Repository navigation
[UPDATE] LLM_NISTAIRMF.md + DSGAI_NISTAIRMF.md - 5 NIST AI RMF 1.0 subcategory IDs used with the wrong meaning (54 rows) #220
Description
File to update
llm-top10/LLM_NISTAIRMF.md: 19 mapping rowsdsgai-2026/DSGAI_NISTAIRMF.md: 35 mapping rowsdata/entries/*.jsonanddocs/data.js: regenerated from the above
Framework: NIST AI RMF 1.0 — Artificial Intelligence Risk Management Framework (AI RMF 1.0), NIST AI 100-1, January 2023, https://doi.org/10.6028/NIST.AI.100-1. This is still the current version: NIST's framework page says 1.0 "is being revised", but has published no draft, version number or date (checked 2026-10-09). Subcategory ids below use the registry's short form (MS-2.5 = MEASURE 2.5), the same form NIST AI 600-1 uses.
What is incorrect
This is the LLM and DSGAI half of #217, which covers the 21 agentic rows. #219 re-transcribed data/frameworks/nist-ai-rmf.json verbatim from AI 100-1, so the registry now holds the published statement for every id. 54 rows cite one of five subcategories with the meaning of the old, wrong registry title, not the published one:
| Id | Rows | How the rows use it (old registry title) | Published AI RMF 1.0 statement |
|---|---|---|---|
| MS-2.5 (MEASURE 2.5) | 20 | Adversarial testing | The AI system to be deployed is demonstrated to be valid and reliable. Limitations of the generalizability beyond the conditions under which the technology was developed are documented. |
| MG-2.2 (MANAGE 2.2) | 17 | Risk response — incident | Mechanisms are in place and applied to sustain the value of deployed AI systems. |
| MG-2.4 (MANAGE 2.4) | 9 | Risk response — change management | Mechanisms are in place and applied, and responsibilities are assigned and understood, to supersede, disengage, or deactivate AI systems that demonstrate performance or outcomes inconsistent with intended use. |
| MG-3.2 (MANAGE 3.2) | 7 | Communication of incidents | Pre-trained models which are used for development are monitored as part of AI system regular monitoring and maintenance. |
| MS-4.1 (MEASURE 4.1) | 1 | Measurement results communication | Measurement approaches for identifying AI risks are connected to deployment context(s) and informed through consultation with domain experts and other end users. Approaches are documented. |
None of the 54 rows has a reviewer: reviewed_by is empty on all of them.
All 54 rows, by subcategory
| Id | Entry | Row label (control_name) |
File |
|---|---|---|---|
| MS-2.5 | DSGAI02 | Testing — adversarial | dsgai-2026/DSGAI_NISTAIRMF.md |
| MS-2.5 | DSGAI04 | Testing — adversarial | dsgai-2026/DSGAI_NISTAIRMF.md |
| MS-2.5 | DSGAI05 | Testing — adversarial | dsgai-2026/DSGAI_NISTAIRMF.md |
| MS-2.5 | DSGAI06 | Testing — adversarial | dsgai-2026/DSGAI_NISTAIRMF.md |
| MS-2.5 | DSGAI11 | Testing — adversarial | dsgai-2026/DSGAI_NISTAIRMF.md |
| MS-2.5 | DSGAI12 | Testing — adversarial | dsgai-2026/DSGAI_NISTAIRMF.md |
| MS-2.5 | DSGAI13 | Testing — adversarial | dsgai-2026/DSGAI_NISTAIRMF.md |
| MS-2.5 | DSGAI15 | Testing — adversarial | dsgai-2026/DSGAI_NISTAIRMF.md |
| MS-2.5 | DSGAI16 | Testing — adversarial | dsgai-2026/DSGAI_NISTAIRMF.md |
| MS-2.5 | DSGAI17 | Testing — adversarial | dsgai-2026/DSGAI_NISTAIRMF.md |
| MS-2.5 | DSGAI18 | Testing — adversarial | dsgai-2026/DSGAI_NISTAIRMF.md |
| MS-2.5 | DSGAI20 | Testing — adversarial | dsgai-2026/DSGAI_NISTAIRMF.md |
| MS-2.5 | DSGAI21 | Testing — adversarial | dsgai-2026/DSGAI_NISTAIRMF.md |
| MS-2.5 | LLM01 | Testing and evaluation — adversarial | llm-top10/LLM_NISTAIRMF.md |
| MS-2.5 | LLM03 | Testing — adversarial | llm-top10/LLM_NISTAIRMF.md |
| MS-2.5 | LLM04 | Testing and evaluation | llm-top10/LLM_NISTAIRMF.md |
| MS-2.5 | LLM05 | Testing — adversarial | llm-top10/LLM_NISTAIRMF.md |
| MS-2.5 | LLM06 | Testing — adversarial | llm-top10/LLM_NISTAIRMF.md |
| MS-2.5 | LLM09 | Testing — adversarial | llm-top10/LLM_NISTAIRMF.md |
