> Markdown version of https://agledger.ai/compliance/nist/
> Full index of this site for AI assistants: https://agledger.ai/llms.txt

# NIST AI RMF crosswalk: the four functions, mapped

If your AI risk program needs to implement the four [NIST AI RMF](https://www.nist.gov/itl/ai-risk-management-framework) functions - GOVERN, MAP, MEASURE, and MANAGE - here is how each maps to the AGLedger record, the Signed Statement chain, the dispute path, and the Settlement Signal surface.

The crosswalk is a capability mapping. AGLedger provides the evidence pattern; your program provides the risk methodology, the tolerances, and the response decisions.

If your AI program needs to evidence NIST AI RMF MEASURE controls, the crosswalk below applies. The same evidence pattern - signed records, hash-chained, append-only - also supports non-AI automated work under SOX, GLBA, HIPAA, and other control families that require tamper-evident audit trails for RPA, CI pipelines, and microservice handoffs. AGLedger is software you self-host; the regulations are AI-framed, the underlying evidence pattern is not.

## The crosswalk at a glance

| Function | AGLedger evidences | Your program owns |
| --- | --- | --- |
| GOVERN | Who held which authority, and every oversight action, on a signed chain (record → completion → verdict) | Policies, risk tolerances, who is responsible |
| MAP | Risk level and domain classification per record; each operation tied to its risk context | The risk assessment itself; categories and thresholds |
| MEASURE | Tolerance bands on criteria, signed timestamps on every transition, queryable acceptance and rejection rates | Measurement criteria; interpreting results |
| MANAGE | Dispute and remediation states on the chain; Settlement Signals routing outcomes; full export for third-party audit | Risk response strategy; resource allocation |

Each function is expanded below. For NIST's own mappings to ISO/IEC 42001 and the EU AI Act, see the official [AI RMF crosswalks](https://airc.nist.gov/AI_RMF_Knowledge_Base/Crosswalks).

## GOVERN

Establish and maintain policies, processes, and accountability structures for AI risk management.

### AGLedger provides

- Structured accountability chain for every automated operation (record → completion → verdict)
- Role-based access: principal, performer, accessor with defined authority scopes
- Append-only audit vault records every policy decision and oversight action
- Cross-record compliance attestation records linked to audit chain

### You own

- Defining governance policies and risk tolerances
- Designating responsible individuals and their authority
- Establishing organizational AI risk management strategy

## MAP

Identify, categorize, and document AI risks in context.

### AGLedger provides

- Risk level and domain classification per record (maps to Annex III categories)
- Structured records linking each automated operation to its risk context
- Federation enables cross-organizational risk mapping with sovereign data
- Custom schemas allow domain-specific risk categorization

### You own

- Performing the risk assessment
- Determining risk categories and thresholds
- Mapping AI systems to organizational context

## MEASURE

Analyze, assess, and track AI risks and impacts.

### AGLedger provides

- Tolerance bands enforce numeric bounds on record criteria
- Timeliness evidence - every state transition timestamped and signed
- Reputation scoring tracks agent reliability across records
- Drift detection across model updates and provider changes (most useful in federated deployments)
- Audit vault queryable for cross-record analysis of acceptance, rejection, and revision rates

### You own

- Defining measurement criteria and acceptable thresholds
- Interpreting measurement results
- Deciding what corrective action to take

## MANAGE

Allocate resources and implement plans to respond to AI risks.

### AGLedger provides

- 3-tier dispute resolution: self-resolution, mediation, human escalation
- Remediation states and revision workflow for corrective actions
- Settlement Signal™ (SETTLE/HOLD/RELEASE) routes outcomes to downstream systems
- Full chain exportable for regulatory submission and third-party audit

### You own

- Resource allocation decisions
- Risk response strategy and implementation
- Ongoing monitoring program design

The AI RMF is voluntary, but its GOVERN, MAP, MEASURE, and MANAGE functions all assume durable evidence of how your AI systems actually behave in production. AGLedger provides that evidence pattern - signed, hash-chained, exportable for third-party audit; your risk-management program provides the policy and process around it.

## Frequently asked

## Primary sources

- [NIST AI 100-1: Artificial Intelligence Risk Management Framework (AI RMF 1.0)](https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.100-1.pdf)  - the framework itself, and the source of the four function definitions quoted above
- [NIST AI RMF Playbook](https://airc.nist.gov/AI_RMF_Knowledge_Base/Playbook)  - the suggested actions per subcategory, which is where the evidence expectations get concrete
- [NIST AI RMF crosswalks](https://airc.nist.gov/AI_RMF_Knowledge_Base/Crosswalks) - NIST's own mappings to ISO/IEC 42001, the EU AI Act, and other frameworks

next[EU AI Act](https://agledger.ai/compliance/eu-ai-act/)

next[ISO/IEC 42001:2023](https://agledger.ai/compliance/iso-42001/)

learn[AI agent audit trail](https://agledger.ai/ai-agent-audit-trail/)

learn[Tamper-evident logging](https://agledger.ai/tamper-evident-logging/)

install[Install locally](https://agledger.ai/docs/install/)