Large language models
When agencies solicit large language models, OMB M-26-04 requires them to ask for an acceptable use policy, model, system or data cards, resources for end users and a way for those users to give feedback.
AI governance with the NIST AI RMF and ISO/IEC 42001
If your products or your work for agencies use AI, we set up the governance agencies ask about. We build a risk process on the NIST AI RMF and, if you want certification, an ISO/IEC 42001 management system.
A voluntary framework and a certifiable standard
| Framework | What it is | Assessed by | Result |
|---|---|---|---|
| NIST AI RMF 1.0 | A voluntary framework, NIST AI 100-1, with four functions: Govern, Map, Measure and Manage. Govern runs through the other three. NIST is revising it. | No one. You apply it and keep the record. | Your own risk documentation, which a customer or agency can review. |
| ISO/IEC 42001:2023 | A management system standard for organizations that develop, provide or use AI. | An independent certification body; ISO itself certifies no one. ISO/IEC 42006 sets the rules those bodies follow. We prepare you for the audit. | A certificate. |
Sources: NIST AI Risk Management Framework (opens in a new tab) and ISO/IEC 42001:2023 (opens in a new tab).
The AI RMF, category by category
The framework’s four functions hold 19 categories and 72 subcategories. They describe the outcomes an AI program works toward. Select a category to read it.
Govern
19
Map
18
Measure
22
Manage
13
Measure · Table 3
MEASURE 2
AI systems are evaluated for trustworthy characteristics.
13 subcategories
From NIST AI 100-1 (opens in a new tab), Tables 1 to 4.
What agencies ask vendors for
No federal rule requires contractors in general to follow the AI RMF. OMB’s memos direct agencies, and their requirements reach vendors through solicitations and contracts. GSA has drafted a clause that would ask for documentation consistent with the AI RMF; it is not final.
High-impact uses
Under OMB M-25-22, contracts for high-impact AI must ensure the minimum risk management practices, and vendors must give agencies the access and time to evaluate the system independently.
How we set up AI governance
AI inventory
We list the models and AI features you build, buy or run, with what each is for, the data it uses and whether an agency could treat it as high-impact.
Risk process
We write the policies and roles first (Govern), then work through each system: what it is for and where it runs (Map), the tests it needs (Measure) and what you do about each risk (Manage).
- AI risk register
- Risks, tests, owners and the decisions taken, system by system.
Management system
For ISO/IEC 42001 we set up the scope, AI policy, risk and impact assessments, the Annex A controls you select, internal audit and management review, ready for a certification body.
Vendor documentation
The acceptable use policy and the model and system cards agencies ask for, written from how the system works.