NIST AI Risk Management Framework

The US framework for managing artificial intelligence risk is voluntary and binds no one, which explains both its quick spread and its limits. It sorts the work into four functions, govern, map, measure and manage, with the first running across the other three. It also sets out seven characteristics of a trustworthy system, among them validity, safety, security, accountability, explainability and fairness. On method it adds little, since those functions look like any risk management setup. What it adds is a shared vocabulary. An insurer, an auditor and an operator can finally name the same thing with the same words, in a field where everyone had their own. In underwriting it has become the standard set of questions for policies covering liability tied to an AI system: the insurer asks which functions are documented, not whether the model is good.