Evidence status: This is a PromptLeash review of external research, not original PromptLeash research or a customer benchmark.
What the evidence indicates
- Responsible AI risk management is an ongoing organisational activity, not a one-time compliance exercise.
- NIST organises the work into Govern, Map, Measure, and Manage functions.
- Measurement needs to connect technical evidence, context, impact, and accountable decisions.
Implications for transformation leaders
- Make governance evidence usable by both technical teams and organisational leaders.
- Track whether controls and capabilities improve as AI use changes.
- Use measurement to decide what to manage next, rather than treating reporting as the endpoint.
Limitations
- The AI RMF is voluntary guidance and does not replace applicable legal or regulatory obligations.
- NIST does not prescribe a single maturity score or implementation sequence.
- PromptLeash methodology is informed by, but is not endorsed or certified by, NIST.
Original sources
- Artificial Intelligence Risk Management Framework - National Institute of Standards and Technology
- NIST AI RMF Playbook - National Institute of Standards and Technology