AI to Production · tool 7 of 9
AI Risk and Governance
AI Risk and Governance: handles bias, privacy, security and regulation before they become incidents.
Best for: Any AI in real use · Time: Days
Domain: Across all domains · Focus area: Planning
How it works
The NIST AI Risk Management Framework organizes the work into four functions: Govern, Map, Measure and Manage. In the EU, the AI Act sets obligations by risk level. Its high-risk dates were moved by the 2026 Digital Omnibus: to 2 December 2027 for stand-alone systems and 2 August 2028 for AI in regulated products. Transparency duties have applied since 2 August 2026.
- Classify each system by risk.
- Check your role: provider or deployer.
- Ask legal to confirm what applies to you.
How to apply it
- Keep an inventory of AI systems.
- Assess risks for each.
- Add controls, logs and human review.
- Reassess when things change.
A CV-screening tool would fall under employment uses, which the Act treats as high-risk, so it needs much more care than a meeting summarizer.
Regulation moves fast. Check the date on anything you read, including this page.
General information, not legal advice. Check with a qualified adviser.
Use it
- Playbook: Our AI gave a harmful answer
- Case study: Air Canada Chatbot
Quick check
What are the four NIST AI RMF functions?
Sources
Last reviewed 2026-11-02 against the PMBOK® Guide, 8th edition · Practitioner review pending · How this guide is made