Renzo DemartiniIn short
- Record the framework edition, the scope and the date, and start from controls the business already runs.
- Tie each selected outcome to a record, an owner and a target, and keep the original records beside the map.
- Accept a gap only with a reason, an expiry and a named person, and hold expansion while evidence is missing.
The NIST AI Risk Management Framework is a long document. Your business already runs controls that touch it: approvals, vendor reviews, reconciliations, stop rights.
The owner’s job is to see which controls have evidence, which gaps matter and what waits until they close.
Start with the version and scope
A profile records the edition, the scope and the date so the next review can repeat it
| Field | Recorded choice |
|---|---|
| Framework | NIST AI RMF 1.0 (January 2023) |
| Scope | Sales, purchasing, finance and operations |
| Profile date | 3 November 2026 |
| Decision | Extend existing controls before expansion |
Illustrative figures, not client data.
NIST says the framework ‘is intended for voluntary use’. Its page also says version 1.0 is being revised, and the Roadmap adds that ‘A revised version is in progress.’ Record the edition you used and check again at each review.
This profile is a management record. It is not a certification, an Australian legal requirement or a compliance promise.
Map evidence to outcomes
Four selected outcomes, each tied to a record, an owner and a target
| Outcome and workflow | Current evidence | Target | Evidence owner |
|---|---|---|---|
| GOVERN 2.1, sales | S01: approval grid, no stop rights | Signed stop delegation | Sales manager |
| MAP 4.2, purchasing | P01: vendor review, no retention evidence | Retention evidence filed | Purchasing manager |
| MEASURE 2.3, finance | F12: 10 of 12 sample answers correct | 12 of 12 before decision use | Finance lead |
| MANAGE 2.4, operations | O02: 1 of 2 pause tests passed | 2 of 2 before expansion | Operations lead |
Sample profile. Each row is one selected outcome, not an assessment of the whole function. NIST does not prescribe profile templates or risk tolerance, so these targets are sample choices.
Illustrative figures, not client data.
The framework’s Core has four functions: GOVERN, MAP, MEASURE and MANAGE. Each row picks one outcome and asks what evidence the business already produces. A policy title alone proves little.
Keep the original records beside the map. Finance keeps the disputed answers. Operations keeps the failed pause test. Purchasing requests vendor evidence through the AI vendor evidence annex.
Separate gaps from duplicated work
One gap is accepted for a week, and three stay open and hold expansion
| Record | Disposition | Boundary |
|---|---|---|
| S01 | Open gate | No expanded sales permissions |
| P01 | Open gate | No new data categories |
| F12 | Temporary gap accepted | Internal drafts only, manual reconciliation |
| O02 | Open gate | No increase in operations volume |
Illustrative figures, not client data.
The owner accepts F12 until 10 November 2026, and decision use stays blocked. An acceptance needs a reason, an expiry and a named person. It does not turn missing evidence into a passed control.
Two registers copy the same S01 approval evidence. Keep one controlled record and link both reviews to it. NIST’s Playbook is ‘neither a checklist nor set of steps to be followed in its entirety’, so borrow only what fits.
Test the control in use
Three rehearsals show whether a control works when people use it
| Test | Evidence to keep |
|---|---|
| Substitute reviewer | Source record and decision reason |
| Conflicting answer | Correction and responsible manager |
| Pause request | Stopped action and restart authority |
Illustrative figures, not client data.
Test the people and the waiting time as well as the software. A control that exists on paper may stop nothing.
For personal information, get advice on your own obligations. The OAIC recommends staff can check outputs and that businesses ‘actively engage with and manage privacy settings’ in enterprise tools. A framework map does not settle those obligations.
Keep the decision current
Three triggers reopen the profile, and gaps stay visible until evidence closes them
| Trigger | Required action |
|---|---|
| 10 November 2026 | Revisit the F12 acceptance |
| Vendor or model change | Re-test the affected evidence |
| Failed pause or disputed answer | Hold expansion and send to the owner |
Illustrative figures, not client data.
NIST says comparing current and target profiles ‘likely reveals gaps to be addressed’, and it leaves the template flexible. Keep each gap visible until evidence closes it.
Revisit the scope when the business adds a workflow. Record why an outcome is deferred or left out, and keep the owner’s decision beside the evidence.
What to do first
Four outcomes and four records are enough for a first profile
- 01Pick four outcomes
One each for sales, purchasing, finance and operations.
- 02List the evidence you hold
The records the workflow already produces, not the policy titles.
- 03Set targets and owners
A local target and a named evidence owner for each outcome.
- 04Decide which gaps stop expansion
Accept a gap only with a reason, an expiry and a named person.
- 05Set the review triggers
A date, a vendor or model change, and any failed test.
Start with the AI use that has the most access to your data.
Common questions
What is the NIST AI risk management framework?
A voluntary framework for managing AI risk. Its Core has four functions: Govern, Map, Measure and Manage.
Is the Playbook a mandatory checklist?
No. NIST says organisations may borrow as many or as few of its suggestions as apply to their industry use case or interests.
Does completing a profile prove compliance?
No. NIST says addressing trustworthiness characteristics individually will not ensure trustworthiness. The framework is voluntary and is not an Australian certification, so seek advice on your obligations.
Chartered Accountant (CA ANZ) and finance executive, based in Canberra. Practical AI and automation for SMEs, and adviser to owners, CEOs and boards on integration and finance.