NIST AI RMF MAP

Context and risk framing for each AI system

By Jorge García Aibar Reviewed 2026-09-19

From clause to evidence Build the artefact, then file every output it produces as a record that names AIGE-OBL-NISTRMF-MAP. Drawn from chapter 08.

Text alternative

Clause: NIST AI RMF, MAP.
Duty holder: Not stated.
Applies from: No date, Voluntary.
Artefact: Threat models.
Layers: Layer 02, Layer 03.
Evidence record: Use-case record, +8 more.
Record schemas: Use-case record , Instructions for use , Model card , Impact assessment , Dataset admission record , Risk register entry , Dataset card , Training record , Design record .
The same topic in 27 other frameworks; the crosswalk section below links each clause.

Id: AIGE-OBL-NISTRMF-MAP
Instrument: NIST AI RMF framework
Compared side by side: NIST AI RMF vs ISO 42001 · NIST AI RMF vs EU AI Act
Clause: MAP
Applies from: No date Voluntary · Voluntary (AI RMF 1.0, January 2023)

The artefact that evidences it

Threat models; use-case and impact mapping; data/model cards.

What this obligation connects to Solid edges are direct relations, dashed ones looser (a case that cites the same article, a framework whose clauses only touch the topic); patterns and controls take the colour of their stack layer. Select a node to open it; the lists below give every relation in full.

Data table: every relation

Relations of AIGE-OBL-NISTRMF-MAP
Family	Item	Relation
Patterns	AI Threat Model	Direct
Patterns	AIBOM	Direct
Patterns	Agent Registry	Direct
Patterns	Dataset Admission Gate	Direct
Patterns	Decision Notice & Contest Path	Direct
Patterns	Downstream Use Register	Direct
Patterns	FRIA-as-Code	Direct
Patterns	Model Card as Control Evidence	Direct
Patterns	Shadow-AI Discovery	Direct
Patterns	Training-Data Rights Ledger	Direct
Patterns	Use-Case Intake & Risk Tiering	Direct
Patterns	Vendor / Model Due-Diligence Gate	Direct
Open controls	AIGE-CTL-ASSURE-012 AI Bill of Materials per Build	Direct
Same crosswalk topic	AI Verify 4.3.1, 4.7.1, 4.2.1, 11.2.1, 8.1.1, 8.2.1, 1.1.6, 1.7.2, 1.1.1, 9.7.1, 5.3.1, 4.5.2, 9.3.1, 10.3.1, 10.3.2, 9.4.1, 9.5.3, 5.1.1, 8.4.1, 8.5.1	Core clause
Same crosswalk topic	CSA AICM GRC-02, MDS-12, GRC-10, DSP-09, DSP-20, DSP-21, MDS-03, MDS-04, STA-10, STA-09, GRC-15, HRS-14, HRS-11	Core clause
Same crosswalk topic	China AI Labelling Label Art. 4, Label Art. 5	Core clause
Same crosswalk topic	China Deep Synthesis DeepSyn Art. 14, DeepSyn Art. 16, DeepSyn Art. 17	Core clause
Same crosswalk topic	China GenAI Measures GenAI Art. 17, GenAI Art. 7, GenAI Art. 8, GenAI Art. 11, GenAI Art. 12, GenAI Art. 19, GenAI Art. 10, GenAI Art. 7(2), GenAI Art. 4(3)	Core clause
Same crosswalk topic	CoE Convention CoE Art. 16, CoE Art. 14(2), CoE Art. 15(2), CoE Art. 8	Core clause
Same crosswalk topic	EU AI Act Art. 9, Art. 3, Art. 27, Art. 10, Art. 10(2)(f)–(g), Art. 4a, Art. 53, Art. 53(1)(c), Art. 5(1)(e), Art. 11, Art. 13, Art. 50, Art. 86, Art. 18, Art. 43, Art. 53(1)(d), Art. 50(2), 50(4), Art. 25, Art. 25(4), Art. 26, Art. 22, Art. 23, Art. 24, Art. 54, Art. 14, Art. 14(4)(b), Art. 4, Art. 26(2), Art. 95(2)(c)	Core clause
Same crosswalk topic	G7 Code G7 Action 3, G7 Action 11	Core clause
Same crosswalk topic	GAO AI Accountability 1.6, 1.5, 2.1, 2.2, 2.4, 2.5, 1.9, 3.5, 1.7, 2.6, 3.9, 1.4	Core clause
Same crosswalk topic	GB/T 45654 GB/T 45654 Corpus security, GB/T 45654 Content labelling	Core clause
Same crosswalk topic	GDPR Art. 35, Art. 36, Art. 5(1)(c), Art. 25, Art. 9, Arts. 13–14, Art. 30, Art. 28, Arts. 44–46, Art. 22, Art. 39(1)(b)	Core clause
Same crosswalk topic	GPAI Code Safety C1, Safety C3, Copyright 1.1–1.5, Transparency 1.1, Transparency 1.2, Copyright 1.1, Copyright 1.2, Copyright 1.3, Copyright 1.4, Copyright 1.5	Core clause
Same crosswalk topic	ISO 23894 23894 6.4, 23894 6.5, 23894 6.6	Core clause
Same crosswalk topic	ISO 42001 6.1.2, 6.1.3, 8.2, 8.3, A.6, 6.1.4, 8.4, A.5, A.7, A.7.3, A.4, 7.5, A.8, A.10, A.9, 7.2, 7.3	Core clause
Same crosswalk topic	ISO 42005 42005 5.8, 42005 6.8, 42005 5.12	Core clause
Same crosswalk topic	Korea AI Act Art. 34(1)(1), Art. 35, Art. 31, Art. 34(1)(2), Art. 34(1)(4)	Core clause
Same crosswalk topic	NIST AI RMF MANAGE 1, GOVERN 1.3, MANAGE 1.3, MANAGE 1.4, MEASURE 3, MEASURE 2, MEASURE 2.10, MEASURE 2.11, MEASURE 2.8, MEASURE 2.9, GOVERN 6, MANAGE 3, MANAGE 3.1, GOVERN 6.2, MANAGE 2.4, GOVERN 3.2, GOVERN 2.2, GOVERN 6.1	Core clause
Same crosswalk topic	OECD AI Principles OECD 1.5(c), OECD 1.3, OECD 1.2(b)	Core clause
Same crosswalk topic	OWASP Agentic ASI04, ASI09	Core clause
Same crosswalk topic	OWASP LLM LLM05:2026, LLM04:2026	Core clause
Same crosswalk topic	Singapore Agentic Agentic 2.1, Agentic 2.2.2, Agentic 2.4	Core clause
Same crosswalk topic	Singapore GenAI GenAI 2, GenAI 3, GenAI 9	Core clause
Same crosswalk topic	TC260 Framework 3.0 TC260 2, TC260 Summary table, TC260 5.3.19, TC260 Appendix 1, TC260 2.2, TC260 2.1.3, TC260 5.1, TC260 App. 2 II.4, TC260 4.4.4, TC260 App. 2 II.3	Core clause
Same crosswalk topic	UK ATRS ATRS 2.5.2, ATRS 2.5.1, ATRS 2.4.3, ATRS Tier 1, ATRS 2.2, ATRS 2.1.4, ATRS 2.3.2, ATRS 2.3.4	Core clause
Same crosswalk topic	UK DUAA UK GDPR Art. 22C	Core clause
Same crosswalk topic	prEN 18228 prEN 18228	Core clause
Same crosswalk topic	China Algo. Rec. AlgoRec Art. 27, AlgoRec Art. 16, AlgoRec Art. 17	Related clause

