Frameworks, NIST AI RMF
Run your AI risk program on what the agents did
A risk register says what could go wrong. The NIST AI RMF asks you to measure and manage it in practice. VeriProof gives your risk team the live record they need, and sends the calls that are yours as the business owner to you.
Subcategories VeriProof records support
Scroll horizontally to see all columns.
| Function | Subcategory | What VeriProof records |
|---|---|---|
| GOVERN | GOVERN 2.1: roles, responsibilities, and lines of communication for AI risk are documented and clear | A portal per role with its own permissions, and handoffs that show who received each piece of work and who closed it |
| GOVERN | GOVERN 2.3: executive leadership takes responsibility for decisions about AI risk | Risk acceptances approved by the named business owner, with the decision date and the next review date |
| MAP | MAP 3.5: processes for human oversight are defined, assessed, and documented | The escalation rules that decide which actions need a person, with their version history |
| MEASURE | MEASURE 2.4: the system's functionality and behavior are monitored in production | Allow, Warn, Transform, Escalate, and Deny outcomes from live decisions, with the facts behind each |
| MANAGE | MANAGE 1.3: responses to high-priority risks are planned and documented, including accepting a risk | Remediation assigned with an owner and due date, or a risk acceptance routed to the business owner |
| MANAGE | MANAGE 2.4: mechanisms exist to supersede, disengage, or deactivate a system that isn't performing as intended | Deny and escalate outcomes the application applies before the action runs |
| MANAGE | MANAGE 4.1: post-deployment monitoring covers user input, appeal and override, incident response, and change management | Reviewer overrides, Shadow runs for rule changes, and the approvals your change control requires before a change is enforced |
Subcategory wording is shortened from the AI RMF 1.0 Core. Your team picks the outcomes in its profile. The rest of the Core, such as workforce diversity or third-party risk, runs on your own processes.
A risk acceptance, start to finish
MANAGE 1.3 allows accepting a risk as a documented response. Here is how that works for a claims agent that can approve small payouts without review.
Compliance spots the risk
A control shows that payouts under the review threshold aren't sampled after the fact. Compliance proposes accepting that risk for one quarter instead of lowering the threshold.
It lands with the business owner
The proposal names you, the owner of the claims agent, as the approver. You get the context and reminders until you decide.
The decision is on record
Your approval, its date, and the proposed review date sit with the control. When that date arrives, the accepted risk comes back for review.
Questions about the AI RMF
No. NIST doesn't certify anyone against the AI RMF, and there is no AI RMF certificate to get. The framework is voluntary. Organizations use it to structure their own risk program, and some customers and regulators ask how you apply it.
AI RMF 1.0, published January 2023. NIST is working on a revision, and the mapping will follow it once it's final.
Yes. A reviewer's decision on an escalated action supports MAP 3.5 and MANAGE 4.1 at the same time. Each assessment keeps its own findings.
See where one agent stands
The go-live check covers the same handoffs this page maps: exceptions, rule changes, risk decisions, and audit. It takes eight questions.
Framework source: NIST's AI Risk Management Framework page. Other mappings are in the Compliance Center.