NIST AI Risk Management Framework: Govern, Map, Measure, Manage

Three ways to see it

1. 1

   NIST AI RMF 1.0, published January 2023, is built on four functions: Govern, Map, Measure, Manage. Govern means setting the policies, roles, and culture inside which AI work happens. Map means understanding the context, intended use, and people affected by a particular AI system. Measure means assessing the system's trustworthiness across many dimensions. Manage means deciding what risks are acceptable, mitigating the rest, and watching the system after deployment. The four functions repeat in a loop; nothing is ever done.

2. 2

   Way one to use NIST in a Pakistani bank or telco: as a charter for the Govern function. Most Pakistani organisations have no AI policy document. Adopting NIST's Govern subcategories as the skeleton, a CIO can produce a 10-page internal AI policy in a fortnight: roles, escalation paths, training requirements, vendor obligations, data handling, incident response. The document is unglamorous and exactly what regulators will eventually ask for.

3. 3

   Way two: as a checklist for the Map function on every new project. Before a single model is trained or a single API key issued, the team writes down: what problem, for whom, with what inputs, what outputs, what stakes, what alternatives, what failure modes. Pakistani agile teams often skip this and start with a model. Mapping first is slower for two weeks and faster for the next two years.

The why-tree

Try this with Claude

AI-edge prompt to try: 'You are a NIST AI RMF assessor. I will paste a description of my AI system. Walk through Govern, Map, Measure, Manage and for each function name the top three subcategories from the RMF Playbook and one practical action my team should take this quarter.' Use the output as a draft, then revise with your context.