NIST AI RMF GOVERN

A culture and structure for managing AI risk

By Jorge García Aibar Reviewed 2026-09-19

From clause to evidence Build the artefact, then file every output it produces as a record that names AIGE-OBL-NISTRMF-GOVERN. Drawn from chapter 08.

Text alternative

Clause: NIST AI RMF, GOVERN.
Duty holder: Not stated.
Applies from: No date, Voluntary.
Artefact: Policy-as-code.
Layers: Layer 01, Layer 02.
Evidence record: Policy card, +5 more.
Record schemas: Policy card , Decommissioning runbook , Agent register entry , Vendor due-diligence response , Training record , AI system register entry .
The same topic in 25 other frameworks; the crosswalk section below links each clause.

Id: AIGE-OBL-NISTRMF-GOVERN
Instrument: NIST AI RMF framework
Compared side by side: NIST AI RMF vs ISO 42001 · NIST AI RMF vs EU AI Act
Clause: GOVERN
Applies from: No date Voluntary · Voluntary (AI RMF 1.0, January 2023)

The artefact that evidences it

Policy-as-code; operating model; registry ownership.

L1 Govern-as-Code
L2 Inventory & Transparency

What this obligation connects to Solid edges are direct relations, dashed ones looser (a case that cites the same article, a framework whose clauses only touch the topic); patterns and controls take the colour of their stack layer. Select a node to open it; the lists below give every relation in full.

