What is NIST-AI RMF?
Isn’t it mandatory to understand the consequences of the innovating technologies
first which we are
adapting in our regular work? Along with their benefits. The emergence of Artificial Intelligence is
continuously increasing at the same time, making advancements from the future perspective. It is quite
complex to understand the risks associated with the creation of AI tools by different organizations.
According to the explanation given by the National Institute of Standards and Technology, these risks
associated with AI tools are completely different from the risks associated with the traditional software
development process.
These AI-related issues or risks do not even share similarities with the risk
management frameworks. While
considering all these dis-similarities on January 26, 2023, the NIST released the Artificial Intelligence
Risk Management Framework (AI RMF). This framework was introduced to provide businesses with a risk
management approach for developing an authentic AI system or tool. The integration of this framework made
our AI tools security compliance with the risks associated with AI. This integration provides benefits like
automation of the security processes, behavioral analytics, predictive analytics, instant threat detection,
enhanced decision support, scalability, customized risk assessment, and continuous monitoring.
How does this AI Risk Management Framework operate?
The NIST AI RMF 1.0 or NIST AI framework is designed to increase the trustworthiness
of AI solutions
provided by organizations or individuals. With the use of this framework, organizations can directly work
toward the deployment of secure and responsible AI applications. The AI RMF 1.0 is majorly divided into two
sections in which the first section is foundational information, and the second section is the core and
profile.
1. Fundamental Information
This fundamental section of AI RMF describes some of the potential harms and risks
associated with AI
systems. Along with this, it highlights the challenges that can arise in AI risk management.
Harms associated with AI-Solutions
These harms are caused due to the emergence of AI solutions in the marketplace
without any compliance
standards. These are harm to people as individuals’ civil liabilities, physical safety, economic
opportunities, and other rights. Harm to the organizations as difficulty in organizational operations,
security breaches, and reputational harm. And harm to the ecosystem as a negative impact on both
interconnected and interdependent solutions to various resources. Such as global finances, supply chain,
natural resources, and environmental aspects.
AI Risk Management Challenges
The concept of AI trustworthiness is defined as a limit to which an AI system can
rely upon to operate as
intended while minimizing the risk of unintended problems or consequences. While considering the
trustworthiness of these AI solutions, some of the challenges can be faced during the risk management
process. These are as mentioned further.
Risk measurement
Measuring the risk according to its severity index is considered the major aspect of
handling AI risks.
Undefined or poorly understood AIO risks can lead to challenges in differentiating these risks' static or
subjective nature. According to the NIST AI framework, these measurement challenges can be using different
risk methodologies for AI solutions development from the standard metrics, tracking emergent risks,
real-world settings are different from the laboratory study, and the arrival of different risks at different
stages of the AI lifecycle.
Risk Tolerance
The risk framework is meant to be tolerant and to reinforce current risk management
procedures that are
aligned with legal laws, and standards. The aspects like criteria, tolerance, and response to risk need to
be decided by organization, domain, sector, and discipline. The professional requirements should be followed
by existing organizational guidelines and regulations. In case, where any established do not exist for a
specific sector or application, then the organization must define reasonable risk tolerance criteria. This
AI RMF can be utilized to manage risk as well as a risk management procedure record holder once the risk
tolerance is defined.
Risk Prioritization
Organization/ Amplework holds a responsibility to tackle and prioritize risks
according to their severity.
In this, the AI-solutions development company can prioritize unacceptable negative risk levels as it can be
full of negative imminent impacts. The organization should stop its ongoing operations if this kind of risk
arrives and also such risks need to be documented to inform the end-users about the potential negative
impacts.
Risk Integration & Management
The proper working of this framework requires a collaborative integration of other
risk management assets.
