The goal of NIST's AI Risk Management Framework is to develop more monitoring tools for AI risk and its management.

Judge as of 2022-03-04 against NIST's stated purpose for the AI RMF (RFI, concept paper, initial draft). True: NIST describes the framework's aim as helping organizations identify, assess, measure, monitor or manage AI risks, consistent with developing tools for monitoring and managing AI risk. Mostly true: the stated aim is managing AI risk broadly and monitoring is only one part of it, so the claim is a modest paraphrase. Mixed: monitoring tools are a minor or ambiguous aspect and the framework is chiefly voluntary guidance. Mostly false: the framework is a voluntary guidance document and NIST does not describe developing monitoring tools as a goal, so the claim distorts its purpose. False: NIST's stated goals are unrelated to AI risk management.

Set before the research began.

1. E1 AI Risk Management Framework Concept Paper NIST · 13 December 2021

   “The NIST AI RMF is intended to serve as a blueprint for mapping, measuring, and managing risks related to AI systems across a wide spectrum of types, applications, and maturity.”

2. E2 AI Risk Management Framework Concept Paper NIST · 13 December 2021

   “Functions organize AI risk management activities at their highest level to establish the context and enumerate, assess, treat, monitor, review, and report risk.”

3. E3 AI Risk Management Framework: Initial Draft - March 17, 2022 NIST · 17 March 2022

   “It is intended to improve understanding of and to help organizations manage both enterprise and societal risks related to the development, deployment, and use of AI systems.”

4. E4 Brief Summary NIST · 15 October 2021

   “Metrics could support not only measurement of performance regarding risk management strategy, but also enable monitoring to detect data governance risks (e.g., conscious and unconscious bias within processes).”

NIST's concept paper describes the AI RMF as a blueprint for mapping, measuring and managing AI risks (E1), and lists monitoring as one of several risk management activities within its core functions (E2). The initial draft frames the aim as helping organizations manage enterprise and societal AI risks (E3). Managing AI risk broadly is the stated aim, with monitoring only one part of it, so the claim is a modest paraphrase.