Patterns that build it

Agent Registry (layer 2)
AIBOM (layer 2)
Model Card as Control Evidence (layer 2)
FRIA-as-Code (layer 1 and 2)
Shadow-AI Discovery (layer 2)
Vendor / Model Due-Diligence Gate (layer 2 and 5)
Use-Case Intake & Risk Tiering (layer 1 and 2)
AI Threat Model (layer 1 and 3)
Training-Data Rights Ledger (layer 2)
Dataset Admission Gate (layer 1 and 2)
Decision Notice & Contest Path (layer 4 and 5)
Downstream Use Register (layer 2 and 1)

The same topic in other frameworks

From the topic crosswalk: the clauses filed under the same topics as this one. Mappings are illustrative, not a claim of conformity.

Open controls that evidence it

Draft controls in the open control profiles that map to this row: each states a requirement and the evidence it must leave behind.

AIGE-CTL-ASSURE-012 AI Bill of Materials per Build (Assurance and evidence profile)

Source

Chapter 08, section NIST AI RMF, checked against its sources on the review date above.

Machine-readable

This obligation: /api/v1/obligations/aige-obl-nistrmf-map.json
The register: /api/v1/obligations.json · CSV
Schema and stability promise: open data and API

Cite this obligation

García Aibar, J. (2026). NIST AI RMF MAP (AIGE-OBL-NISTRMF-MAP). In AI Governance Engineering: The Thesis & Body of Knowledge (v0.5.0). https://doi.org/10.5281/zenodo.22956197. https://aigovernanceengineer.com/obligations/aige-obl-nistrmf-map. CC BY 4.0

BibTeX

@misc{aige2026obligation,
  author       = {Jorge García Aibar},
  title        = {{NIST AI RMF MAP (AIGE-OBL-NISTRMF-MAP)}},
  howpublished = {In AI Governance Engineering: The Thesis \& Body of Knowledge},
  year         = {2026},
  version      = {0.5.0},
  doi          = {10.5281/zenodo.22956197},
  url          = {https://aigovernanceengineer.com/obligations/aige-obl-nistrmf-map},
  note         = {Version 0.5.0}
}