Data table: every relation

Relations of AIGE-OBL-NISTRMF-GOVERN
Family	Item	Relation
Patterns	Continuous Assurance Telemetry	Direct
Patterns	Deactivation, Localisation & Retirement Runbook	Direct
Patterns	Disclosure & Notification Pipeline	Direct
Patterns	Framework Crosswalk	Direct
Patterns	Machine-Readable Evidence (OSCAL)	Direct
Patterns	Model Artefact Integrity	Direct
Patterns	Policy Card	Direct
Patterns	Rights Requests Against Models	Direct
Patterns	Sanctioned AI Gateway	Direct
Patterns	Training-Data Rights Ledger	Direct
Patterns	Use-Case Intake & Risk Tiering	Direct
Patterns	Vendor / Model Due-Diligence Gate	Direct
Open controls	AIGE-CTL-ASSURE-005 Live Control Status from the Assurance Store	Direct
Open controls	AIGE-CTL-ASSURE-007 Machine-Readable Evidence in OSCAL	Direct
Same crosswalk topic	AI Verify 9.1.1, 9.5.2, 9.12.1, 5.5.1, 10.3.1, 10.3.2, 9.4.1, 9.7.1, 5.3.1, 4.5.2, 9.3.1, 4.3.1, 4.7.1, 4.2.1, 9.5.4, 1.5.1, 1.6.1, 5.11.1, 7.1.1, 7.2.1, 7.8.1, 9.5.3, 5.1.1, 8.4.1, 8.5.1, 8.1.1, 5.14.1, 6.5.1, 4.6.1	Core clause
Same crosswalk topic	CSA AICM GRC-01, GRC-06, STA-08, IAM-03, GRC-15, STA-10, STA-09, GRC-02, MDS-12, SEF-07, SEF-08, GRC-09, HRS-15, GRC-11, HRS-14, HRS-11, DSP-20, IAM-18, AIS-11, IAM-12, AIS-06, CCC-01, DSP-02	Core clause
Same crosswalk topic	China Algo. Rec. AlgoRec Art. 7, AlgoRec Art. 24, AlgoRec Art. 17, AlgoRec Art. 27, AlgoRec Art. 21	Core clause
Same crosswalk topic	China Deep Synthesis DeepSyn Art. 7, DeepSyn Art. 19, DeepSyn Art. 14	Core clause
Same crosswalk topic	China GenAI Measures GenAI Art. 9, GenAI Art. 17, GenAI Art. 10, GenAI Art. 7, GenAI Art. 14, GenAI Art. 15, GenAI Art. 4, GenAI Art. 4(2), GenAI Art. 7(2), GenAI Art. 4(3)	Core clause
Same crosswalk topic	CoE Convention CoE Art. 9, CoE Art. 8, CoE Art. 16, CoE Art. 16(4), CoE Art. 10, CoE Art. 16(2)(g)	Core clause
Same crosswalk topic	EU AI Act Art. 17, Art. 4, Art. 87, Art. 49, Art. 71, Art. 6, Art. 3(1), Art. 52, Art. 14, Art. 26, Art. 14(4)(b), Art. 25, Art. 25(4), Art. 22, Art. 23, Art. 24, Art. 54, Art. 9, Art. 3, Art. 72, Art. 73, Art. 26(5), Art. 55, Art. 3(49), Art. 20, Art. 5, Art. 10(2)(f)–(g), Art. 4a, Art. 26(2), Art. 95(2)(c), Art. 53(1)(c), Art. 53(1)(d), Art. 43(4), Art. 79, Art. 86	Core clause
Same crosswalk topic	G7 Code G7 Action 5, G7 Action 11, G7 Action 2, G7 Action 4	Core clause
Same crosswalk topic	GAO AI Accountability 1.2, 1.1, 1.3, 3.1, 3.9, 2.6, 1.6, 4.1, 4.2, 2.7, 3.8, 1.4, 4.4, 4.5	Core clause
Same crosswalk topic	GDPR Art. 5(2), Art. 22, Art. 28, Arts. 44–46, Arts. 33–34, Art. 5(1)(a), Art. 9, Art. 39(1)(b)	Core clause
Same crosswalk topic	GPAI Code Safety C8, Transparency 1.2, Safety C1, Safety C3, Safety C9, Safety 3.5, Copyright 1.1, Copyright 1.2, Copyright 1.3, Copyright 1.4, Copyright 1.5	Core clause
Same crosswalk topic	ISO 23894 23894 6.4, 23894 6.5, 23894 6.6	Core clause
Same crosswalk topic	ISO 42001 5.1, 5.2, 5.3, A.2, A.3, 9.3, 7.2, 9.2, 10.1, A.4, A.9, A.10, 6.1.2, 6.1.3, 8.2, 8.3, A.6, 6.1.4, A.8, 10.2, A.9.4, A.5.4, 7.3, A.6.2.5, A.6.2.6	Core clause
Same crosswalk topic	Korea AI Act Art. 36, Art. 33, Art. 34(1)(4), Art. 34(1)(1), Art. 32(1)	Core clause
Same crosswalk topic	NIST AI RMF MANAGE 2.4, MAP 3.5, MAP 4, MANAGE 3, MANAGE 3.1, MAP 1, MAP 5, MANAGE 1, MAP 1.5, MANAGE 1.3, MANAGE 1.4, MEASURE 3, MEASURE 2, MANAGE 4, MANAGE 4.3, MEASURE 2.11, MAP 3.4, MAP 4.1, MANAGE 4.1	Core clause
Same crosswalk topic	OECD AI Principles OECD 1.5, OECD 1.2(b), OECD 1.5(c), OECD 1.2, OECD 1.4	Core clause
Same crosswalk topic	OWASP Agentic ASI09, ASI04, ASI03, ASI02, ASI07, ASI10	Core clause
Same crosswalk topic	OWASP LLM LLM04:2026, LLM03:2026	Core clause
Same crosswalk topic	Singapore Agentic Agentic 2.2.1, Agentic 2.2.2, Agentic 2.1, Agentic 2.3.3, Agentic 2.1.1, Agentic 2.4, Agentic 2.1.2	Core clause
Same crosswalk topic	Singapore GenAI GenAI 1, GenAI 4, GenAI 9, GenAI 2	Core clause
Same crosswalk topic	TC260 Framework 3.0 TC260 4, TC260 5.3.12, TC260 App. 2 II.2, TC260 4.4.1, TC260 App. 2 II.3, TC260 App. 2 II.4, TC260 4.4.4, TC260 2, TC260 Summary table, TC260 5.3.19, TC260 5.3.7, TC260 5.3.18, TC260 App. 2 II.6, TC260 5.3	Core clause
Same crosswalk topic	UK ATRS ATRS 2.1, ATRS Tier 1, ATRS 2.3.2, ATRS 2.1.4, ATRS 2.5.2, ATRS 2.4.2, ATRS 2.3.4	Core clause
Same crosswalk topic	UK DUAA UK GDPR Art. 22C	Core clause
Same crosswalk topic	prEN 18228 prEN 18228	Core clause
Same crosswalk topic	EN 18286 EN 18286	Related clause

Patterns that build it

Policy Card (layer 1)
Continuous Assurance Telemetry (layer 5)
Framework Crosswalk (layer 1 and 5)
Machine-Readable Evidence (OSCAL) (layer 5)
Vendor / Model Due-Diligence Gate (layer 2 and 5)
Use-Case Intake & Risk Tiering (layer 1 and 2)
Training-Data Rights Ledger (layer 2)
Model Artefact Integrity (layer 2 and 4)
Rights Requests Against Models (layer 2 and 5)
Sanctioned AI Gateway (layer 4 and 2)
Disclosure & Notification Pipeline (layer 5 and 2)
Deactivation, Localisation & Retirement Runbook (layer 4 and 2)

The same topic in other frameworks

From the topic crosswalk: the clauses filed under the same topics as this one. Mappings are illustrative, not a claim of conformity.

