S9.03 - NIST_AI_RMF

S9.03 ? NIST AI RMF

flowchart LR
    A[High-level AI governance often stays at policy level] --> B[RAIDT
Run-level evidence framework]
    B --> C[NIST AI RMF
Govern Map Measure Manage
operationalised per run]
    C --> D[Evidence pack]
    C --> E[RAIDT score profile]
    D --> F[Reviewer reconstruction]
    D --> G[Contestability]
    E --> H[Governance readiness]
    E --> I[Policy and assurance alignment]
    J[Public services] --> C
    K[Healthcare] --> C
    L[Finance] --> C
    M[Education] --> C
    N[Procurement] --> C
    O[Internal audit] --> C

? Star S9 - Policy, Standards and Assurance

Star context: Connects RAIDT to policy instruments, standards, assurance, procurement, audit and organisational accountability, showing how broad governance frameworks become inspectable run-level practice.

Academic picture

Definition / background

The NIST AI Risk Management Framework is a voluntary governance framework that helps organisations structure how they govern AI-related risk. Its core functions, commonly expressed as Govern, Map, Measure, and Manage, organise attention around accountability, context, assessment, and response. In general AI governance, the framework is valuable because it provides a shared vocabulary for discussing risk without assuming that every organisation has the same sector, legal exposure, technical architecture, or operating conditions.

For generative AI governance, the importance of the NIST AI RMF lies in its ability to move discussion beyond abstract principles and towards disciplined risk management. It encourages organisations to ask who is accountable, what context of use matters, how performance and harms are assessed, and what actions follow when risks are identified. However, on its own, it remains intentionally high level. It tells organisations what kinds of governance work matter, but not exactly what evidence should be captured for a specific run of a generative AI tool used for a specific task at a specific time.

That is why this concept belongs inside RAIDT. RAIDT treats the run as the unit of governance and uses run-level evidence to make framework commitments testable. In RAIDT terms, the NIST AI RMF becomes a practical organising logic for evidence capture: governance ownership under Govern, contextual description under Map, validation and monitoring under Measure, and response or control actions under Manage. Those elements can then be assembled into a run-level evidence pack and reflected in the five-pillar score profile across Responsibility, Auditability, Interpretability, Dependability, and Traceability.

This also distinguishes the NIST AI RMF from adjacent concepts such as legal compliance instruments or management-system standards. A law may impose duties, and a standard may define auditable management requirements, but the NIST AI RMF primarily provides a risk-management architecture. RAIDT adds an evidence grammar and scoring approach that let this architecture be applied at the level where generative AI is actually used.

Why this concept matters

The central problem solved by this concept is the gap between organisation-level AI governance claims and run-level proof. An organisation may say that it follows recognised guidance, yet supervisors, auditors, reviewers, or procurement teams still need to know how a particular use of a generative AI system was governed in context. Without that translation step, frameworks can become symbolic rather than operational.

This concept also prevents a common confusion: the belief that adopting a governance framework is the same as governing every AI use well. In practice, risk varies across runs because prompt design, input data, user role, output destination, and decision consequences change from one use event to the next. The same model can be low risk in one run and materially sensitive in another. RAIDT matters because it preserves the structure of the NIST AI RMF while making those differences visible in evidence.

If this concept is missing, organisations are more likely to rely on assertions such as policy approval, vendor assurance, or generic control statements. That creates weak reviewability, thin audit trails, and poor contestability when outputs are challenged. For organisations using generative AI in operational work, the NIST AI RMF matters because it offers a recognised governance language, and RAIDT matters because it turns that language into evidence-bearing practice.

Key idea: The NIST AI RMF matters in RAIDT because it provides the governance logic that RAIDT converts into run-level evidence, scoring, and audit-ready review.

