How Best to Proceed with NIST AI RMF
- Proceed in this order: demonstration requirement, inventory, target maturity, gap assessment, GOVERN, MAP, MEASURE, MANAGE, then the cycle.
- Decide how you will demonstrate adoption before you write anything, because it changes how the documentation is written.
- Set the target maturity early. Nothing else declares the work finished.
- Start MEASURE early, because measurement infrastructure usually has to be built.
- The framework is a cycle. Plan the ongoing loop at the same time as the first pass.
Stage 1: The demonstration requirement
Proceed in this order: work out what you actually need to show and to whom, build the inventory, agree a target maturity, assess the gap, then build GOVERN, MAP, MEASURE and MANAGE, and put the ongoing cycle in place. The common mistake is starting with the policy, because GOVERN is the easiest function to document, which produces an organisation with good policy and nothing behind it.
Before any implementation work, answer one question: what do you need to be able to show, and to whom?
There is no certificate, so the options are a self-attestation, a completed buyer questionnaire answered from evidence, an independent third-party assessment, or certification against ISO/IEC 42001 using the published crosswalk.
That answer changes how everything is documented. Documentation destined for a certification audit is written differently from documentation destined for a questionnaire, and retrofitting is more expensive than deciding early.
Decision: the demonstration route.
Stage 2: Inventory
Every AI system built, bought or used, including AI features inside purchased software. For each: what it does, who owns it, what data it uses, what decisions it influences, who it affects, and whether it is generative.
Ask each department what tools they use that generate content, rank, score or recommend. That question surfaces more than asking whether they use AI.
Decision: none, but the completeness of this list determines whether every later stage is accurate.
Stage 3: Target maturity
The framework has no endpoint, so you have to supply one.
Decide the level you are aiming for, for which systems, by when, and why. That decision is what makes the work finite, and it is the one most often skipped, which is why implementations drift.
Decision: the target, and the test for whether you have reached it.
Stage 4: Gap assessment
A subcategory-by-subcategory position across the 72 subcategories, with the Generative AI Profile applied where large language models are in use. State what is in place, what is not, and what closes each gap.
Prioritise the output by risk rather than by function order. Systems that affect people first, then customer-facing systems, then internal ones.
Decision: the remediation plan and its sequence.
Stage 5: GOVERN
The AI policy, named accountability for each system and overall, a stated risk tolerance, a process for AI you buy, and a mechanism for recording decisions.
Keep this proportionate. GOVERN is the easiest function to over-document and the one where extra length adds least. A short policy that names real people and real processes beats a long one that names neither.
Decision: who is accountable, and what the risk tolerance is.
Stage 6: MAP
Per-system context: intended purpose, foreseeable misuse, affected people, benefits and potential harms, system limits, and the assumptions made about data and deployment.
This is where the useful thinking happens and where documentation either becomes credible or does not. Treat it as an exercise in describing reality rather than completing a form.
Decision: which systems are material, and what the real risks are.
Stage 7: MEASURE
Start this early, in parallel with MAP rather than after it, because measurement infrastructure usually has to be built and that work sits in an engineering backlog.
Decide what gets tested, on what data, with what metric, at what threshold, at what cadence, and what happens when a threshold is crossed. Include monitoring in production, because model behaviour changes.
Where systems were bought rather than built, some measurements sit with your supplier. Ask early what they will provide, because the answer shapes what you can commit to.
Decision: what is measurable, what is not, and what you will do about the gap.
Stage 8: MANAGE
Prioritise the risks, decide treatment, allocate resources, and record the decisions including accepted risks with their reasoning. Plan response and recovery. Establish how incidents are handled and recorded.
Decision: which risks are accepted, by whom, and on what basis.
Stage 9: The cycle
The framework is continuous. New systems get inventoried and mapped. Retrained models get re-measured. Results feed back into risk decisions. Documentation stays current.
Add a gate to procurement and to your launch process so new AI systems arrive already inventoried rather than being discovered later. Two small process changes prevent most of the work that would otherwise recur.
That ongoing loop is our continuous governance and assurance service.
The order in one table
| Stage | Output | Decision that is hard to reverse |
|---|---|---|
| 1. Demonstration requirement | How you will show adoption | The route, since it shapes all documentation |
| 2. Inventory | Complete list of AI systems | None, but completeness determines everything after |
| 3. Target maturity | An agreed level and completion test | The target |
| 4. Gap assessment | Subcategory position and prioritised plan | The remediation sequence |
| 5. GOVERN | Policy, accountability, risk tolerance | Who is accountable |
| 6. MAP | Per-system context and risk records | Which systems are material |
| 7. MEASURE | Test design, results, monitoring | What is measurable and what is not |
| 8. MANAGE | Treatment decisions and records | Which risks are accepted |
| 9. The cycle | A running governance function | Who owns it permanently |
What to do next
Answer stage 1 this week. It is a conversation rather than a project, and it determines how everything else gets written.
Our free AI impact assessment gives an immediate first view, and the NIST AI RMF service page sets out how we run each stage.
References
- National Institute of Standards and Technology, AI Risk Management Framework. https://www.nist.gov/itl/ai-risk-management-framework
- National Institute of Standards and Technology, AI Resource Center. https://www.nist.gov
- International Organization for Standardization, ISO/IEC 42001. https://www.iso.org
FAQ
What is the first step in a NIST AI RMF implementation?
Deciding how you will demonstrate adoption, because that changes how all the documentation is written.
Why set a target maturity?
Because the framework has no endpoint. Without a target the work expands indefinitely and the engagement has no completion test.
When should MEASURE start?
Early, in parallel with MAP. Measurement infrastructure usually has to be built and that work sits in an engineering backlog.
How long does an implementation take?
Two to four weeks for inventory and assessment, two to four months for a first implementation covering a modest estate.
When does the work end?
It does not. The framework is a cycle, so plan the ongoing loop at the same time as the first pass.
About Hael
Hael is an advisory firm specialising in AI governance and security compliance. We do the work, hold the deadline and stand behind the evidence, across the NIST AI Risk Management Framework, ISO/IEC 42001, the EU AI Act, SOC 2 and ISO 27001, and maintain the position afterwards. On engagements involving regulated financial services firms we work alongside Buckingham Capital Consulting, the partner firm that has advised payment and e-money firms on FCA authorisation and compliance since 2013.
This guide is general information and is not professional advice on your particular circumstances.