Procurement workflow surface

NIST AI Risk Management Framework — provisions explorer

A procurement officer evaluating a vendor against NIST AI Risk Management Framework can use this page to walk the operative articles + paragraphs the instrument touches, anchored to the primary source. Each row groups every coverage cell that names that article so the reader sees WHICH governance topic each clause speaks to. Use it as a checklist scaffold, not as legal advice (see charter §7.4).

MAP 1.1

1 cell

governs
Foundation Models / GPAI
GenAI Profile (NIST AI 600-1, 2024)
Verbatim text:
“Intended purposes, potentially beneficial uses, context-specific laws, norms and expectations, and prospective settings in which the AI system will be deployed are understood and documented.”
Open primary source: NIST AI 100-1

MEASURE 2.9

1 cell

governs
Transparency Obligations
Trustworthy characteristics 5 (transparency) + 6 (explainability)
Verbatim text:
“The AI model is explained, validated, and documented, and AI system output is interpreted within its context — as identified in the MAP function — to inform responsible use and governance.”
Open primary source: NIST AI 100-1
Contract clause language candidates
Candidate language — not legal advice (see /wiki/charter §7.4)
- Vendor shall provide documentation demonstrating compliance with the transparency / disclosure obligations identified at NIST AI Risk Management Framework MEASURE 2.9, including (as applicable) machine-readable provenance markers, model cards, and end-user disclosure flows.

GOVERN 1.3

1 cell

implicit
Catastrophic & Existential Risk
Map 1.1 risk classification covers catastrophic via 'societal' impact tier; GenAI Profile (2024) adds explicit content
Verbatim text:
“Processes, procedures, and practices are in place to determine the needed level of risk management activities based on the organization's risk tolerance.”
Open primary source: NIST AI 100-1

MANAGE 2.4

1 cell

implicit
Agentic AI Governance
Map / Manage functions apply to autonomous systems; no agent-specific profile yet
Verbatim text:
“Mechanisms are in place and applied, and responsibilities are assigned and understood, to supersede, disengage, or deactivate AI systems that demonstrate performance or outcomes inconsistent with intended use.”
Open primary source: NIST AI 100-1

MANAGE 4.1

1 cell

implicit
Individual Redress
Accountability characteristic
Verbatim text:
“Post-deployment AI system monitoring plans are implemented, including mechanisms for capturing and evaluating input from users and other relevant AI actors, appeal and override, and decommissioning.”
Open primary source: NIST AI 100-1

MAP 2.3

1 cell

implicit
Training-Data Rights
Manage 4: data integrity
Verbatim text:
“Scientific integrity and TEVV considerations are identified and documented, including those related to experimental design, data collection and selection (e.g., availability, representativeness, suitability)…”
Open primary source: NIST AI 100-1

MEASURE 2.8

1 cell

implicit
Deepfakes / Synthetic Content
GenAI Profile addresses synthetic content
Verbatim text:
“Risks associated with transparency and accountability — as identified in the MAP function — are examined and documented.”
Open primary source: NIST AI 100-1

Unanchored citations

1 cell

implicit
Synthetic Content Provenance
General framework applies; provenance-specific guidance lives in the GenAI Profile
Verbatim text:
Verbatim text not yet transcribed — see primary source.
Open primary source: NIST AI 100-1

NIST AI Risk Management Framework — provisions explorer