improving
The AI Governance Toolkit (Professional, $599) has the NIST AI RMF mapping workbook: maturity scoring, evidence, owners and next steps for every category, plus the ISO/IEC 42001 crosswalk.
Other MAP categories
- MAP 1: For each AI system you know its purpose, users, setting, limits and the laws that apply.
- MAP 3: You know what the AI is meant to achieve, what it costs, and how it compares with alternatives, including not using AI.
- MAP 4: Risks are mapped for every part of the system, including third-party models and data.
- MAP 5: You have assessed who could be affected by the AI and how, likely and unlikely.