Your team uses an AI tool to draft replies to customer emails. It saves time. But the emails may contain personal information, and the AI may write something that is wrong. Who checks the replies? What happens to the information entered into the tool?
The NIST AI Risk Management Framework can help your team answer those questions before the tool becomes part of daily work.
NIST is the U.S. National Institute of Standards and Technology. It created the framework to help organizations think through AI risks and decide how to manage them. The framework is voluntary. It is not a law, a certification, or a promise that an AI tool is risk-free. It gives teams a shared way to discuss the use of AI and record their decisions.
Four questions to guide your review
NIST groups its guidance into four areas: Govern, Map, Measure, and Manage. Here is what those words mean for the customer-email example.
1. Govern: Who is responsible?
Choose a person to own the process. Decide which AI tool the team may use and what staff are allowed to do with it. For example, staff may use AI to draft a reply, but a person must check and send it.
2. Map: What is the tool being used for?
Write down the task, the people affected, and the information the tool uses. Does the email contain names, contact details, or account information? Does the tool provider keep the information or use it in other ways? Check the tool’s current settings and terms.
3. Measure: What could go wrong?
Try the tool on sample emails. Check whether it invents details, misses important information, includes private information, or writes a reply that could upset or mislead a customer. Keep a record of what you tested and what you found.
4. Manage: What will you do about the results?
Decide whether to use the tool, limit its use, or pause. Set rules based on what you found. For example, staff could remove personal details before using AI and check every draft before sending it. Decide who handles mistakes and when the team will review the process again.
A one-page review your team can start today
For one AI task, write down:
- The task and the reason for using AI
- The tool and the settings your team will use
- The information staff may enter
- Who could be affected by the result
- What you tested and what happened
- Who checks the AI’s work
- Who owns the process and when it will be reviewed
You do not need to assess every possible AI tool at once. Start with one task. Review it before launch, then revisit it if the tool, information, or way of working changes.
The NIST framework helps organize a review. It does not decide for you whether a use is legal or suitable for your business. Your team still needs to make that decision and bring in legal, security, or other specialists when needed.
How NikolaFi can help: We can help your team review one AI use, map the task and information involved, plan practical checks, and document who is responsible. You leave with a clear review and next steps.
Read more: NIST’s AI Risk Management Framework. The framework is voluntary, and NIST says its current version is being revised.