AI Actors Across the AI Lifecycle

Revised NIST AI RMF Figure 2

Attachment B:
Plan & 

design

Collect & 

process data

Build & use 

model

Verify & 

validate

Deploy

Operate & 

monitor

Use or 

impacted by

Plan & 

design

Collect & 

process data

Build & use 

model

Verify & 

validate

[Market]

Deployment

Operate & 

monitor

Manage 

Adverse 

Incidents

Procurement

[Buyer]

Deployment

[Buyer]

Deployment

Operate, 

monitor & 

improve

Address 

grievances

BUYER BUYER BUYER BUYER DEVELOPER DEVELOPER DEVELOPER DEVELOPER DEV DEVELOPER DEVELOPER

AI Actors Across the AI Lifecycle

Revised NIST AI RMF Figure 2

Current

Revised

Figure2 of the AI RMF isa helpful guide. I would ask the NIST

AI RMF team to consider the various contexts that are

present in the market today. Here area two examples:

1) Buyer/Seller Partnership: When the buyer commissionsa

highly-customized system from the developer (e.g.,a

health insurance benefits determination system), where

the two parties function asa collaborative team, the

current AI RMF lifecycle framework seems quite fitting.

2) COTS Solution: Ifa seller/developer createsa commercial

off-the-shelf (COTS) solution on their own, withouta

buyer determining the features and functions, (e.g.,a

background check system), the current AI RMF lifecycle

framework may be missing several critical risk-mitigation

steps on the buyer’s side of the risk equation.

Most notably, the procurement process, the deployment

process, operating and monitoring the system, and managing

adverse incidents will not only look different for the buyer but

will also involve different AI actors during those steps of the

AI lifecycle.

Additional details are provided in the following pages.
Plan & 

design

Articulate and document the system’s concept and 

objectives, underlying assumptions, context and 

requirements.

System operators, end-users, domain experts, AI designers, impact 

assessors, TEVV experts, product managers, compliance experts, 

auditors, governance experts, organizational management, end-users, 

affected individuals/communities, evaluators.

Collect & 

process data

Data collection & processing: gather, validate, and clean 

data and document the metadata and characteristics or the 

dataset

Data scientists, domain experts, socio-cultural analysis, human factors 

experts, data engineers, data providers, TEVV experts.

Build & use 

model Create or select, train models or algorithms.

Modelers, model engineers, data scientists, developers, and domain 

experts. With consultation of socio-cultural analysts familiar with the 

application context, TEVV experts.

Verify & 

validate Verify & validate, calibrate, and interpret model output.

Deploy

Pilot, check compatibility with legacy systems, verify 

regulatory compliance, manage organizational change, and 

evaluate user experience.

System integrators, developers, systems/software engineers, domain 

experts, procurement experts, third-party suppliers with consultation of 

human factors experts, socio-cultural analysts, and governance experts, 

TEVV experts, end-users.

Operate & 

monitor

Operate the AI system and continuously assess its 

recommendations and impacts (both intended and 

unintended) in light of objectives and ethical consideration.

System operators, end-users, domain experts, AI designers, impact 

assessors, TEVV experts, product managers, compliance experts, 

auditors, governance experts, organizational management, end-users, 

affected individuals/communities, evaluators.

Use or 

impacted by

Use system/technology; monitor & assess impacts: seek 

mitigation of impacts: advocate for rights.

End-users, affected individuals/communities, general public; policy 

makers, standards organizations, trade associations, advocacy groups, 

environmental groups, civil society organizations, researchers.

NIST AI Actors Across the AI Lifecycle
Plan & 

design

Articulate and document the system’s concept and 

objectives, underlying assumptions, context and 

requirements.

System operators, domain experts, AI designers, impact assessors, TEVV 

experts, product managers, compliance experts, auditors, governance 

experts, organizational management, end-users, affected 

individuals/communities, evaluators.

Collect & 

process data

Data collection & processing: gather, validate, and clean 

data and document the metadata and characteristics or the 

dataset

Data scientists, domain experts, socio-cultural analysis, human factors 

experts, data engineers, data providers, TEVV experts.

Build & use 

model Create or select, train models or algorithms. Modelers, model engineers, data scientists, developers, and domain 

experts. With consultation of socio-cultural analysts familiar with the 

Verify & application context, TEVV experts.

validate Verify & validate, calibrate, and interpret model output.

[Market]

Deployment

Verify regulatory compliance, verify market acceptance of 

U/X, U/I, explainability, interpretability, privacy, security, 

transparency/disclosure features.

System integrators, developers, systems/software engineers, domain 

experts, procurement experts, third-party suppliers with consultation of 

human factors experts, socio-cultural analysts, and governance experts, 

TEVV experts, end-users.

Operate & 

monitor

Track, operate, and monitor the AI system; obtain clear 

consent, provide disclosure of use, continuously assess its 

recommendations and impacts (intended and unintended); 

assure appropriate use and user training, purge aging data.

System operators, domain experts, AI designers, impact assessors, TEVV 

experts, product managers, compliance experts, auditors, governance 

experts, organizational management, end-users, affected 

individuals/communities, evaluators.

Manage 

Adverse 

Incidents

Provide adverse incident user awareness education and 

reporting paths; monitor & assess adverse incidents: seek 

mitigation of incidents: advocate for rights.

End-users, affected individuals/communities, general public; policy 

makers, standards organizations, trade associations, advocacy groups, 

environmental groups, civil society organizations, researchers.

Procurement

Conduct a demo, request for proposal process, verify 

regulatory compliance, verify responsible design, check 

compatibility with intended integration systems, review 

independent security and VPAT audits, contract terms. 

Buyer-side: Procurement, domain experts, System/software engineers, legal/risk 

experts, impact assessors, change management, finance/accounting

Supplier-side: Sales, marketing, implementation staff, product managers, legal, 

finance

[Buyer]

Deployment

Pilot, integrate with other systems, train employees, 

incorporate into governance practices, manage 

organizational change, and evaluate user experience.

System integrators, developers, systems/software engineers, domain 

experts, procurement experts, third-party suppliers with consultation of 

human factors experts, socio-cultural analysts, and governance experts, 

TEVV experts, end-users.

[Buyer]

Deployment

Assist buyer with responsible system configuration, 

administrator training, and user training.

System integrators, domain experts, and governance experts, & TEVV 

experts.

Operate, 

monitor & 

improve

Monitor KPI’s, monitor for algorithmic drift, publish updates, 

notify buyers, provide training and support

System integrators, domain experts, and governance experts, & TEVV 

experts.

Address 

grievances

Log, review, assess, and address individual, group, and 

systemic adverse incidents.

System integrators, developers, systems/software engineers, domain 

experts, product managers, governance experts, affected 

individuals/communities, evaluators.

BUYER BUYER BUYER BUYER DEVELOPER DEVELOPER DEVELOPER DEVELOPER DEV DEVELOPER DEVELOPER

(Revised) AI Actors Across the AI Lifecycle