Study NIST AI RMF
Jump & context
Week 10: Governance, Tamper-Evident Ledger & Browser/Computer-Use Agent Security
The five hours
- 01
Concepts & system design
60 min· read · map the mechanismR31 — NIST AI RMF 1.0
R32 — EU AI Act official portal & risk tiers
Read the assigned sections; map the mechanism, threat model and trade-offs.
- 02
Project implementation
120 min· build · integrate · debugStudy the NIST AI Risk Management Framework (
Govern,Map,Measure,Manage) and EU AI Act risk categories. MapP2to NIST AI RMF functions with explicit risk owners, technical controls, and incident workflows.Build, integrate, debug and improve the increment in the active project.
- 03
Security lab
60 min· attack your own systemIdentify governance gaps where a technical control exists without an operational owner or incident runbook (or vice versa).
Test the abuse case, failure path, authorization bypass or resource limit.
- 04
Verification & evidence
30 min· test · record evidencePreliminary NIST AI RMF mapping matrix for
P2.Add or run regression tests; record the 9-point evidence record.
- 05
Deliberate practice & Socratic review
30 min· explain aloud · update gapsAnswer the 8 Socratic questions without notes: What? Why? How? What if? Why not? How can I prove it? Where can it break? What have I learned?
Re-explain the hardest concept aloud, inspect one edge case, update the gap log.
- total5 h
Read today · inside the concepts block
R31 R32Govern, Map, Measure, and Manage functions; risk ownership, measurement, and lifecycle documentation.
Risk-based regulatory tiers, high-risk system obligations, and GPAI transparency/cybersecurity rules.
Read only the named sections needed for today's task. Reading sits inside the 60-minute concepts block; it is not extra time.
Free resources for this day
5 curated- docsNISTNIST AI Risk Management Framework
The Govern/Map/Measure/Manage definitions you must map P2 onto, including the outcomes that force named risk owners and documented measurement.
R31checked 2026-11-11 - docsEU AI Act Service Desk (European Commission)Article 6: Classification rules for high-risk AI systems
The legal test for high-risk classification via Annex I products and Annex III use cases, which decides whether P2 inherits the Act's obligation set.
R32checked 2026-11-11 - videoExplorAIEU AI Act Explained (Episode 1): What Counts as AI, Risk Categories & How to Start Compliance
Explains the statutory definition of an AI system and the unacceptable/high/limited/minimal tiers, the classification step before any obligation mapping.
R32checked 2026-11-11 - videoContra AverageNIST AI RMF Explained: GOVERN, MAP, MEASURE & MANAGE | Practical Implementation Guide
Shows how the four functions are operationalised with owners, evidence, and review cadence, which is what turns the RMF into an auditable record for P2.
R31checked 2026-11-11 - articleNISTNIST AI RMF Playbook
Suggested actions per subcategory, so each Map/Measure outcome gets a concrete control and an accountable owner instead of a narrative claim.
R31checked 2026-11-11
Evidence record · 9-point standard
A lab is complete only when it produces evidence. Installing PyRIT, Garak, Presidio or TransformerLens is not completion. Saved on this device only.
Day notes
emptyThe two source formulations
verbatim · nothing summarisedProject & Stage Target
P2 & All Projects | S11 (Governance & Compliance)
Core Implementation
Study the NIST AI Risk Management Framework (Govern, Map, Measure, Manage) and EU AI Act risk categories. Map P2 to NIST AI RMF functions with explicit risk owners, technical controls, and incident workflows.
Security Lab
Identify governance gaps where a technical control exists without an operational owner or incident runbook (or vice versa).
Verification & Evidence
Preliminary NIST AI RMF mapping matrix for P2.
Read Today (60m Concepts Block)
R31 (NIST AI RMF 1.0), R32 (EU AI Act official portal & risk tiers).
---