When a US client asks how you govern AI, the question often names a framework: "Do you follow the NIST AI RMF?" A truthful yes means showing how your own controls line up with its four functions. For a business of 50 to 500 people, that mostly means putting in order the owner, policy, register and controls you need anyway.
What it is
In January 2023 the National Institute of Standards and Technology, the US government's standards body, published the AI Risk Management Framework. It is voluntary and applies to any business that builds or uses AI, and there is no certificate for it, so nobody can be "NIST certified" for AI. NIST says version 1.0 is being revised, and in July 2024 it added the generative AI profile described below.
The four functions
The framework sets out the work as four functions, with Govern running across the other three.
Govern
Who is responsible for AI, what the rules are and whether people know them. For a business your size that means a named owner, a written policy, an acceptable use page and a register of tools, which is the core of an AI governance framework for 50 to 500 people.
Map
Understanding where AI is used, for what, and who it affects. In practice that is the register, filled in from what is in use rather than what was approved, with each use described and its risks noted. The register can live in a spreadsheet or in an AI governance platform, and that article covers which suits your size.
Measure
Testing and tracking how each use performs and what could go wrong: accuracy, errors, fairness where people are affected, and whether the tool does the job at all. Measuring AI work and AI hallucinations cover most of what a business using tools needs here.
Manage
Acting on what you found: putting controls in place, ranking what to fix first, responding to incidents and retiring uses that do not work. AI security and the incident route are the core of it.
A checklist for approving a new use
The framework lists the characteristics of AI it considers trustworthy: valid and reliable; safe; secure and resilient; accountable and transparent; explainable and interpretable; privacy-enhanced; and fair, with harmful bias managed. Used as seven questions when someone proposes a new use, they catch most of what goes wrong. Not every one applies to every use: a tool that drafts internal emails needs little thought about explainability, while one that screens job applicants needs all seven.
What the generative AI profile adds
NIST's generative AI profile, published in July 2024, names risks specific to tools like ChatGPT, Copilot and Claude. Among them are confabulation, NIST's word for confident invention; data privacy; information security; intellectual property; and the risks that come from depending on other companies' models and services. For a business using these tools, the profile is a useful list of what to check, and it maps closely onto the articles in this Briefing.
How to line up with it accurately
Because NIST's companion playbook is extensive and written for businesses of every size, do not try to adopt every suggested action. Instead:
- Write one page that takes each of the four functions and lists what you already do under it: the owner, the policy, the register, the tests, the controls and the incident route.
- Mark the gaps, and decide which ones matter for your size and your clients.
- Review that page whenever the AI policy is reviewed.
With that page in place, you can answer a client's question with "we align our AI governance to the NIST AI RMF, and here is how", which is true, checkable and far more convincing than a bare yes.
NIST, ISO 42001 or both
The NIST framework is voluntary, comes from the US government's standards body and has no certificate. ISO 42001 is international and can be certified. ISO 27001 covers the information security half of both. For most businesses of 50 to 500 people, mapping to NIST answers the client question, ISO 27001 carries the security evidence if you hold it, and ISO 42001 waits until a client asks for it by name.
Where this fits
The one-page mapping is a short addition to the policy work in Govern, and keeping it current sits with the governing part of Trackside. It is also the answer to the framework question in a client's security questionnaire.