AI Risk Management: Implementing the NIST AI RMF

Chapter 1: The AI Risk Landscape

• AI adoption trends across enterprise and government environments
• Differences between AI systems and traditional software systems
• AI system lifecycle: data collection, training, deployment, monitoring
• Risk amplification through scale, automation, and data dependency
• Generative AI and large language model (LLM) risk considerations
• Decision automation risks and impacts on business processes
• Ethical, legal, operational, and reputational risk categories
• Real-world examples of AI failures and unintended consequences

Chapter 2: The NIST AI Risk Management Framework

• Overview of AI RMF core functions: Govern, Map, Measure, Manage
• Establishing AI governance structures and accountability models
• Risk categorisation aligned to business and mission impact
• AI system inventory and asset management strategies
• Risk measurement techniques and qualitative vs quantitative methods
• Continuous monitoring and lifecycle risk management
• Communication of AI risk to stakeholders and leadership
• Integration of AI RMF into existing governance frameworks

Chapter 3: Mapping Traditional RMF to AI Systems

• Aligning NIST Risk Management Framework SP 800-37 with AI RMF
• Translating Prepare, Categorise, Select, Implement, Assess, Authorise, Monitor
• Categorising AI systems based on sensitivity and impact
• Selecting controls specific to AI models and data pipelines
• Implementing controls across the AI lifecycle
• Assessing AI systems for performance, fairness, and security
• Authorisation processes for AI deployment
• Continuous monitoring and reassessment strategies

Chapter 4: AI Governance and Organisational Controls

• Establishing AI governance boards and risk committees
• Defining roles and responsibilities across stakeholders
• Developing AI policies, standards, and procedures
• Model lifecycle governance and approval workflows
• Documentation requirements (model cards, data sheets, audit artifacts)
• Risk registers and accountability tracking
• Aligning AI governance with enterprise risk management (ERM)
• Preparing for regulatory and compliance requirements

Chapter 5: AI Risk Identification and Control Implementation

• Identifying AI-specific risks: bias, drift, hallucinations, adversarial threats
• Data quality and training data risk considerations
• Model asset protection, including risks related to model weights and intellectual property
• AI supply chain risks including third-party models, datasets, and dependencies
• Bias detection and mitigation strategies
• Model validation and robustness testing
• Explainability and interpretability requirements
• Technical controls vs governance controls vs operational controls
• Control mapping to risks and measurable outcomes
• Creating audit-ready evidence and documentation

Chapter 6: Explainability, Transparency, and Trust

• Importance of transparency in AI decision-making
• Black-box vs interpretable model trade-offs
• Feature importance and decision traceability
• Explainability techniques such as SHAP and LIME
• Communicating model behavior to technical and non-technical audiences
• Supporting audit, compliance, and legal requirements
• Building trust with stakeholders and end users
• Limitations and risks of explainability methods

Chapter 7: AI Security and Adversarial Risks

• Data poisoning and model poisoning attack vectors
• Adversarial machine learning techniques and evasion attacks
• Model extraction and inference attacks
• Model weight protection and risks associated with model theft and misuse
• Securing AI pipelines, datasets, and training environments
• Secure AI architecture patterns including isolation, restricted interfaces, and controlled environments
• Threat modeling for AI systems
• Integrating AI risks into existing security operations
• Detection and response strategies for AI-specific threats
• Introduction to high-assurance AI security models and emerging practices for protecting sensitive AI systems

Chapter 8: AI Monitoring, Operations, and ISO 42001 Integration

• Detecting model drift and data drift in production systems
• Monitoring performance degradation and reliability issues
• Establishing retraining triggers and lifecycle management processes
• Observability and logging for AI systems
• Overview of ISO/IEC 42001 Artificial Intelligence Management System
• Aligning AI RMF with ISO 42001 control areas
• AI risk maturity models and progression from standard controls to high-assurance environments
• Evaluating when increased isolation and restricted architectures are appropriate
• Continuous improvement and governance maturity models
• Building and sustaining an enterprise AI risk management programme