NIST AI RMF GOVERN

A culture and structure for managing AI risk

By Jorge García Aibar Reviewed 2026-09-19

From clause to evidence Build the artefact, then file every output it produces as a record that names AIGE-OBL-NISTRMF-GOVERN. Drawn from chapter 08.

Text alternative

Clause: NIST AI RMF, GOVERN.
Duty holder: Not stated.
Applies from: No date, Voluntary.
Artefact: Policy-as-code.
Layers: Layer 01, Layer 02.
Evidence record: Policy card, +5 more.
Record schemas: Policy card , Decommissioning runbook , Agent register entry , Vendor due-diligence response , Training record , AI system register entry .
The same topic in 24 other frameworks; the crosswalk section below links each clause.

Id: AIGE-OBL-NISTRMF-GOVERN
Instrument: NIST AI RMF framework
Compared side by side: NIST AI RMF vs ISO 42001 · NIST AI RMF vs EU AI Act
Clause: GOVERN
Applies from: No date Voluntary · Voluntary (AI RMF 1.0, January 2023)

The artefact that evidences it

Policy-as-code; operating model; registry ownership.

L1 Govern-as-Code
L2 Inventory & Transparency

Patterns that build it

Policy Card (layer 1)
Continuous Assurance Telemetry (layer 5)
Framework Crosswalk (layer 1 and 5)
Machine-Readable Evidence (OSCAL) (layer 5)
Vendor / Model Due-Diligence Gate (layer 2 and 5)
Use-Case Intake & Risk Tiering (layer 1 and 2)
Training-Data Rights Ledger (layer 2)
Model Artefact Integrity (layer 2 and 4)
Rights Requests Against Models (layer 2 and 5)
Sanctioned AI Gateway (layer 4 and 2)
Disclosure & Notification Pipeline (layer 5 and 2)
Deactivation, Localisation & Retirement Runbook (layer 4 and 2)

The same topic in other frameworks

From the topic crosswalk: the clauses filed under the same topics as this one. Mappings are illustrative, not a claim of conformity.

Governance and accountability

EU AI Act Art. 17 Quality management system (core)
ISO 42001 5.1 Leadership and commitment (core)
ISO 42001 5.2 AI policy (core)
ISO 42001 5.3 Roles, responsibilities and authorities (core)
ISO 42001 A.2 Policies related to AI (core)
ISO 42001 A.3 Internal organization (core)
TC260 Framework 3.0 TC260 4 Comprehensive governance measures (core)
TC260 Framework 3.0 TC260 5.3.12 Traceable chain of responsibility (core)
China GenAI Measures GenAI Art. 9 Provider responsibility as content producer (core)
China Algo. Rec. AlgoRec Art. 7 Algorithm-security responsibility system (core)
China Deep Synthesis DeepSyn Art. 7 Information-security responsibility system (core)
GDPR Art. 5(2) Accountability (core)
ISO 42001 9.3 Management review (core) (clause not verified)
CSA AICM GRC-01 Governance Program Policy and Procedures (core)
CSA AICM GRC-06 Governance Responsibility Model (core)
UK ATRS ATRS 2.1 Owner and responsibility (core)
Singapore GenAI GenAI 1 Accountability (core)
Singapore Agentic Agentic 2.2.1 Clear allocation of responsibilities within and outside the organisation (core)
OECD AI Principles OECD 1.5 Accountability (core)
GAO AI Accountability 1.2 Roles and responsibilities: define clear roles, responsibilities, and delegation of authority for the AI system (core)
EU AI Act Art. 4 AI literacy
EU AI Act Art. 87 Reporting of infringements and protection of reporting persons
ISO 42001 7.2 Competence (clause not verified)
ISO 42001 9.2 Internal audit (clause not verified)
ISO 42001 10.1 Continual improvement (clause not verified)
GPAI Code Safety C8 Commitment 8: Systemic risk responsibility allocation
Korea AI Act Art. 36 Domestic representative
CoE Convention CoE Art. 9 Accountability and responsibility
G7 Code G7 Action 5 Develop, implement and disclose AI governance and risk-management policies
EN 18286 EN 18286 Quality management system for EU AI Act regulatory purposes
GAO AI Accountability 1.1 Clear goals: define clear goals and objectives for the AI system
GAO AI Accountability 1.3 Values: demonstrate a commitment to values and principles established by the entity

