7. AI RMF PROFILES

Category

MANAGE 4: Responses to identified and measured risks are documented and monitored regularly. MANAGE 4.1: Post-deployment system monitoring plans are implemented, including mechanisms for capturing and evaluating user and stakeholder feedback, appeal and override, decommissioning, incident response, and change management. MANAGE 4.2: Measurable continuous improvement activities are integrated into system updates and include regular stakeholder engagement.

Subcategory

AI RMF use case profiles are instantiations of the AI RMF functions, categories, and subcategories for a certain application or use case based on the requirements, risk tolerance, and resources of the Framework user. Examples could be an AI RMF hiring profile or an AI RMF fair housing profile. Profiles may illustrate and offer insights into how risk can be managed at various stages of the AI lifecycle or in specific sector, technology, or end-use applications. A profile assists organizations in deciding how they might best manage AI risk that is well-aligned with their goals, considers legal/regulatory requirements and best practices, and reflects risk management priorities. AI RMF temporal profiles are descriptions of either the current state or the desired, target state of specific AI risk management activities within a given sector, industry, organization, or application context. An AI RMF Current Profile indicates how AI is currently being managed and the related risks in terms of current outcomes. A Target Profile indicates the outcomes needed to achieve the desired or target AI risk management goals. Comparing Current and Target Profiles may reveal gaps to be addressed to meet AI risk management objectives. Action plans can be developed to address these gaps to fulfill a given Category or Subcategory. Prioritizing the mitigation of gaps is driven by the user’s needs and risk management processes. This risk-based approach enables Framework users to compare their approaches and themselves with other stakeholders and to gauge the resources needed (e.g., staffing, funding) to achieve AI risk management goals in a cost-effective, prioritized manner. This Framework does not prescribe Profile templates, allowing for flexibility in implementation. NOTE: NIST welcomes contributions towards development of AI RMF use case profiles as well as current and target profiles. Submissions to be included in the NIST Trustworthy and Responsible AI Resource Center will inform NIST and the broader community about the usefulness of the AI RMF and will likely lead to improvements which can be incorporated into future versions of the framework.