Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Create an AI risk management plan by setting organization-wide rules, applying them to every AI system you develop or use, and connecting risk assessments to documented decisions and ongoing oversight. NIST’s voluntary AI Risk Management Framework (AI RMF) offers a flexible structure: Govern, Map, Measure, and Manage. Tailor it to your organization’s actual systems, capacity, and applicable laws.
Start with a policy that covers the whole organization
Define what counts as an AI system for your policy and which activities it covers: development, procurement, deployment, and employee use. Include third-party tools and systems already in operation, not just new projects. Set boundaries for intended use and identify who can approve deployment, require changes, accept residual risk, or stop use.
As an Amazon Associate I earn from qualifying purchases.
Connect AI oversight with existing enterprise risk, privacy, data, security, and legal processes. Establish a route for employees and other relevant people to raise concerns, and specify who receives and escalates them. Your policy should state the organization’s risk tolerance, but the appropriate threshold depends on the system’s context and potential impacts.
Use NIST’s AI RMF as an adaptable structure
NIST describes the AI RMF as a voluntary resource for organizations that design, develop, deploy, evaluate, or use AI. Its four functions are Govern, Map, Measure, and Manage. Governance applies across the organization; the other functions are used in system-specific contexts and at relevant lifecycle stages. The framework is designed to be adapted, not treated as a universal checklist. NIST’s Playbook says it is “neither a checklist nor a set of steps to be followed in its entirety.” See the NIST AI RMF overview and NIST AI RMF Playbook.
#1 Best Overall
Build the plan around the system lifecycle
1. Govern: assign ownership and rules
Document who owns AI risk at the organization and for each system. Specify approval authority, escalation paths, required reviews, and which roles can pause or deactivate a system. Set policy expectations for experimental design and data quality, testing and validation, and legal and risk review. NIST’s GOVERN Playbook suggests addressing deployed and third-party AI systems in organizational policy; it does not prescribe one mandatory policy template.
2. Map: document purpose and context
For each system, record enough information to understand what it is meant to do, where and how it will be used, who may be affected, and where it sits in its lifecycle. Capture relevant data, dependencies, participating organizations, and foreseeable impacts. This context helps reviewers identify which risks matter and what evidence is appropriate. NIST does not require one inventory format, so choose documentation your teams can maintain.
Rank #2
3. Measure: assess and record risks
Define how teams identify, analyze, test, validate, and track risks in each context. Match the assessment to the system and its consequences; determine when specialist expertise or input from affected people is needed. Record the methods, evidence, findings, assumptions, and unresolved questions so decision-makers can understand the basis for a recommendation.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsKeep the assessment connected to the system’s intended use. A test result without context is not enough to establish whether a system is appropriate for deployment or whether its controls remain effective.
Rank #3
- Used Book in Good Condition
4. Manage: decide and treat risks
Turn assessment results into an explicit decision: proceed, proceed with conditions, change the system or its use, or do not use it. Prioritize treatment based on potential impact, likelihood, and the resources or methods available. Assign owners and due dates for actions, and document why high-priority risks are being mitigated, transferred, avoided, or accepted. NIST’s Manage guidance describes these response options.
5. Monitor, review, and respond to change
Set a review cadence appropriate to the system and define what events trigger an earlier review, such as a change in use, data, model, vendor, or operating environment. Specify monitoring responsibilities, audit expectations, incident reporting, and response and recovery procedures. Establish who can pause, supersede, or deactivate a system if it behaves outside its approved use or produces unacceptable outcomes. Revisit the context, risks, and controls when the system or its use changes.
Rank #4
6. Identify applicable legal and sector requirements
Build a review step that checks requirements for the relevant jurisdictions, sector, data, users, and use case. NIST notes that legal requirements vary by application and context. The AI RMF is voluntary and does not, by itself, establish that an organization meets applicable legal duties. Have qualified internal or external reviewers assess the requirements that apply to your situation.
Make the plan practical to implement
A plan should produce usable decisions and records, not paperwork that teams cannot sustain. When choosing how to implement it, consider the breadth of systems covered, fit with existing enterprise risk processes, lifecycle monitoring, sector and jurisdiction requirements, organizational capacity, and the evidence and accountability the approach produces. These are useful comparison dimensions, not a ranking of frameworks.
- Use proportional review: Match documentation and assessment depth to the context and potential impact rather than requiring identical treatment for every use.
- Make accountability visible: Name the people or roles responsible for assessment, approval, treatment actions, and ongoing monitoring.
- Preserve decision records: Keep the evidence, findings, risk treatment, approval conditions, and review triggers together so a later reviewer can understand what was decided.
- Connect policy to operations: Make sure procurement, project approval, employee-use guidance, incident handling, and system changes follow the same governance expectations.
Account for generative AI and NIST’s current materials
NIST published NIST-AI-600-1, Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile on July 26, 2024. It can help organizations consider generative-AI-specific risks while aligning risk management with the AI RMF. NIST released AI RMF 1.0 on January 26, 2023, and its overview says the framework is being revised. Check NIST’s current overview and the Generative AI Profile when designing or updating your plan.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
