Question · NIST AI RMF
How does an evidence record map to NIST AI RMF?
NIST's voluntary framework for managing AI risks, organized into four functions (GOVERN, MAP, MEASURE, MANAGE) with 19 categories and 72 subcategories, plus seven characteristics of trustworthy AI.
01 / The answer
The short answer
A record of how an AI system was tested maps mainly to the MEASURE function and feeds MANAGE. Documented test sets, metrics and tools match MEASURE 2.1; results under deployment-like conditions match 2.3; production monitoring matches 2.4; validity, reliability and generalizability limits match 2.5; and evaluation of the testing process itself matches 2.13. MANAGE uses those results to decide whether to deploy and how to treat risks. GOVERN and MAP remain organizational work. The AI RMF is voluntary, and NIST is revising version 1.0 under the July 2025 AI Action Plan.
02 / The rule
What NIST AI RMF requires
NIST's voluntary framework for managing AI risks, organized into four functions (GOVERN, MAP, MEASURE, MANAGE) with 19 categories and 72 subcategories, plus seven characteristics of trustworthy AI. It is the most widely referenced US AI risk vocabulary and is being revised under the 2025 AI Action Plan.
- 01GOVERN: set policies, accountability, culture and third-party controls for AI risk across the organization.
- 02MAP: establish each AI system's context, purpose, categorization, benefits, costs and impacts.
- 03MEASURE: select metrics and test, evaluate, verify and validate AI systems for trustworthiness characteristics; track risks over time.
- 04MANAGE: prioritize and treat AI risks, manage third-party risk, and monitor deployed systems with response and recovery plans.
03 / Records
Records to keep
- 01AI risk management policy mapped to AI RMF functions
- 02AI system inventory with context and risk categorization
- 03Test, evaluation, verification and validation (TEVV) reports with documented metrics
- 04Risk register with treatment decisions and post-deployment monitoring plans
Optional evidence · where Planisphere fits
Keep a record anyone can check
When your team meets a duty, Planisphere can seal the event it reports as a receipt.
A disclosure shown, a review signed, a model change approved: the event your system reports.
The event becomes a sealed receipt, dated and attributed to whoever is signed in.
Paste the receipt into Verify. No account or key.
A record supports your compliance evidence process. It is not a legal finding or a certification. Systems that call Planisphere's gate API can also hold or refuse an action before it runs.
SOURCES
Go back to the source
National Institute of Standards and Technology
National Institute of Standards and Technology
NIST Trustworthy and Responsible AI Resource Center
The White House
RELATED
Related: NIST AI RMF: the full guide