1

Comments of the Recording Industry Association of America on the National Institute of 

Standards and Technology Artificial Intelligence Risk Management Framework Second Draft and

the AI Risk Management Framework Playbook each dated August 18, 2022

Delivered via email to aiframework@nist.gov

September 29, 2022

The Recording Industry Association of America (“RIAA”) welcomes this opportunity to provide 

comments to National Institute of Standards and Technology (“NIST”) on its Artificial 

Intelligence Risk Management Framework: Second Draft (“AI RMF”), and the associated AI Risk 

Management Framework Playbook (“AI RMF Playbook”), each dated August 18, 2022.

The RIAA is the trade organization that supports and promotes the creative and commercial 

vitality of music labels in the United States, the most vibrant recorded music community in the 

world. Our membership – which includes several hundred companies, ranging from small-tomedium-sized enterprises to global businesses – creates, manufactures, and/or distributes 

sound recordings representing the majority of all legitimate recorded music consumption in the 

United States. In support of its mission, the RIAA works to protect the intellectual property and 

First Amendment rights of artists and music labels; conducts consumer, industry, and technical 

research; and monitors and reviews state and federal laws, regulations, and policies.

Introduction

As noted in our April 29, 2022 comments, human creative expression is at the core of our 

members’ businesses and is vital to our nation’s culture and economy. The United States 

boasts over one million revenue-generating sound recording artists and songwriters.1 Overall, 

the music industry contributes $170 billion to the nation’s economy, supports 2.47 million jobs,

and accounts for over 236,000 businesses in the United States.2

The heart of all this activity is the creativity of sound recording artists, songwriters, musicians, 

producers, recording engineers, and countless other participants in the music industry that 

bring music to life. Their creative output is protected by copyright, which is both recognized in 

1

Source: http://50statesofmusic.com/?USimpact. 

2

Source: http://50statesofmusic.com/?USimpact. 
2

the U.S. Constitution3 and in the U.N. Universal Declaration of Human Rights.4 Because of the 

importance of copyright in our Constitution, as a human civil right, and to the U.S. economy and 

competitiveness, as well as the importance of the proper functioning of our society in 

accordance with the rule of law, we ask that you take into account the following comments on 

the next version of the AI RMF.

Comments on the AI RMF

Introduction. The AI RMF must better address the risks and best practices concerning 

assessment and compliance with applicable law and regulation generally, and specifically

concerning the use of works covered by third-party intellectual property rights, including 

copyrights, as training data for an AI system. While the AI RMF alludes to the possibility of legal 

risk, the discussion of it is muted. It is only when you get to GOVERN 1.1 on p. 19 that there is a 

clearer statement about the need to understand, manage and document legal and regulatory 

requirements involving AI. It would be better if the AI RMF more clearly acknowledged that risk 

management involves limiting one’s legal risk, including legal risks associated with the use of 

third-party materials. Below are some more specific comments related to these issues.

Section 4.5 – Transparent and Accountable. We appreciate that Section 4.5 of the AI RMF 

states that “Maintaining the provenance of training data and supporting attribution of decisions 

of the AI system to subsets of training data can assist with both transparency and 

accountability.” However, this is insufficient to properly explain some of the risks associated 

with training material. 5 

This section should be expanded to expressly identify that training materials may be subject to 

copyright or other intellectual property rights. It should also explain that maintaining accurate 

information about the provenance of training materials should include information concerning 

the authors of the training materials, where and how the training materials were obtained, if 

the training materials are subject to third-party copyright or other intellectual property rights, 

copies of any licenses obtained that cover the training materials, and the purposes for which 

the training materials are used. 

3 U.S. Const. art. 1, § 8, cl. 8 (“To promote the Progress of Science and useful Arts, by securing for limited Times to 

Authors and Inventors the exclusive Right to their respective Writings and Discoveries;”).

4 art. 27, § 2 (“Everyone has the right to the protection of the moral and material interests resulting from any 

scientific, literary or artistic production of which he is the author”).

5 Unauthorized uses of copyrighted materials for AI are happening every day and harming original creators. See, 

for example, Heikila, Melissa, “This artist is dominating AI-generated art. And he’s not happy about it.” MIT 

Technology Review, Sept. 16, 2022, available at https://www.technologyreview.com/2022/09/16/1059598/thisartist-is-dominating-ai-generated-art-and-hes-not-happy-about-it/, describing the issues with AI art generator 

Stable Diffusion.
3

This section should also promote as a best practice that AI developers obtain licenses or other 

clearances to use any copyrighted training materials for training an AI system, or that they 

instead rely on public domain materials for such training. 

Other Sections. More broadly, the AI RMF should give greater prominence to the importance of 

compliance with applicable law and regulations, and to issues concerning third-party 

intellectual property rights in training materials. In addition to the changes noted above, the AI 

RMF should be modified as follows:

• In Figure 3 in Section 3.1, the language concerning Harm to People: Individual, should be 

modified to read:

“Individual: Harm to a person’s civil liberties (including their intellectual 

property rights), or physical safety.” 

• Section 3.2.1 should expressly identify the risk of infringement of third-party rights if an 

AI Actor uses third-party works as training materials without proper authorization or 

clearances. This can be done by modifying the last sentence of the second paragraph of 

Section 3.2.1 to read:

“Risk measurement and management can be further complicated by how thirdparty data or systems are used or integrated into AI products or services, such as 

whether such third-party data or systems are properly licensed or cleared for 

such use or integration, etc.”

• Section 3.2.4 should identify risk of intellectual property infringement by modifying the 

last sentence of the second paragraph to read:

“Overlapping risks include privacy and intellectual property concerns related to 

the use of underlying data to train AI systems, and security concerns related to 

the confidentiality, integrity and availability of training and output data for AI 

systems.”

• Section 6.1 should expressly state that good governance should also address legal issues 

related to the use of third-party data, software, or hardware, including issues related to 

third-party intellectual property and other rights in their data, software, or hardware. 

To do this, the last sentence of the second paragraph of Section 6.1 should be modified 

to read:

“Governance should address legal and other issues concerning supply chains, 

including obtaining licensing or other clearances to use third-party software or 

hardware systems and data, as well as supply chain issues concerning internally 

developed AI systems.” 

Also, the language for GOVERN 6.1 in Table 2 should be revised to read:

“GOVERN 6.1: Policies and procedures are in place that address risks associated 

with third-party entities, including risks of infringement of a third party’s 

intellectual property or other rights.”
4

• In Section 6.2, the language for MAP 4.1 in Table 3 should be revised to read:

“MAP 4.1: Approaches for mapping technology and legal risks concerning the 

use of third-party data or software are in place and documented, including risks 

of infringement of a third party’s intellectual property or other rights.”

• In Section 6.3, Table 4 should include a measure related to transparency and 

accountability risks. This should expressly address legal and other risks associated with 

third-party data, software, or hardware used to develop, train, or implement the AI 

system.

Comments on the AI RMF Playbook.

The Playbook’s provisions on governance and mapping should be modified to be consistent 

with the comments noted above. 

* * *

We thank NIST for the opportunity to share these views on what should be included in the AI 

RMF and AI RMF Playbook. We look forward to continuing this conversation with NIST and 

other policy makers as AI technology and its impact on the marketplace and society evolves.