All articles
AI GRC
First steps with the NIST AI Risk Management Framework
, 7 min read
Govern, Map, Measure, Manage: how GRC teams are starting to apply the AI RMF to real products.
The NIST AI RMF organises AI risk work into four functions: Govern, Map, Measure and Manage. It's voluntary, but it's quickly becoming the common language between GRC teams and product teams.
A practical starting point is Map: write down what the AI system does, who uses it, what data it touches and what could go wrong. That inventory drives everything else.
From there, pick a small number of measurable risks, agree who owns them and review them on a schedule, just as you would for any other control.
