NIST AI RMF Measure Function
Measure is the third of the four functions in the NIST AI Risk Management Framework, covering how an organization analyzes, assesses, benchmarks and tracks AI risks using quantitative, qualitative or mixed methods.
Where It Sits
The AI Risk Management Framework is organized into four functions. Govern establishes the culture and processes, Map builds the context in which risks are identified, Measure analyzes and tracks those risks, and Manage allocates resources to treat them. Measure depends on Map having happened, since a risk nobody identified cannot be assessed.
The companion entry for the Govern function covers the first of the four.
What the Function Covers
Selecting appropriate methods and metrics for the risks that Map identified. Evaluating AI systems for trustworthy characteristics, which include validity and reliability, safety, security and resilience, accountability and transparency, explainability and interpretability, privacy, and fairness with harmful bias managed. Establishing mechanisms to track identified risks over time. Then gathering feedback about the efficacy of the measurement itself.
What Monitoring Evidence Can Satisfy
Outcomes concerned with tracking risks over time and with system performance in deployment draw directly on records that operating systems produce. Activity records, enforcement outcomes and deviation counts accrue whether or not anybody is available to assemble them.
Outcomes concerned with evaluating a model’s own characteristics, such as fairness or explainability, need testing rather than observation, and no volume of interaction records substitutes.
Why the Function Is Frequently Underdone
Measurement requires a unit, and programs that treat AI risk qualitatively have nothing to track over time. AI risk quantification (AIRQ) supplies a figure that can move, which is what makes tracking possible rather than aspirational.
Related Terms
Full AI Visibility. Full Control. One Connected Platform.
Enterprise AI is expanding faster than most governance programs can track. Kovrr connects every AI signal across browser, endpoint, network, identity, and vendor systems into a single platform so security, governance, and risk teams work from the same evidence.
