AI Governance Frameworks
NIST AI RMF, ISO/IEC 42001, internal review boards, and turning principles into gates that actually block.
7concepts
68flashcards
51minutes of reading
- 01 ISO/IEC 42001 and Certifiable Management Systems What a management system standard certifies, why certification is about process consistency rather than model quality, and where it fits alongside a risk framework.
- 02 Risk Tiering and Impact Assessment How to classify AI systems by consequence rather than by technology, what an impact assessment should establish before a system is built, and why the affected-population question is the one that changes designs.
- 03 The NIST AI Risk Management Framework What the four functions of the AI RMF actually ask an organisation to do, why Govern is the one that determines whether the rest happens, and what a voluntary framework can and cannot deliver.
- 04 Third-Party AI Vendor Risk Management Why buying AI moves the risk without moving the accountability, what due diligence can and cannot learn from a model vendor, and the contract and monitoring controls that make a hosted model governable.
- 05 Incident Response for AI Systems Why an AI incident often has no error to page on, what detection has to rely on instead, and the response steps that differ from a conventional outage.
- 06 Model Risk Management from SR 11-7 to SR 26-2 How bank model risk management built validation around effective challenge, why the 2026 rewrite made it principles-based and pushed generative AI out of scope, and how its three validation components still carry over to LLM systems.
- 07 Turning Principles into Gates That Block Why AI principles documents change nothing on their own, the properties a gate needs to have force, and the design that keeps a review board from becoming either a bottleneck or a formality.