United States (federal) · voluntary framework
NIST AI RMF · MAP: what it asks, and the records to keep
MAP establishes the context needed to frame an AI system's risks, through 5 categories and 18 subcategories covering intended purpose, categorization, capabilities, benefits and costs, component risks and impacts. Its outputs feed MEASURE and MANAGE and support a go or no-go decision on whether to design, develop or deploy.
01 / What it asks
What NIST AI RMF · MAP asks
Organizations adopting the AI RMF; MAP is done per AI system by the teams that design, develop, deploy or procure it.
- 01Document intended purposes, deployment settings, applicable laws and norms, mission goals and risk tolerances (MAP 1.1, 1.3, 1.5).
- 02Define the AI system's tasks and methods and document TEVV considerations, including data representativeness (MAP 2.1, 2.3).
- 03Document expected benefits, costs, targeted application scope and human oversight processes (MAP 3.1, 3.3, 3.5).
- 04Map technology and legal risks of all components, including third-party data, software and models (MAP 4.1, 4.2).
- 05Characterize likelihood and magnitude of impacts on individuals, groups, communities, organizations and society (MAP 5.1).
02 / AI work
Where it touches AI work
AI-specific. It frames the context and impacts of a particular AI system before measurement and treatment.
03 / Dates
The dates that matter
NIST releases AI RMF 1.0 (NIST AI 100-1)
Generative AI Profile (NIST AI 600-1) released
AI Action Plan directs NIST to revise the AI RMF
Concept note for critical infrastructure AI RMF profile
04 / Enforcement
Who enforces it
None; voluntary.
05 / Records
Records an organisation keeps
What an auditor or an inquiry usually asks to see. Your obligations depend on your role and your facts.
- 01AI system context statement: purpose, users, deployment setting
- 02AI system categorization and documented application scope
- 03Component and third-party risk mapping
- 04Impact assessment with likelihood and magnitude estimates
Optional evidence · where Planisphere fits
Keep a record anyone can check
When your team meets a duty, Planisphere can seal the event it reports as a receipt.
A disclosure shown, a review signed, a model change approved: the event your system reports.
The event becomes a sealed receipt, dated and attributed to whoever is signed in.
Paste the receipt into Verify. No account or key.
A record supports your compliance evidence process. It is not a legal finding or a certification. Systems that call Planisphere's gate API can also hold or refuse an action before it runs.
SOURCES
Go back to the source
National Institute of Standards and Technology
National Institute of Standards and Technology
NIST Trustworthy and Responsible AI Resource Center
CHANGE LOG
What changed, and when
Rebuilt from primary sources; facts checked on this date.
Related: NIST AI RMF · MAP for defense AI workflows · NIST AI RMF · OMB M-25-21/22 · DoW RAI S&IP · EO 14179 · FIPS 140-3 · SHA-256 / FIPS 180-4