An organization should work towards making the develop and maintaining mandatory procedures for assuring
accountability, assigning roles, and duties, developing an incentive structure, and working on spreading
awareness of such risk management practices
2. Core & Profile
This section of the framework describes the core functionalities and outlines four of
its different
functions. Which are govern, map, measure, and manage. Their work is to assist organizations in addressing
the threats posed by AI systems.
Govern
This function works for developing and implementing a risk management culture within
an organization that
designs, develops, deploys, tests, and acquires AI solutions. Provides a framework from which the AI-risk
management activities can synchronize with organizational policies, strategic priorities, and principles.
Works on considering the entire product lifecycle and addresses everything with this concern. It is denoted
as a cross-cutting function which is connected to other functions of the framework. According to the NIST AI
RMF, this function is divided into six major categories and further into subcategories.
MAP
This function works for establishing the context to frame risks to an AI system. This
enables organizations
to identify potential risks and factors which can reduce the negative impact of these risks. While applying
this function we can expect proper trustworthy AI solution outcomes. This works to enhance user capacity for
understanding the risk management framework and testing their usage context assumptions. This function works
toward the identification of the risks when the AI systems do not operate properly in or outside of their
intended content. Along with this performs tasks like positive identification of existing AI systems,
enhancing knowledge of AL & ML process’s limitations, recognition of practical process limitations,
identifying possible adverse effects from AI intended use, and anticipating the risks of AI systems beyond
the intended use. According to the NIST AI RMF, this function is divided into five major categories and
further into subcategories
Measure
This function adapts different practices to analyze the AI risks and associated
impacts. Which are
quantitative, qualitative, and mixed method tools, techniques, and methodologies. The integration of these
tools results in certain information provided by the MAP function and based on this information guides the
MANAGE function. This makes sure that before and just after deployment AI solutions should be tested. This
AI risk measurement involves documentation of aspects of the system’s functionality and trustworthiness. The
measurement of AI risks involves tracking trustworthiness characteristics metrics, human-AI configuration
rigorous software testing, and performance evaluation procedures with the measurement of uncertainty and
social impact. According to the NIST AI RMF, this function is divided into four major categories and further
into subcategories.
Manage
This function works as a regular assigner of the risk resources to mapped and
measured risks in accordance
with the GOVERN function’s definition. In which the risk treatment involves plans for responding to,
recovering from, and establishing communication about the incident. For the reduction of system failure and
advanced outcomes, a special technique is used. As in this contextual information is collected with the help
of expert consultation and inputs from relevant AI actors. These are developed using the GOVEN function,
carried out in MAP, and used in the MANAGE function. This overall function works towards increasing the
accountability and transparency of the AI risk management process. According to the NIST AI RMF, this
function is divided into four major categories and further into subcategories
Implementing ways of this RMF in our solutions
International Standards
Organizations can start to maintain an alignment with the international standards and
AI-solution
production crosswalks to related standards. NIST works along with the government and industry stakeholders.
Factors like critical standards development activities, strategies, and gaps are considered.
Settlement of AI RMF 1.0 Profiles
The creation of these profiles is considered as a primary method for the
organizations to share particle
examples of AI RMF implementation in regular practices. The development of such profiles is given to the
industry sector, cross-sectoral, temporal, and other topics.
Defining AI- System’s Purpose & Goals
With this step, organizations can start to build trustworthy AI solutions with the
use of NIST AI RMF.
While defining clear goals of systems. This makes companies understand the risks associated with the
intended use of AI systems.
Implementation of NIST AI RMF actionable
The implementation of these actionable guidelines during the development phase of the
AI solution. Which
involves incorporating AI RMF’s four major functions govern, map, measure, and manage in the development
processes of AI solutions.
Regular Monitoring & Testing
The continuous monitoring of these practices works towards ensuring the proper
functionality of RMF
functions to reach defined performance metrics.
Continuous Improvement
With the analyzed data from the practices of monitoring and testing, organizations
can implement changes
for the development of AI solutions. In which the major highlight is to focus on iterative improvement for
managing AI risks effectively.
