GOVERN: management and responsibilities
When introducing AI, establish who prepares the work, who decides and how agreed rules become part of everyday practice. Adapt this working guide to your organisation and the use in question.
How to use NIST AI RMF
GOVERN is a cross-cutting function in the voluntary NIST AI RMF 1.0. Its six categories cover policies and processes, accountability, people, organisational culture, stakeholder engagement and supplier risks. The framework helps organise the work; it does not replace assessment of specific legal obligations. See the NIST AI RMF Playbook.
1. Build on existing processes
Review your AI inventory and existing data, security, procurement and change rules. Record where they cover AI use and where a decision or process is missing. Assign an owner and priority to each gap.
Output: required changes linked to existing rules.
2. Agree decisions and contributions
Start with activities and authority. A person may take on several tasks if they have the knowledge, time and support.
| Activity | What needs to be clear |
|---|---|
| Purpose and budget | Who approves the investment and conditions for continuing |
| Preparation | Who gathers information, tracks tasks and coordinates feedback |
| Assessment | Who contributes on data, security, contracts and impacts |
| Permission to use | Who approves a pilot or operation and records restrictions |
| Everyday work | Who uses the tool, checks outputs and reports problems |
| Change or incident | Who decides on restrictions, stopping, remediation and restarting |
For each decision, record the accountable person, required evidence and approval process. The coordinator prepares work and follows up; their authority must be explicitly agreed. See coordinating AI use.
3. Write rules people can apply
Rules should answer everyday questions:
- Which tools and purposes are approved, and how are others requested?
- What data may be used, under which conditions?
- Which outputs need checking, who checks them and what is recorded?
- When is further assessment or approval required?
- Where should a problem be reported and who will respond?
Adapt the policy templates to the inventory and organisational decisions. An internal risk scale is not an AI Act legal classification. See laws and obligations for the relevant context.
Output: approved rules with an owner, version and review date or trigger.
4. Try the rules with people
Work through actual situations: a new tool, sensitive input, an incorrect output or unclear approval. Find out whether a person knows what to do and where to get help. Adjust the wording and practical learning accordingly.
Include people whose work or customer experience will be affected. Agree who will assess feedback and how contributors will hear the result.
5. Assess suppliers and prepare operations
For the proposed solution, request evidence on data, access, limitations, service changes and exit arrangements. Record what you checked, what you rely on the supplier for and what remains open. A supplier certificate alone does not describe every risk of your use.
Continue with options and costs and tool requirements. Before acceptance, assign support, change and incident responsibilities.
6. Check whether the arrangement works
Review open tasks and actual events. Check that rules match real use, decisions can be traced and people can respond to problems. Set reviews according to changes, impacts and operational needs.
- Each assessed use has an accountable person and documented conditions.
- Open questions have an owner and a deadline.
- Rules are available and the team can apply them.
- There is a process for new tools, changes and problems.
- Review findings lead to specific changes.
Output: a record of decisions and follow-up actions. Policy counts or training attendance alone do not establish that the arrangement works.
MAP: describe use and context · MEASURE: test and measure · MANAGE: respond to findings
Method reference checked on 20 September 2026: NIST AI RMF 1.0. This is TECHNOMATON’s own working procedure; its steps do not correspond to GOVERN category numbers.