Pick Your AI RMF

You could use the existing RMF your organization is currently using, but there are some unique risks to AI that would benefit an AI-specific RMF.

Let's list the top 5 in terms of reach and uses.

1. NIST AI RMF 1.0: is a voluntary, guidance-based tool for organizations to manage risks associated with AI systems by integrating trustworthiness considerations into their entire AI lifecycle, from design to deployment and decommissioning

Best Use: Companies and institutions developing, deploying, or using AI systems to ensure their AI is reliable, safe, and ethical. Government agencies seeking to fulfill mandates and ensure national security and public trust.

1. ISO 42001: ISO 42001 provides the best framework for organizations to implement a structured Artificial Intelligence (AI) Management System (AIMS), allowing them to manage risks, ensure compliance, build trust, and foster responsible innovation.

Best Use: Any organization that develops, deploys, or manages AI systems. IT security professionals, risk managers, and compliance officers. Companies seeking to build trust with customers and partners in the AI space.

1. CSA AICM: The AICM is a framework designed to help organizations manage and mitigate security, privacy, and trust risks that are unique to artificial intelligence and machine learning systems.

Best Use: The Cloud Security Alliance (CSA) AI Controls Matrix (AICM) is best used by organizations that develop, deploy, or use AI technologies, particularly those built in cloud environments

1. EU AI Act: Its purpose is to ensure that AI deployed within the European Union is safe, transparent, and respects fundamental rights, while also fostering innovation.

Best Use: The EU AI Act is best used for establishing a comprehensive regulatory framework for Artificial Intelligence (AI) systems based on their potential risk.

1. FAIR-AIR: this framework is intended to help identify AI loss exposure risks and enable risk-based decisions. It does this by using the FAIR techniques of quantitative analysis of risk, modeling, and quantifying cyber risk. The playbook breaks it down into five steps.

Best Use: The framework’s intent is summed up by the conclusion “The purpose of this approach is to meet the business needs, not create additional obstacles to AI deployment.”

There are at least six or more beyond these five, but these seem to be the biggest in use and reach. When deciding on a framework, it is important to look at use-cases and what RMF is going to be fit your needs. When evaluating a vendor’s use of AI, it is critical to measure that against the framework they have chosen to understand their commitment to a secure and stable AI product.