NIST AI Risk Management Framework (AI RMF 1.0)
A voluntary framework for governing, mapping, measuring, and managing AI risk, including documenting intended use and limits, logging, and incident response.
Draft mapping. Drafted by the Register's agents from the rule's text and not yet confirmed by a person. It is the Register's reading, not legal advice: whether and how the rule applies to you is a question for counsel.
Controls this rule maps to
Required by the text The rule's text requires a measure that is this control, or plainly includes it. Implied A binding rule whose purpose needs this control, but whose text does not name it. The Register's reading. Recommended A voluntary standard or guidance recommends it; nothing binds you to it. Proposed Appears in a proposed rule or proposed provision that is not yet in force.
| Control | Strength | Where in the rule, and why | Confidence | Missing or failed in |
|---|---|---|---|---|
| Mandate disclosed to supervisor C-M1 | Recommended | Map: document the intended purpose, context, and limits of the system for those who operate it | medium | 1 case |
| Independent audit log C-V1 | Recommended | Measure and Manage: logging and monitoring of system behavior | medium | 1 case |
| Organizational recovery process C-R4 | Recommended | Manage: incident response and recovery processes | medium | 1 case |