What this item enables

A structured translation from Govern, Map, Measure, and Manage into concrete run-level governance questions.
A practical bridge between policy commitments and the contents of a RAIDT evidence pack.
A consistent way to justify why a run receives particular RAIDT pillar scores.
A shared vocabulary for researchers, auditors, managers, and procurement teams discussing generative AI risk.
Better comparison across runs, teams, and deployment settings because evidence is captured against a recognisable governance structure.
Clearer escalation and assurance pathways when a run raises privacy, safety, fairness, reliability, or accountability concerns.

Practical example / likely audience question

Audience question

If the NIST AI RMF already provides an AI governance framework, what does RAIDT add that is not already there?

Answer

The concern behind this question is the fear of duplication. A supervisor, reviewer, or practitioner may worry that RAIDT simply repackages an existing framework in new language. The direct answer is that RAIDT does not duplicate the NIST AI RMF; it operationalises it at the level of a single run.

The NIST AI RMF tells an organisation that it should govern AI risk through accountability, contextual mapping, measurement, and management. RAIDT asks what evidence would allow another person to verify that those governance activities were actually performed for this run, with this model, for this task, using this prompt configuration, under this oversight arrangement. That is a different contribution. It turns a framework for managing AI risk into a method for documenting and evaluating governance readiness.

A practical example makes the distinction clearer. A university may state that its generative AI use follows the NIST AI RMF. RAIDT asks for the run-level evidence showing who authorised a student-support drafting run, what data were used, what prompt template was active, what quality checks were applied, who reviewed the output, and how the run would be challenged if a harmful response occurred. A generic governance approach may stop at policy and process statements. RAIDT handles the issue better because it makes governance reconstructable rather than merely declared.

Practical example in RAIDT terms

Consider a public-services use case in which a local authority uses a generative AI assistant to draft responses to housing-benefit appeals. The use case appears administratively routine, but the run-level issue is that not all runs are alike. One run may rely only on public policy guidance, while another may include claimant case notes containing sensitive personal data and a tighter requirement for human review.

In RAIDT terms, the evidence needed for each run would include the task purpose, the accountable staff role, the model and provider used, the prompt template version, the data sensitivity classification, the grounding sources consulted, the review step before sending the draft, and any detected errors or escalation decisions. The most affected RAIDT pillars are Responsibility, Auditability, Dependability, and Traceability, with Interpretability also relevant because reviewers need to understand why the system was used and what limitations applied.

Using the NIST AI RMF as the structuring logic improves governance readiness. Govern clarifies ownership and approval. Map clarifies the use context, affected people, and risk conditions. Measure clarifies what quality, safety, or accuracy checks were used. Manage clarifies what happens if the output is unsuitable, challenged, or linked to harm. RAIDT therefore turns a broad framework into a reviewable evidence pattern for a concrete administrative run.

Detailed link to RAIDT

NIST AI RMF links to RAIDT in four ways.

First, it gives RAIDT a recognised governance structure for moving from broad AI risk principles towards operational decision-making.
Second, it helps RAIDT specify what should be examined at the level of an individual run, especially the context, controls, measurements, and response actions attached to that run.
Third, it strengthens the evidence pack and score profile by providing a defensible rationale for why particular evidence fields and scoring judgements matter.
Fourth, it improves reviewability, contestability, audit readiness, and organisational learning because framework claims can be checked against recorded evidence rather than accepted as assertions.

NIST AI RMF ? Run-level evidence ? Evidence pack ? RAIDT score profile ? Governance readiness

In this chain, the framework supplies the governance logic, the run-level evidence supplies the inspectable record, the evidence pack assembles that record coherently, the score profile summarises governance quality across the five pillars, and governance readiness describes the organisation's ability to justify, review, and improve real-world generative AI use.

Link to the five RAIDT pillars

Responsibility

The NIST AI RMF strongly supports Responsibility because it asks who governs the system, who owns the use context, and who is accountable when risk decisions are made. In RAIDT, that becomes a run-level question about named ownership and authorised use.