Inventory and registration

EU AI Act Art. 49 Registration (core)
EU AI Act Art. 71 EU database for high-risk AI systems (core)
ISO 42001 A.4 Resources for AI systems (core)
China Algo. Rec. AlgoRec Art. 24 Algorithm filing (core)
China Deep Synthesis DeepSyn Art. 19 Filing for public-opinion services (core)
China GenAI Measures GenAI Art. 17 Algorithm filing (core)
UK ATRS ATRS Tier 1 Summary information (the published record) (core)
EU AI Act Art. 6 Classification rules for high-risk AI systems
TC260 Framework 3.0 TC260 App. 2 II.2 Identity and access management
TC260 Framework 3.0 TC260 4.4.1 CII registration and filing
EU AI Act Art. 3(1) Definition of an AI system
EU AI Act Art. 52 Procedure
CSA AICM STA-08 Supply Chain Inventory
CSA AICM IAM-03 Identity Inventory
Korea AI Act Art. 33 Confirmation of high-impact AI
GAO AI Accountability 3.1 Documentation: catalog model and non-model components, along with operating specifications and parameters

Human oversight

EU AI Act Art. 14 Human oversight (core)
ISO 42001 A.9 Use of AI systems (core)
NIST AI RMF MANAGE 2.4 MANAGE 2.4: Mechanisms are in place and applied, and responsibilities are assigned and understood, to supersede, disengage, or deactivate AI systems that demonstrate performance or outcomes inconsistent with intended use (core)
TC260 Framework 3.0 TC260 App. 2 II.3 Strengthen human approval (core)
GDPR Art. 22 Automated individual decision-making, including profiling (core)
NIST AI RMF MAP 3.5 MAP 3.5: Processes for human oversight are defined, assessed, and documented in accordance with organizational policies from the GOVERN function (core)
CSA AICM GRC-15 Human supervision (core)
Korea AI Act Art. 34(1)(4) Human management and supervision (core)
UK DUAA UK GDPR Art. 22C Safeguards for automated decision-making (core)
UK ATRS ATRS 2.3.2 Human review (core)
Singapore Agentic Agentic 2.2.2 Design for meaningful human oversight (core)
GAO AI Accountability 3.9 Human supervision: define and develop procedures for human supervision of the AI system (core)
EU AI Act Art. 26 Obligations of deployers of high-risk AI systems
China Algo. Rec. AlgoRec Art. 17 User option to switch off
China GenAI Measures GenAI Art. 10 User guidance and protection
EU AI Act Art. 14(4)(b) Awareness of automation bias
OWASP Agentic ASI09 Human-Agent Trust Exploitation
CoE Convention CoE Art. 8 Transparency and oversight
OECD AI Principles OECD 1.2(b) Human agency and oversight safeguards

