Workday is using the AI RMF to assess, refine, 

and strengthen our approach to trustworthy 

AI. Workday has benchmarked our common 

control framework to the AI RMF, augmenting 

guidelines, policies, and procedures and 

developing plans for further alignment where 

needed.

Workday has anchored our new responsible AI 

guidelines, product risk evaluation, and thirdparty risk questionnaire in the AI RMF. 

Workday has used the AI RMF as a common 

reference point for Product & Technology, 

Responsible AI, Product Legal, and Data Privacy 

& Engineering teams to collaborate on AI risk 

management. 

Workday was an early champion of the AI RMF 

and participated in every stage of its open, 

multi-stakeholder development process. When 

NIST launched the AI RMF 1.0 in January 2023, 

Workday’s Co-President Sayan Chakraborty 

endorsed it as a “major milestone” in AI 

governance.

With support from senior leadership, and 

informed by our experience using the NIST 

Cybersecurity and Privacy Frameworks, Workday 

began using the AI RMF to map, measure, 

manage, and govern potential AI risk.

Workday’s Privacy & Data Engineering team first 

mapped the AI RMF to our existing common 

control framework. In doing so, they identified 

existing controls and processes corresponding 

to the AI RMF’s categories and subcategories, 

Using the AI Risk Management Framework 

Workday

Benefits of Using the Framework

Situation & Drivers

Process

Workday is a provider of enterprise cloud 

applications and an AI developer. Our 

applications for financial management, human 

resources, planning, spend management, and 

analytics are built with AI and ML at the core to 

help organizations around the world embrace 

the future of work. 

Workday is used by more than 10,000 

organizations around the world and across 

industries—from medium-sized businesses to 

more than 50% of the Fortune 500.

Our customers trust us with some of their 

most sensitive data, and upholding that trust 

is essential to Workday’s business. Earning and 

retaining our customers’ trust is aligned with 

our core values and facilitates the adoption 

of innovative AI tools by the world’s leading 

organizations.

When Workday uses an AI tool that we have 

either developed or procured from a third-

“As business leaders begin their AI journey, 

many are looking for a roadmap for how to 

develop and use AI in a way that is responsible 

and innovative. At Workday, we’ve found the 

NIST AI Risk Management Framework to be a 

concrete benchmark for mapping, measuring, 

and managing our approach to AI governance. 

We believe the Framework will help us 

maintain our customers’ trust and stay true to 

our company’s core values as we leverage it to 

innovate going forward”. 

Jim Stratton, Chief Technology Officer, Workday

party and interacts with end-users, we are an AI 

deployer.

With AI best practices and technical standards 

continuing to mature, the AI RMF is an essential 

benchmark for AI developers and deployers. 

Workday uses the AI RMF to assess and refine 

our responsible AI practices and to communicate 

the rigor of our AI governance approach to our 

enterprise customers. 

With leaders in the U.S., Europe, Canada, 

Singapore, and elsewhere taking action to 

promote trustworthy AI, the AI RMF is a common 

language to understand the expectations and 

requirements of AI governance.

The voluntary NIST AI Risk Management Framework was 

developed through a collaborative process by industry, 

civil society, academia, and government stakeholders. 

The Framework is designed to equip organizations 

and individuals with approaches that increase the 

trustworthiness of AI systems, and to help foster their 

responsible design, development, and deployment. NIST 

does not validate or endorse any individual organization or 

its approach to using the AI RMF.
Workday’s approach to trustworthy AI has been 

refined and strengthened since using the AI RMF, 

including by:

Establishing an AI Advisory Board of Workday’s 

Chief Legal Officer, Chief Technology Officer, 

Chief Compliance Officer, and senior product, 

technology, public policy, and diversity leaders. 

The Board reviews and approves new aspects 

of Workday’s Responsible AI program, advises 

on novel issues, 

and addresses edge 

cases and escalations 

as needed. 

Clarifying separate 

lines of reporting 

for front-line AI 

developers and 

teams tasked with AI 

governance. 

Anchoring Workday’s 

responsible AI guidelines and risk evaluation 

process in the AI RMF’s categories and 

subcategories. Workday is also updating our data 

sheets, the documentation about our AI tools 

that we provide customers.

Building a responsible AI questionnaire to assess 

the third-party AI tools that Workday procures 

from other AI developers. By evaluating various 

aspects of AI development, implementation, and 

usage, this questionnaire helps Workday align 

third-party tools with our ethics principles and 

risk management priorities.

With AI legal requirements, best practices, and 

technical standards maturing, Workday will 

continue using the AI RMF as a reference point 

for how we assess, refine, and strengthen our 

approach to AI governance.

Workday’s Responsible AI team is further 

operationalizing the new guidelines by developing 

templates and standard operating procedures, 

which are informed by and anchored in the AI 

RMF. 

Workday has partnered with the Future of Privacy 

Forum to establish best practices for developers 

and deployers of AI in the workplace. The best 

practices are informed by the AI RMF and call 

on organizations to map, measure, manage, 

and govern AI tools intended for and used in 

consequential employment decisions. 

Next Steps 

Results & Impact

Contact Information & Resources

Contact NIST at: AIframework@nist.gov

NIST AI Risk Management Framework Website: 

nist.gov/itl/ai-risk-management-framework

NIST AI Resource Center: airc.nist.gov/Home

For more information, please visit workday.com or 

email publicpolicy@workday.com

Process Continued

including areas that could be refined.

Workday’s Responsible AI team convened a 

cross-functional group of internal AI stakeholders 

to craft new responsible AI guidelines and update 

how Workday measures a product’s risk profile. 

The guidelines and risk evaluation map to the 

AI RMF and are informed by Workday’s AI ethics 

principles and Towards a Standard for Identifying 

and Managing Bias in Artificial Intelligence (NIST 

SP-1270).

Workday’s Product & Technology, Responsible AI, 

Product Legal, and Privacy & Engineering teams 

documented their roles, responsibilities, and lines 

of communication regarding AI risk management.