| MS-2.5 | LLM10 | Testing — output safety | llm-top10/LLM_NISTAIRMF.md |
| MG-2.2 | DSGAI02 | Risk response | dsgai-2026/DSGAI_NISTAIRMF.md |
| MG-2.2 | DSGAI04 | Risk response | dsgai-2026/DSGAI_NISTAIRMF.md |
| MG-2.2 | DSGAI05 | Risk response | dsgai-2026/DSGAI_NISTAIRMF.md |
| MG-2.2 | DSGAI11 | Risk response | dsgai-2026/DSGAI_NISTAIRMF.md |
| MG-2.2 | DSGAI12 | Risk response | dsgai-2026/DSGAI_NISTAIRMF.md |
| MG-2.2 | DSGAI13 | Risk response | dsgai-2026/DSGAI_NISTAIRMF.md |
| MG-2.2 | DSGAI15 | Risk response | dsgai-2026/DSGAI_NISTAIRMF.md |
| MG-2.2 | DSGAI16 | Risk response | dsgai-2026/DSGAI_NISTAIRMF.md |
| MG-2.2 | DSGAI17 | Risk response | dsgai-2026/DSGAI_NISTAIRMF.md |
| MG-2.2 | DSGAI20 | Risk response | dsgai-2026/DSGAI_NISTAIRMF.md |
| MG-2.2 | DSGAI21 | Risk response | dsgai-2026/DSGAI_NISTAIRMF.md |
| MG-2.2 | LLM01 | Risk response — incident | llm-top10/LLM_NISTAIRMF.md |
| MG-2.2 | LLM03 | Risk response | llm-top10/LLM_NISTAIRMF.md |
| MG-2.2 | LLM05 | Risk response | llm-top10/LLM_NISTAIRMF.md |
| MG-2.2 | LLM06 | Risk response | llm-top10/LLM_NISTAIRMF.md |
| MG-2.2 | LLM09 | Risk response | llm-top10/LLM_NISTAIRMF.md |
| MG-2.2 | LLM10 | Risk response | llm-top10/LLM_NISTAIRMF.md |
| MG-2.4 | DSGAI01 | Risk response — data | dsgai-2026/DSGAI_NISTAIRMF.md |
| MG-2.4 | DSGAI03 | Risk response — data | dsgai-2026/DSGAI_NISTAIRMF.md |
| MG-2.4 | DSGAI08 | Risk response — data | dsgai-2026/DSGAI_NISTAIRMF.md |
| MG-2.4 | DSGAI09 | Risk response — data | dsgai-2026/DSGAI_NISTAIRMF.md |
| MG-2.4 | DSGAI14 | Risk response — data | dsgai-2026/DSGAI_NISTAIRMF.md |
| MG-2.4 | DSGAI18 | Risk response — data | dsgai-2026/DSGAI_NISTAIRMF.md |
| MG-2.4 | LLM02 | Risk response — data | llm-top10/LLM_NISTAIRMF.md |
| MG-2.4 | LLM07 | Risk response — data | llm-top10/LLM_NISTAIRMF.md |
| MG-2.4 | LLM08 | Risk response — data | llm-top10/LLM_NISTAIRMF.md |
| MG-3.2 | DSGAI06 | Residual risk — third party | dsgai-2026/DSGAI_NISTAIRMF.md |
| MG-3.2 | DSGAI07 | Residual risk | dsgai-2026/DSGAI_NISTAIRMF.md |
| MG-3.2 | DSGAI10 | Residual risk | dsgai-2026/DSGAI_NISTAIRMF.md |
| MG-3.2 | DSGAI17 | Residual risk | dsgai-2026/DSGAI_NISTAIRMF.md |
| MG-3.2 | DSGAI19 | Residual risk | dsgai-2026/DSGAI_NISTAIRMF.md |
| MG-3.2 | LLM04 | Residual risk — third party | llm-top10/LLM_NISTAIRMF.md |
| MG-3.2 | LLM06 | Residual risk — availability | llm-top10/LLM_NISTAIRMF.md |
| MS-4.1 | LLM07 | Feedback mechanisms | llm-top10/LLM_NISTAIRMF.md |
Also untracked: MP-3.5 (2 rows)
DSGAI03 ("AI system impact") and DSGAI16 ("AI system impact") cite MP-3.5. On main before #219, that registry entry held authored text about shadow AI, which isn't in the framework. MAP 3.5 is actually: "Processes for human oversight are defined, assessed, and documented in accordance with organizational policies from the GOVERN function." #219 flagged these two rows but left them unchanged, so they're listed here so they don't get lost.
Lower priority: the wording shifted but the rows may still fit
These are for the same reviewer to glance at, not presumed wrong:
MP-2.3: the rows say "Risk categorisation", but MAP 2.3 is about scientific integrity and TEVV considerations.GV-1.7: the rows say "Policies for trustworthy AI", but GOVERN 1.7 is about decommissioning and phasing out AI systems.MS-2.6andMP-5.1: slight shifts only.
What is needed
This is a mapping judgment, so it's not agent work. Under C4 and STRAT-04, a reviewer with AI RMF expertise decides, for each row, one of:
- re-point it to the subcategory that matches the row's intent;
- keep the id with a fresh rationale; or
- drop the row.
No row has been changed, and this issue proposes no targets. If anyone drafts proposals, they land as DRAFT — SME review required, as on #217. Doing #217 and this issue together keeps the LLM, DSGAI and agentic files consistent.
Activity