Supply chain and third parties

EU AI Act Art. 25 Responsibilities along the AI value chain (core)
ISO 42001 A.10 Third-party and customer relationships (core)
NIST AI RMF MAP 4 MAP 4: Risks and benefits are mapped for all AI system components including third-party software and data (core)
NIST AI RMF MANAGE 3 MANAGE 3: AI risks and benefits from third-party entities are managed (core)
TC260 Framework 3.0 TC260 App. 2 II.4 Supply chain and tool management (core)
EU AI Act Art. 25(4) Written agreement with third-party suppliers (core)
GDPR Art. 28 Processor (core)
NIST AI RMF MANAGE 3.1 MANAGE 3.1: AI risks and benefits from third-party resources are regularly monitored, and risk controls are applied and documented (core)
CSA AICM STA-10 Supply Chain Risk Management (core)
CSA AICM STA-09 Service Bill of Material (BOM) (core)
OWASP LLM LLM04:2026 Supply Chain (core)
OWASP Agentic ASI04 Agentic Supply Chain Vulnerabilities (core)
EU AI Act Art. 26 Obligations of deployers of high-risk AI systems
TC260 Framework 3.0 TC260 4.4.4 Open-source ecosystem
China GenAI Measures GenAI Art. 7 Lawful data and model sources
China Deep Synthesis DeepSyn Art. 14 Providers and technical supporters
EU AI Act Art. 22 Authorised representatives of providers of high-risk AI systems
EU AI Act Art. 23 Obligations of importers
EU AI Act Art. 24 Obligations of distributors
EU AI Act Art. 54 Authorised representatives of providers of general-purpose AI models
GPAI Code Transparency 1.2 Providing relevant information
GDPR Arts. 44–46 Transfers to third countries
UK ATRS ATRS 2.1.4 Third party involvement
G7 Code G7 Action 11 Implement data input measures and protect personal data and intellectual property
GAO AI Accountability 2.6 Dependency: assess interconnectivities and dependencies of data streams that operationalize the AI system

Risk management

EU AI Act Art. 9 Risk management system (core)
ISO 42001 6.1.2 AI risk assessment (core)
ISO 42001 6.1.3 AI risk treatment (core)
ISO 42001 8.2 AI risk assessment (operation) (core)
ISO 42001 8.3 AI risk treatment (operation) (core)
NIST AI RMF MAP 1 MAP 1: Context is established and understood (core)
NIST AI RMF MAP 5 MAP 5: Impacts to individuals, groups, communities, organizations, and society are characterized (core)
NIST AI RMF MANAGE 1 MANAGE 1: AI risks based on assessments and other analytical output are prioritized, responded to, and managed (core)
TC260 Framework 3.0 TC260 2 Classification of AI safety risks (core)
TC260 Framework 3.0 TC260 Summary table Risks × technological × governance measures (core)
ISO 23894 23894 6.4 Risk assessment (core) (clause not verified)
ISO 23894 23894 6.5 Risk treatment (core) (clause not verified)
NIST AI RMF MAP 1.5 MAP 1.5: Organizational risk tolerances are determined and documented (core)
NIST AI RMF MANAGE 1.3 MANAGE 1.3: Responses to the AI risks deemed high priority, as identified by the MAP function, are developed, planned, and documented (core)
NIST AI RMF MANAGE 1.4 MANAGE 1.4: Negative residual risks to both downstream acquirers of AI systems and end users are documented (core)
NIST AI RMF MEASURE 3 MEASURE 3: Mechanisms for tracking identified AI risks over time are in place (core)
CSA AICM GRC-02 Risk Management Program (core)
Korea AI Act Art. 34(1)(1) Risk management plan for high-impact AI (core)
UK ATRS ATRS 2.5.2 Risks and mitigations (core)
Singapore Agentic Agentic 2.1 Assess and bound the risks upfront (core)
CoE Convention CoE Art. 16 Risk and impact management framework (core)
prEN 18228 prEN 18228 AI risk management (draft; supports Art. 9) (core) (clause not verified)
GAO AI Accountability 1.6 Risk management: implement an AI-specific risk management plan to systematically identify, analyze, and mitigate risks (core)
ISO 42001 A.6 AI system life cycle
NIST AI RMF MEASURE 2 MEASURE 2: AI systems are evaluated for trustworthy characteristics
TC260 Framework 3.0 TC260 5.3.19 Re-assessment on material change
China GenAI Measures GenAI Art. 17 Security assessment and algorithm filing
China Algo. Rec. AlgoRec Art. 27 Security assessment
EU AI Act Art. 3 Definitions
ISO 42001 6.1.4 AI system impact assessment
ISO 23894 23894 6.6 Monitoring and review (clause not verified)
GPAI Code Safety C1 Commitment 1: Safety and Security Framework
GPAI Code Safety C3 Commitment 3: Systemic risk analysis
CSA AICM MDS-12 Open Model Risk Assessment
OECD AI Principles OECD 1.5(c) Systematic risk management at each lifecycle phase

