US AI governance operations guide
AI governance starts with a reliable inventory and named decisions. A policy without systems, owners and evidence cannot control daily use.
Is NIST a legal requirement?
NIST AI RMF 1.0, its Playbook and the Generative AI Profile are voluntary. They do not certify compliance or replace applicable law.
NIST says AI RMF 1.0 is being updated. Identify the version used and revisit the mapping when NIST publishes a replacement.
FTC advertising standards concern truthful, supported claims. A supplier’s description of safe or accurate AI does not establish that claim for your use.
Worked example. A restricted support-assistant pilot
Fictional example. Beacon Support pilots AI-014 to draft customer replies. Staff must approve each reply before it reaches a customer.
The inventory identifies the model, data, owner and restricted pilot. The supplier review records retention terms and unresolved training-use questions.
The decision allows a synthetic-data pilot only. It names the evidence required before real customer data or automatic sending becomes permitted.
These are linked records, not competing descriptions. Reuse the system reference so a supplier change can be traced into the deployment decision.
The sample demonstrates the format, not a real approval or proof that a supplier’s controls operate.
Map the system and its context
Record the use case, people affected, model or service, data, output, human role, owner, supplier and deployment state. Keep unknown facts visible.
Connect governance to risk work
Use the inventory to decide which systems need testing, supplier review, monitoring, incident preparation or a deeper legal assessment.
- Govern
- Map
- Measure
- Manage
Keep accountable decisions
Record the decision, approver, evidence, conditions, monitoring trigger and next review. The record should show why the system remained allowed, restricted or stopped.
Working checklist and fictional samples
Use this checklist as an operating aid, not an exhaustive legal assessment. Inspect the samples before entering your own facts.
- Register purpose, people affected, owner and deployment state.
- Identify supplier dependencies, data flows and material unknowns.
- Choose use-specific tests and preserve failures as well as successes.
- Approve, restrict or stop through a named decision-maker.
- Set monitoring, incident and change-review triggers.
- Retain retirement evidence when use ends. This is a suggested workflow, not a mandatory NIST sequence.
- Fictional US AI inventory PDF. Inspect one system record and its evidence gaps. It is not NIST certification.
- Fictional US AI supplier review PDF. Inspect review subjects, supplier evidence and unresolved actions.
Material reviewed for this guide
- Artificial Intelligence Risk Management Framework 1.0National Institute of Standards and Technology · Voluntary framework or implementation guidance · Checked 2026-09-03
- AI Risk Management Framework PlaybookNational Institute of Standards and Technology · Voluntary framework or implementation guidance · Checked 2026-09-03
- Generative Artificial Intelligence ProfileNational Institute of Standards and Technology · Voluntary framework or implementation guidance · Checked 2026-09-03
- Advertising and Marketing BasicsFederal Trade Commission · Guidance explaining enforceable advertising standards · Checked 2026-09-03
This guide is general operational information, not legal advice. Check the official material and obtain appropriate advice for circumstances outside the stated scope.