How to use the NIST AI Risk Management Framework, step by step

Using the NIST AI RMF means working through four functions in order: Govern, Map, Measure and Manage. Govern establishes the policies and accountability. Map identifies the context and the risks. Measure assesses and tracks them. Manage prioritises and responds. The framework is voluntary and deliberately non-prescriptive, which is why implementation needs a walkthrough. For what the framework is rather than how to run it, see the NIST AI RMF explainer.

Artificial intelligence (AI) is revolutionizing sectors like healthcare, education, finance, and entertainment, offering unprecedented opportunities and advancements. Yet, the advent of AI introduces substantial challenges and risks that necessitate careful management and consideration.

Questions arise regarding the trustworthiness, reliability, safety, security, fairness, and ethics of AI systems. How do we balance AI's benefits against its risks across various stakeholders and environments? Moreover, how can we promote an AI innovation ecosystem that is responsible and inclusive?

The National Institute of Standards and Technology (NIST) proposes the AI Risk Management Framework (AI RMF), a comprehensive guide comprising industry-neutral guidelines and practices to assess and mitigate AI-related risks. Designed for voluntary adoption, the AI RMF aims to integrate trustworthiness in the lifecycle of AI products, services, and systems—from design to deployment and beyond.

This blog post offers a detailed walkthrough on utilizing the AI RMF to oversee AI risks effectively and guarantee the ethical use of AI. We will unpack the major elements of the AI RMF, provide insights into its implementation within your organization, and highlight how to ensure your AI risk management efforts are fruitful. Additionally, practical examples and resources will be provided to facilitate the application of the AI RMF in real-world scenarios.

Understanding the NIST AI Risk Management Framework

The NIST AI Risk Management Framework (AI RMF) offers guidelines and best practices universally applicable across industries, designed to assist organizations in navigating the risks linked to artificial intelligence (AI) system use. Its implementation is voluntary and aims to enhance the trustworthiness of AI technologies through thoughtful consideration during their design, development, application, and assessment phases.

Background and Objectives

Developed collaboratively by NIST with input from both the private and public sectors, the AI RMF's creation involved an inclusive and open procedure. This process saw the submission of a Request for Information, the publication of several draft versions for public critique, organizing multiple workshops, among other input solicitation efforts. January 2023 marked the release of the AI RMF, accompanied by a comprehensive suite of resources: the NIST AI RMF Playbook, an AI RMF Explainer Video, an AI RMF Roadmap, an AI RMF Crosswalk, and various Perspectives.

The AI RMF sets out to:

• Establish a universally understood terminology and structure for AI risk management;
• Guide organizations in pinpointing, evaluating, and mitigating AI risks across the system's entire lifecycle;
• Facilitate the creation and deployment of AI solutions that are reliable, safe, secure, resilient, accountable, clear, explainable, interpretable, privacy-focused, and equitable;
• Complement and enhance ongoing AI risk management initiatives by various entities, including standard-setting organizations, industry groups, and regulatory agencies;
• Promote the AI RMF's adoption and ensure its global applicability through the Trustworthy and Responsible AI Resource Center.

Core Components of the Framework

The AI RMF is built around two key elements: the Core and the Profiles, which together offer a robust framework for artificial intelligence risk management. The Core encompasses four crucial functions—Govern, Map, Measure, and Manage—that outline the backbone of AI risk management. Each function is broken down further into categories and subcategories providing detailed directions for their implementation. This structure is designed with flexibility in mind, allowing for tailoring to diverse organizational needs and AI technologies.

The Profiles represent the tailored application of the Core, reflecting an organization's specific AI-related challenges, impacts, objectives, and priorities. They enable an organization to prioritize the aspects of AI risk management most pertinent to their context and facilitate communication and cooperation with various stakeholders within the AI ecosystem, including developers, users, regulators, and auditors.

Implementing the NIST AI Risk Management Framework

The NIST AI Risk Management Framework lays out a systematic way to handle the risks tied to artificial intelligence systems. We'll walk you through how to apply the AI RMF within your organization. You'll learn about preparing for an AI risk assessment, conducting it, crafting a risk management plan, and keeping track of and documenting your AI risk management efforts. We'll also share valuable tips and resources for effectively leveraging the AI RMF.

Step 1: Preparing for AI Risk Assessment

Starting with the AI RMF involves preparing for the AI risk assessment. This step includes defining the assessment's scope, objectives, context, and engaging the relevant stakeholders to manage the risks of AI effectively. Key tasks at this stage include:

• Clarifying the AI risk assessment's scope, e.g., the AI system, product, service, or process to be assessed, its stage in the lifecycle, and the assessment's level of detail.
• Setting the AI risk assessment objectives, like its purpose, scope, and desired outcomes, benchmarks and metrics for gauging AI risks and trustworthiness, and delineating the roles and responsibilities of the assessment team.
• Establishing the context for the AI risk assessment, considering both internal and external factors affecting it, compliances, ethical norms, and social expectations, alongside any assumption and limitation acknowledgments.
• Identifying and involving relevant stakeholders such as AI system developers, users, clients, regulators, auditors, and others affected, to gather their insights, feedback, and expectations.

Step 2: Conducting the Risk Assessment

The next step is to carry out the risk assessment. This encompasses identifying, analyzing, and evaluating the potential risks, impacts, and harms linked to the AI system, and the control measures in place or planned to mitigate them. Tasks include:

• Spotting potential risks, impacts, and harms tied to the AI system, considering the risk sources, causes, scenarios, and outcomes, categorizing AI risks, and evaluating the likelihood and severity of these risks.
• Analyzing these potential risks, impacts, and harms by examining the influencing factors, risk interrelations, and methods and tools for risk quantification.
• Evaluating the identified risks to determine their scale and significance, their acceptability, and prioritizing them based on these evaluations.
• Pinpointing existing and planned controls to dampen the AI risks, covering policies, procedures, and best practices, alongside the technical, organizational, and personnel measures of risk mitigation, and evaluating these controls' effectiveness.