Incident response and monitoring

EU AI Act Art. 72 Post-market monitoring by providers and post-market monitoring plan (core)
EU AI Act Art. 73 Reporting of serious incidents (core)
ISO 42001 A.8 Information for interested parties (core)
ISO 42001 10.2 Nonconformity and corrective action (core)
NIST AI RMF MANAGE 4 MANAGE 4: Risk treatments, including response and recovery, and communication plans for the identified and measured AI risks are documented and monitored (core)
TC260 Framework 3.0 TC260 5.3.7 Real-time risk monitoring (core)
TC260 Framework 3.0 TC260 5.3.18 Incident reporting (core)
China GenAI Measures GenAI Art. 14 Handle and report unlawful content (core)
China GenAI Measures GenAI Art. 15 Complaint and reporting mechanism (core)
EU AI Act Art. 26(5) Deployer monitoring, informing the provider and suspending use (core)
GPAI Code Safety C9 Commitment 9: Serious incident reporting (core)
GDPR Arts. 33–34 Notification and communication of a personal data breach (core)
NIST AI RMF MANAGE 4.3 MANAGE 4.3: Incidents and errors are communicated to relevant AI actors, including affected communities. Processes for tracking, responding to, and recovering from incidents and errors are followed and documented (core)
CSA AICM SEF-07 Incident Management and Response (core)
CSA AICM SEF-08 Security Breach Notification (core)
Korea AI Act Art. 32(1) Safety duties for AI above the compute threshold (core)
Singapore GenAI GenAI 4 Incident Reporting (core)
Singapore Agentic Agentic 2.3.3 When deploying, continuously monitor and test (core)
G7 Code G7 Action 2 Identify and mitigate vulnerabilities, incidents and misuse after deployment (core)
G7 Code G7 Action 4 Responsible information sharing and reporting of incidents (core)
GAO AI Accountability 4.1 Planning: develop plans for continuous or routine monitoring of the AI system (core)
GAO AI Accountability 4.2 Drift: establish the range of data and model drift that is acceptable (core)
EU AI Act Art. 55 Obligations for providers of general-purpose AI models with systemic risk
TC260 Framework 3.0 TC260 App. 2 II.6 Emergency plans
China Algo. Rec. AlgoRec Art. 7 Security management and emergency response
EU AI Act Art. 3(49) Definition of serious incident
EU AI Act Art. 20 Corrective actions and duty of information
GPAI Code Safety 3.5 Measure 3.5: Post-market monitoring
NIST AI RMF MANAGE 2.4 MANAGE 2.4: Mechanisms are in place and applied, and responsibilities are assigned and understood, to supersede, disengage, or deactivate AI systems that demonstrate performance or outcomes inconsistent with intended use

Prohibited practices

EU AI Act Art. 5 Prohibited AI practices (core)
CoE Convention CoE Art. 16(4) Assess the need for a moratorium, ban or other measures for incompatible uses (core)
ISO 42001 A.9.4 Intended use of the AI system (clause not verified)
CSA AICM GRC-09 Acceptable Use of the AI Service
CSA AICM HRS-15 AI Acceptable Use
Singapore Agentic Agentic 2.1.1 Determine suitable use cases for agent deployment
China GenAI Measures GenAI Art. 4 Prohibited content and baseline duties

