Part 0 NIST AI RMF Core: GOVERN 4.2

Assessment Header & Identification

Establish the formal identification, system classification, and accountable roles for this AI Impact Assessment before proceeding to system mapping.

Part 1 NIST AI RMF: MAP 1.1, MAP 2.1

AI System Overview & Context of Use

Define system capabilities, operational context, human oversight boundaries, and available non-AI alternatives.

1.1 System Purpose & Tasks

1.2 Context of Use & Alternatives

1.3 Intended Users & Operators

User / Operator Group Role in System Estimated Count Technical Literacy Action

1.4 Human-AI Configuration & Oversight

Part 2 NIST AI RMF: MAP 1.3, MAP 1.4

Organizational Mission Alignment & Values

Verify that the AI system supports strategic objectives and aligns with fundamental trustworthy AI values.

Societal Values Alignment Verification

Trustworthy AI Value Aligned? Evidence & Operational Controls
Part 3 NIST AI RMF: MAP 1.5, GOVERN 1.1

Risk Tolerance & Legal Review

Document legal compliance requirements, sign-offs, risk thresholds, and explicitly prohibited off-label uses.

3.1 Legal & Regulatory Compliance Review

Requirement Area Applicable? Specific Law / Regulation Compliance Status Action

3.2 Organizational Risk Appetite & Prohibitions

Part 4 NIST AI RMF: MAP 3.1

Potential Benefits & Evidence Base

Quantify expected organizational, consumer, and societal utility, and evaluate empirical evidence reliability.

4.1 Intended Benefits Matrix

Intended Benefit Beneficiary Group How Measured (Metric) Confidence Level Action

4.2 Equity Impact & Evidence Validation

Part 5 NIST AI RMF: MAP 3.2, MAP 5.1

Potential Harms & Interactive Risk Scoring Matrix

Profile specific harm mechanisms, evaluate likelihood and severity, and calculate standardized risk scores.

5.1 & 5.2 Identified Harms & Risk Calculator

Likelihood (1–5) × Impact (1–5) = Risk Score (1–25). Scores update live.

ID Harm Description & Failure Mechanism Affected Group & Asset Dimension Likelihood (1–5) Impact (1–5) Score Risk Level Action
1–6 Low: Routine monitoring
7–12 Medium: Mitigations required
13–19 High: Active controls & escalation
20–25 Critical: Blocks deployment

5.3 Systemic, Multi-Agent & Lifecycle Harms

Part 6 NIST AI RMF: MANAGE 1.3

Risk Mitigation Plan & Residual Risk Acceptance

Specify active mitigations for all Medium, High, and Critical harms, assign accountable owners, and record accepted residual risks.

6.1 Mitigation Controls by Harm ID

Harm ID Response Type Concrete Mitigation Control Owner Target Date Residual Risk Action

6.2 Formally Accepted Residual Risks

Harm ID Residual Level Acceptance Rationale Accepted By (Role) Date Action
Part 7 NIST AI RMF: MAP 5.2, GOVERN 5.1

Stakeholder Consultations & Quality Verification

Document direct engagement with affected populations, frontline operators, domain experts, and marginalized groups.

7.1 Stakeholder Engagement Log

Stakeholder Group Type Method Date Key Feedback Received Action

7.2 Meaningful Engagement Quality Check

Quality Criterion Met? Evidence & Action Taken
Part 8 NIST AI RMF: MAP 2.3, MEASURE 1.1

TEVV Summary & Quantitative Benchmarks

Review independent Test, Evaluation, Verification, and Validation (TEVV) results and metric thresholds.

8.1 TEVV Activities Conducted

TEVV Activity Completed? Date Conducted By Key Findings & Observations Action

8.2 Key Performance & Trustworthiness Metrics

Metric Name Required Threshold Actual Test Result Pass / Fail Action
Part 9 NIST AI RMF: MANAGE 1.1

Go / No-Go Deployment Recommendation

Synthesize findings across all pillars to issue an evidence-backed deployment recommendation.

9.1 Executive Summary Scorecard

9.2 Formal Recommendation

Part 10 NIST AI RMF: GOVERN 2.1, 4.1

Accountability Sign-Off & Approvals

Formal sign-off matrix across mandatory veto holders and accountable officers.

Role Signatory Name Decision Conditions / Notes Date Digital Signature / Stamp
Independence Note (NIST MANAGE 1.1): A veto (Rejection) from the AI Ethics Officer, AI Risk Officer, or Legal & Compliance blocks deployment regardless of business timeline or executive pressure.

Assessment Ready for Audit Submission

You can export this completed assessment to an Executive PDF report or Markdown file.