Step 3: Developing a Risk Management Strategy

The third phase involves developing a strategy for risk management. It includes picking and applying suitable controls to lessen AI risks, and the communication and reporting of AI risk assessment results and recommendations. Tasks at this stage entail:

• Choosing and implementing apt controls to minimize AI risks, considering the mitigation strategies, costs and benefits of risk controls, and their execution and integration.
• Communicating and reporting on AI risk assessment results and suggestions, detailing the assessment's summary, key findings, and action plans for managing AI risks.

Step 4: Ongoing Monitoring and Documentation

The final step is the continuous monitoring and recording of the AI risk management process. This involves periodically reviewing and updating the AI risk assessment and management strategy, and keeping track of all relevant evidence and records. Necessary actions here include:

• Revising the AI risk assessment and management strategy to reflect changes to the AI system, risks, and controls, evaluating the risk management process's performance, and integrating feedback and lessons learned.
• Gathering and preserving records and evidence of the AI risk management process, including data related to the AI system, risks, and controls, documentation of the risk assessment and strategy, and audits of the risk management process.

Lifecycle and Key Dimensions of an AI System - Source : NIST

Ensuring Trustworthiness and Responsible Use of AI

The NIST AI Risk Management Framework (AI RMF) offers a versatile set of guidelines that cater to all industries, helping organizations mitigate the risks tied to the use of artificial intelligence (AI) systems.

In this section, we're going to walk through practical implementations of the AI RMF across various AI scenarios and sectors. Plus, we'll share some valuable tips and resources to smoothly integrate the AI RMF into your organization's processes, ensuring AI systems are used responsibly and trustworthily.

Practical Examples of Applying the Framework

The AI RMF is designed to be adaptable, catering to different organizational needs and AI applications. To showcase its practical application, we'll explore examples across several fields that have implemented or plan to implement the AI RMF to navigate AI risks while promoting trust and responsible AI usage. These instances are meant to inspire and inform, rather than prescribe a rigid approach.

Highlighted examples include:

• The U.S. Department of Defence (DoD) utilizing the AI RMF to guide its AI Ethical Principles Implementation Plan, ensuring ethical AI development and usage.
• The U.S. Department of Health and Human Services (HHS) leveraging the AI RMF to craft an AI Risk Management Strategy, aimed at identifying and mitigating AI risks within health services.
• The U.S. Department of Commerce (DOC) conducting a pilot AI risk assessment with the AI RMF for the Census Bureau's TIGER system, enhancing geographic data's accuracy and efficiency through AI.
• NASA applying the AI RMF to form a draft AI Trustworthiness Framework, establishing methods and criteria for trustworthy AI in space exploration and research.
• The Financial Industry Regulatory Authority (FINRA) creating an AI Risk Management Playbook based on the AI RMF, offering a practical toolkit for managing AI's risks and opportunities in financial services.

Adapting the Framework to Your Organization

While the AI RMF is versatile and rights-preserving, it's not a universal solution. It may require adjustments to align with your organization's specific needs and context. To effectively adapt the AI RMF, consider the following steps:

• Understand how your organization’s mission, vision, values, goals, and objectives intersect with AI system development and use.
• Engage AI stakeholders, including developers, users, customers, regulators, and other affected groups, in the risk management process.
• Evaluate your organization's AI maturity, resources, and capabilities, including adoption levels, expertise, infrastructure, and budgeting for AI.
• Review and possibly update your organization's AI Acceptable Use Policy, procedures, and standards to ensure they meet legal, ethical, and social standards.
• Select and apply the AI RMF Core functions and categories that best match your organization's particular AI risks and priorities.
• Develop an AI RMF Profile tailored to your organization and collaborate within the AI ecosystem using this profile.
• Regularly monitor, document, and update the AI risk management approach and the AI RMF's implementation as necessary.

Conclusion

Artificial Intelligence (AI) stands as a monumental force in the technological realm, offering a plethora of benefits and opportunities to people, businesses, and society at large. Despite its potential, AI introduces considerable challenges and risks that demand meticulous attention and management. Questions loom around ensuring AI's trustworthiness, reliability, safety, security, fairness, and ethical use. Balancing AI's advantages and risks across various stakeholders and scenarios is crucial. Moreover, promoting responsible and inclusive AI innovation and usage is paramount.

The NIST AI Risk Management Framework (AI RMF) offers a comprehensive, sector-neutral set of guidelines and best practices aimed at navigating the risks tied to AI technologies. This framework is comprised of two core elements: the Core and the Profiles. 

Throughout this blog post, we've walked you through utilizing the AI RMF to adeptly navigate AI risks and uphold both trustworthiness and responsible AI deployment. We've broken down the AI RMF's fundamental principles and components, demonstrated how to integrate it within your organization, and highlighted how to certify the robustness of your AI risk management strategies. 

We trust that you've found this blog post enlightening and useful. Should you seek further insights into the AI RMF, the NIST website and the Trustworthy and Responsible AI Resource Center stand as valuable repositories of information, tools, and aids to assist in the AI RMF's implementation. 

We encourage the application of the AI RMF in mitigating your AI risks and ensuring AI's trustworthiness and responsible application, thus fostering trustworthy AI systems.