Fairness and non-discrimination

EU AI Act Art. 10(2)(f)–(g) Examination for possible biases; measures to detect, prevent and mitigate them (core)
EU AI Act Art. 4a Special-category data for bias detection (core)
GDPR Art. 5(1)(a) Lawfulness, fairness and transparency (core)
NIST AI RMF MEASURE 2.11 MEASURE 2.11: Fairness and bias as identified in the MAP function are evaluated and results are documented (core)
CSA AICM GRC-11 Bias and Fairness Assessment (core)
CoE Convention CoE Art. 10 Equality and non-discrimination (core)
China GenAI Measures GenAI Art. 4(2) Prevent discrimination in design, data, training and service (core)
GAO AI Accountability 2.7 Bias: assess reliability, quality, and representativeness of the data used in operation, including potential biases (core)
GAO AI Accountability 3.8 Bias: identify potential biases, inequities, and other societal concerns resulting from the AI system (core)
GDPR Art. 9 Processing of special categories of personal data
ISO 42001 A.5.4 Assessing AI system impact on individuals or groups of individuals (clause not verified)
UK ATRS ATRS 2.4.2 Model specification
OECD AI Principles OECD 1.2 Rule of law, human rights and democratic values, including fairness and privacy
China Algo. Rec. AlgoRec Art. 21 No unreasonable differential treatment in trading conditions

AI literacy and competence

EU AI Act Art. 4 AI literacy (core)
ISO 42001 7.2 Competence (core) (clause not verified)
CSA AICM HRS-14 AI Competency Training (core)
Singapore Agentic Agentic 2.4 Enable end-user responsibility (core)
EU AI Act Art. 26(2) Oversight by people with the competence, training and authority it needs
EU AI Act Art. 95(2)(c) Codes of conduct: promoting AI literacy
GDPR Art. 39(1)(b) DPO tasks: awareness-raising and training of staff (clause not verified)
ISO 42001 7.3 Awareness (clause not verified)
NIST AI RMF MAP 3.4 MAP 3.4: Processes for operator and practitioner proficiency with AI system performance and trustworthiness, and relevant technical standards and certifications, are defined, assessed, and documented
CSA AICM HRS-11 Security Awareness Training
UK ATRS ATRS 2.3.4 Required training
Singapore GenAI GenAI 9 AI for Public Good
China GenAI Measures GenAI Art. 10 Guide users to understand and use generative AI rationally
GAO AI Accountability 1.4 Workforce: recruit, develop, and retain personnel with multidisciplinary skills and experiences

IP and copyright

EU AI Act Art. 53(1)(c) Copyright policy, including rights reservations (core)
GPAI Code Copyright 1.1 Draw up, keep up-to-date and implement a copyright policy (core)
GPAI Code Copyright 1.2 Reproduce and extract only lawfully accessible copyright-protected content (core)
GPAI Code Copyright 1.3 Identify and comply with rights reservations when crawling the World Wide Web (core)
GPAI Code Copyright 1.4 Mitigate the risk of copyright-infringing outputs (core)
G7 Code G7 Action 11 Implement data input measures and protect personal data and intellectual property (core)
China GenAI Measures GenAI Art. 7(2) No infringement of IP rights in training data (core)
EU AI Act Art. 53(1)(d) Public summary of the content used for training
GPAI Code Copyright 1.5 Designate a point of contact and enable the lodging of complaints
NIST AI RMF MAP 4.1 MAP 4.1: Approaches for mapping AI technology and legal risks of its components, including the use of third-party data or software, are in place, followed, and documented, as are risks of infringement of a third party's intellectual property or other rights
CSA AICM DSP-20 Data Provenance and Transparency
Singapore GenAI GenAI 2 Data
China GenAI Measures GenAI Art. 4(3) Respect IP rights and business ethics

Agent identity and autonomy

CSA AICM IAM-18 Agent Access Restriction (core)
CSA AICM AIS-11 Agents Security Boundaries (core)
OWASP Agentic ASI03 Identity and Privilege Abuse (core)
OWASP LLM LLM03:2026 Excessive Agency (core)
Singapore Agentic Agentic 2.1.2 Bound risks through design by defining agents limits and permissions (core)
TC260 Framework 3.0 TC260 App. 2 II.2 Identity and access management (core)
EU AI Act Art. 14 Human oversight
CSA AICM IAM-12 Unique Identities
OWASP Agentic ASI02 Tool Misuse and Exploitation
OWASP Agentic ASI07 Insecure Inter-Agent Communication
OWASP Agentic ASI10 Rogue Agents
Singapore Agentic Agentic 2.2.2 Design for meaningful human oversight
TC260 Framework 3.0 TC260 App. 2 II.3 Strengthen human approval

