Artificial Intelligence Risk Management Framework (AI RMF 1.0)
AI RMF Core > Govern

Govern

The GOVERN function:
• cultivates and implements a culture of risk management within organizations design-
ing, developing, deploying, evaluating, or acquiring AI systems;
• outlines processes, documents, and organizational schemes that anticipate, identify,
and manage the risks a system can pose, including to users and others across society
- and procedures to achieve those outcomes;
• incorporates processes to assess potential impacts;
• provides a structure by which AI risk management functions can align with organi-
zational principles, policies, and strategic priorities;
• connects technical aspects of AI system design and development to organizational
values and principles, and enables organizational practices and competencies for the
individuals involved in acquiring, training, deploying, and monitoring such systems;
and
• addresses full product lifecycle and associated processes, including legal and other
issues concerning use of third-party software or hardware systems and data.
GOVERN is a cross-cutting function that is infused throughout AI risk management and
enables the other functions of the process. Aspects of GOVERN, especially those related to
compliance or evaluation, should be integrated into each of the other functions. Attention
to governance is a continual and intrinsic requirement for effective AI risk management
over an AI system's lifespan and the organization's hierarchy.
Strong governance can drive and enhance internal practices and norms to facilitate orga-
nizational risk culture. Governing authorities can determine the overarching policies that
direct an organization's mission, goals, values, culture, and risk tolerance. Senior leader-
ship sets the tone for risk management within an organization, and with it, organizational
culture. Management aligns the technical aspects of AI risk management to policies and
operations. Documentation can enhance transparency, improve human review processes,
and bolster accountability in AI system teams.
After putting in place the structures, systems, processes, and teams described in the GOV-
ERN function, organizations should benefit from a purpose-driven culture focused on risk
understanding and management. It is incumbent on Framework users to continue to ex-
ecute the GOVERN function as knowledge, cultures, and needs or expectations from AI
actors evolve over time.
Practices related to governing AI risks are described in the NIST AI RMF Playbook. Table
1 lists the GOVERN function's categories and subcategories.
Table 1: Categories and subcategories for the GOVERN function.
GOVERN 1:
Policies, processes,
procedures, and
practices across the
organization related
to the mapping,
measuring, and
managing of AI
risks are in place,
transparent, and
implemented
effectively.
GOVERN 1.1: Legal and regulatory requirements involving AI
are understood, managed, and documented.
GOVERN 1.2: The characteristics of trustworthy AI are inte-
grated into organizational policies, processes, procedures, and
practices.
GOVERN 1.3: Processes, procedures, and practices are in place
to determine the needed level of risk management activities based
on the organization's risk tolerance.
GOVERN 1.4: The risk management process and its outcomes are
established through transparent policies, procedures, and other
controls based on organizational risk priorities.