Signal
AI-enabled decisions — minimum assurance pack (NIST AI RMF)
When AI is in the decision chain, procurement and governance should request a small, consistent assurance pack (risk mapping + testing + monitoring) aligned to NIST’s AI Risk Management Framework.
Reader guide
How to read this Signal
Evidence → Uncertainty → Trigger → Decision implication
Each Signal separates the sourced change from what remains uncertain, identifies the trigger to watch and states why it matters to a decision.
See the full Approach →Decision-relevant statements
Key points
What the evidence indicates for the decision.
- →Anchor vendor conversations on measurable risk: intended use, context limits, and failure modes rather than generic ‘accuracy’ claims.
- →Request evidence of pre-deployment testing and post-deployment monitoring (data drift, performance drift, bias/harms) tied to the use-case.
- →Demand traceability: model/versioning, change logs, incident handling, and accountable owners for the system lifecycle.
Control
Actions
Practical next steps if this Signal touches your mandate.
- 01Add an ‘AI Assurance Pack’ annex to supplier questionnaires: intended use; evaluation metrics; red-team results; monitoring plan; incident process; data provenance statement.
- 02Classify AI suppliers by criticality (decision impact) and raise assurance depth only where impact justifies cost.
Source record
Sources and evidence
Publication and access dates are shown with the source record.
- 01NIST — AI Risk Management Framework (AI RMF 1.0) landing page — Published: n/a • Accessed: 26 January 2026
- 02NIST — AI RMF 1.0 (PDF) — Published: 2023 • Accessed: 26 January 2026
Decision brief
Discuss how this affects your decision
We can pressure-test assumptions and map the next verification steps.