Deployment, change and decommissioning

EU AI Act Art. 26 Obligations of deployers of high-risk AI systems (core)
ISO 42001 A.6.2.5 AI system deployment (core) (clause not verified)
ISO 42001 A.6.2.6 AI system operation and monitoring (core) (clause not verified)
NIST AI RMF MANAGE 2.4 MANAGE 2.4: Mechanisms are in place and applied, and responsibilities are assigned and understood, to supersede, disengage, or deactivate AI systems that demonstrate performance or outcomes inconsistent with intended use (core)
NIST AI RMF MANAGE 4.1 MANAGE 4.1: Post-deployment AI system monitoring plans are implemented, including mechanisms for capturing and evaluating input from users and other relevant AI actors, appeal and override, decommissioning, incident response, recovery, and change management (core)
CSA AICM AIS-06 Secure Application Deployment (core)
EU AI Act Art. 25 Responsibilities along the AI value chain
EU AI Act Art. 43(4) New conformity assessment on substantial modification
EU AI Act Art. 20 Corrective actions and duty of information
EU AI Act Art. 79 Procedure at national level for dealing with AI systems presenting a risk
EU AI Act Art. 86 Right to explanation of individual decision-making
ISO 42001 A.9 Use of AI systems
CSA AICM CCC-01 Change Management Policy and Procedures
CSA AICM DSP-02 Secure Disposal
Singapore Agentic Agentic 2.3.3 When deploying, continuously monitor and test
CoE Convention CoE Art. 16(2)(g) Testing before first use and when significantly modified
OECD AI Principles OECD 1.4 Robustness, security and safety
TC260 Framework 3.0 TC260 5.3 Operators' safety guidelines
TC260 Framework 3.0 TC260 5.3.19 Re-assessment on material change
GAO AI Accountability 4.4 Ongoing assessment: assess the utility of the AI system to ensure its relevance to the current context
GAO AI Accountability 4.5 Scaling: identify conditions, if any, under which the AI system may be scaled or expanded beyond its current use

Open controls that evidence it

Draft controls in the open control profiles that map to this row: each states a requirement and the evidence it must leave behind.

AIGE-CTL-ASSURE-005 Live Control Status from the Assurance Store (Assurance and evidence profile)
AIGE-CTL-ASSURE-007 Machine-Readable Evidence in OSCAL (Assurance and evidence profile)

Source

Chapter 08, section NIST AI RMF, checked against its sources on the review date above.

Machine-readable

This obligation: /api/v1/obligations/aige-obl-nistrmf-govern.json
The register: /api/v1/obligations.json · CSV
Schema and stability promise: open data and API

Cite this obligation

García Aibar, J. (2026). NIST AI RMF GOVERN (AIGE-OBL-NISTRMF-GOVERN). In AI Governance Engineering: The Thesis & Body of Knowledge (v0.5.0). https://doi.org/10.5281/zenodo.22956197. https://aigovernanceengineer.com/obligations/aige-obl-nistrmf-govern. CC BY 4.0

BibTeX

@misc{aige2026obligation,
  author       = {Jorge García Aibar},
  title        = {{NIST AI RMF GOVERN (AIGE-OBL-NISTRMF-GOVERN)}},
  howpublished = {In AI Governance Engineering: The Thesis \& Body of Knowledge},
  year         = {2026},
  version      = {0.5.0},
  doi          = {10.5281/zenodo.22956197},
  url          = {https://aigovernanceengineer.com/obligations/aige-obl-nistrmf-govern},
  note         = {Version 0.5.0}
}