Question · NIST AI RMF · GOVERN
What does a NIST AI RMF GOVERN program look like for a federal agency?
GOVERN is the cross-cutting function of the AI RMF, with 6 categories and 19 subcategories that set the policies, accountability, culture, stakeholder engagement and third-party controls under which AI risk is mapped, measured and managed.
01 / The answer
The short answer
GOVERN is the cross-cutting AI RMF function that sets policies, accountability and risk culture; it has 6 categories and 19 subcategories. For an agency, that means documented legal requirements, an inventory of AI systems, named roles with leadership owning risk decisions, teams that document impacts, channels for outside feedback, and policies for third-party and supply-chain risk. The RMF is voluntary; binding duties, such as designating a Chief AI Officer and publishing a use-case inventory, come from OMB memo M-25-21. NIST is revising the RMF, and GOVERN 3's diversity, equity and inclusion language is the kind the 2025 AI Action Plan told NIST to remove.
02 / The rule
What NIST AI RMF · GOVERN requires
GOVERN is the cross-cutting function of the AI RMF, with 6 categories and 19 subcategories that set the policies, accountability, culture, stakeholder engagement and third-party controls under which AI risk is mapped, measured and managed. NIST describes it as informing and infused throughout the other three functions.
- 01Understand and document legal and regulatory requirements involving AI (GOVERN 1.1).
- 02Keep an inventory of AI systems and processes for safely decommissioning them (GOVERN 1.6, 1.7).
- 03Document roles, responsibilities and lines of communication; executive leadership owns AI risk decisions (GOVERN 2.1, 2.3).
- 04Have teams document and communicate risks and impacts of the AI they build or use (GOVERN 4.2).
03 / Records
Records to keep
- 01AI risk management policy and documented risk tolerance
- 02AI system inventory with owners
- 03RACI or role charter for AI risk decisions
- 04Third-party AI supplier risk policy and contingency plans
Optional evidence · where Planisphere fits
Keep a record anyone can check
When your team meets a duty, Planisphere can seal the event it reports as a receipt.
A disclosure shown, a review signed, a model change approved: the event your system reports.
The event becomes a sealed receipt, dated and attributed to whoever is signed in.
Paste the receipt into Verify. No account or key.
A record supports your compliance evidence process. It is not a legal finding or a certification. Systems that call Planisphere's gate API can also hold or refuse an action before it runs.
SOURCES
Go back to the source
National Institute of Standards and Technology
National Institute of Standards and Technology
NIST Trustworthy and Responsible AI Resource Center
The White House
RELATED
Related: NIST AI RMF · GOVERN: the full guide