Agent identity and autonomy

CSA AICM IAM-18 Agent Access Restriction (core)
CSA AICM AIS-11 Agents Security Boundaries (core)
OWASP Agentic ASI03 Identity and Privilege Abuse (core)
OWASP LLM LLM03:2026 Excessive Agency (core)
Singapore Agentic Agentic 2.1.2 Bound risks through design by defining agents limits and permissions (core)
TC260 Framework 3.0 TC260 App. 2 II.2 Identity and access management (core)
EU AI Act Art. 14 Human oversight
CSA AICM IAM-12 Unique Identities
OWASP Agentic ASI02 Tool Misuse and Exploitation
OWASP Agentic ASI07 Insecure Inter-Agent Communication
OWASP Agentic ASI10 Rogue Agents
Singapore Agentic Agentic 2.2.2 Design for meaningful human oversight
TC260 Framework 3.0 TC260 App. 2 II.3 Strengthen human approval

Deployment, change and decommissioning

EU AI Act Art. 26 Obligations of deployers of high-risk AI systems (core)
ISO 42001 A.6.2.5 AI system deployment (core) (clause not verified)
ISO 42001 A.6.2.6 AI system operation and monitoring (core) (clause not verified)
NIST AI RMF MANAGE 2.4 MANAGE 2.4: Mechanisms are in place and applied, and responsibilities are assigned and understood, to supersede, disengage, or deactivate AI systems that demonstrate performance or outcomes inconsistent with intended use (core)
NIST AI RMF MANAGE 4.1 MANAGE 4.1: Post-deployment AI system monitoring plans are implemented, including mechanisms for capturing and evaluating input from users and other relevant AI actors, appeal and override, decommissioning, incident response, recovery, and change management (core)
CSA AICM AIS-06 Secure Application Deployment (core)
AI Verify 9.4.1 Accountability: a policy to deactivate, decommission and phase out AI systems safely (core)
AI Verify 5.14.1 Security: proper and secure disposal of data and models (core)
AI Verify 6.5.1 Robustness: review changes in code, input data and output data to decide when a new robustness review is due (core)
EU AI Act Art. 25 Responsibilities along the AI value chain
EU AI Act Art. 43(4) New conformity assessment on substantial modification
EU AI Act Art. 20 Corrective actions and duty of information
EU AI Act Art. 79 Procedure at national level for dealing with AI systems presenting a risk
EU AI Act Art. 86 Right to explanation of individual decision-making
ISO 42001 A.9 Use of AI systems
CSA AICM CCC-01 Change Management Policy and Procedures
CSA AICM DSP-02 Secure Disposal
Singapore Agentic Agentic 2.3.3 When deploying, continuously monitor and test
CoE Convention CoE Art. 16(2)(g) Testing before first use and when significantly modified
OECD AI Principles OECD 1.4 Robustness, security and safety
TC260 Framework 3.0 TC260 5.3 Operators' safety guidelines
TC260 Framework 3.0 TC260 5.3.19 Re-assessment on material change
GAO AI Accountability 4.4 Ongoing assessment: assess the utility of the AI system to ensure its relevance to the current context
GAO AI Accountability 4.5 Scaling: identify conditions, if any, under which the AI system may be scaled or expanded beyond its current use
AI Verify 4.6.1 Safety: deployment strategies such as blue-green and canary deployments

Open controls that evidence it

Draft controls in the open control profiles that map to this row: each states a requirement and the evidence it must leave behind.

AIGE-CTL-ASSURE-005 Live Control Status from the Assurance Store (Assurance and evidence profile)
AIGE-CTL-ASSURE-007 Machine-Readable Evidence in OSCAL (Assurance and evidence profile)

Source

Chapter 08, section NIST AI RMF, checked against its sources on the review date above.

Machine-readable

This obligation: /api/v1/obligations/aige-obl-nistrmf-govern.json
The register: /api/v1/obligations.json · CSV
Schema and stability promise: open data and API

Cite this obligation

García Aibar, J. (2026). NIST AI RMF GOVERN (AIGE-OBL-NISTRMF-GOVERN). In AI Governance Engineering: The Thesis & Body of Knowledge (v0.5.0). https://doi.org/10.5281/zenodo.22956197. https://aigovernanceengineer.com/obligations/aige-obl-nistrmf-govern. CC BY 4.0

BibTeX

@misc{aige2026obligation,
  author       = {Jorge García Aibar},
  title        = {{NIST AI RMF GOVERN (AIGE-OBL-NISTRMF-GOVERN)}},
  howpublished = {In AI Governance Engineering: The Thesis \& Body of Knowledge},
  year         = {2026},
  version      = {0.5.0},
  doi          = {10.5281/zenodo.22956197},
  url          = {https://aigovernanceengineer.com/obligations/aige-obl-nistrmf-govern},
  note         = {Version 0.5.0}
}