NIST AI RMF: The Govern Function

Description

Govern is the foundational function of the NIST AI RMF. It establishes the culture, processes, and accountability that let the other 3 functions (Map, Measure, Manage) work. Without governance, technical controls end up in the hands of people with no authority and no clarity about responsibility.

Govern isn't "documentation nobody reads." It's the organizational structure that defines who decides what about AI on your team.

By the end you'll be able to:

• Identify the 6 categories of Govern (Policies, Accountability, Workforce, Engagement, Risk culture, Sustainability)
• Apply Govern to small teams (startups) without enterprise overhead
• Define roles and responsibilities for AI governance
• Implement policy review and enforcement processes

The 6 categories of Govern

The NIST AI RMF's Govern function has 6 categories. Let's go through them one by one with practical application.

Govern 1: Policies and Procedures

What: written policies that govern the development and use of AI in the organization.

For a startup:

• AI Use Policy: what AI is allowed, what isn't
• Data handling policy: how to handle personal data
• Model deployment policy: what's required before production

Minimum viable:

## AI Use Policy v1.0

1. All AI systems deployed to production must complete the
   Ethics Checklist (M7) and be approved by the Tech Lead.

2. AI systems processing personal data must have a lawful basis
   documented in the RoPA.

3. High-risk systems (per the EU AI Act) require a DPIA.

4. No AI system may be deployed to production for critical decisions
   (financial, HR, medical) without human-in-the-loop.

5. Annual review of all production AI systems for bias and compliance.

5-10 lines minimum, 1-2 pages if done well.

Govern 2: Accountability Structures

What: who is responsible for what.

For a startup:

| Decision area | Owner | Reviewer |
|---------------|-------|----------|
| AI system architecture | Tech Lead | CTO |
| Ethics decisions | Tech Lead | Legal Counsel |
| Privacy compliance | Tech Lead | Legal Counsel |
| Production deployment | Tech Lead | CEO (high-impact) |
| Bias monitoring | ML Engineer | Tech Lead |
| Incident response | On-call engineer | Tech Lead |

Don't over-engineer it. 3-5 roles is enough at a startup.

Govern 3: Workforce Diversity, Equity, Inclusion (DEI), Accessibility

What: AI teams should be diverse to reduce blind spots.

For a startup:

• Diverse hiring practices (gender, race, age, perspective)
• DEI training for everyone who touches AI
• Accessibility considerations in design (WCAG)

Realistic at an early stage: hard with a team of 5. But you document the intent and apply it when the opportunity comes.

Govern 4: Engagement with AI Actors

What: stakeholder engagement — users, experts, regulators.

For a startup:

• User feedback loops (the path's M2-M6 deliverables)
• External experts consulted on critical decisions
• Regulator awareness (lurking; no need for active engagement yet)

Govern 5: Risk Management Culture

What: an organizational culture that values early risk identification.

For a startup:

• An "anyone can flag a risk" policy — incentivize reporting
• Blameless post-mortems
• Risk discussions in team meetings (not just engineering)
• "Slow down to think about ethics" without penalizing it

Govern 6: Sustainability

What: AI that's sustainable long-term, not quick wins that create ethical tech debt.

For a startup:

• Documented models (no "black box" knowledge living in one person's head)
• Continuity if a key engineer leaves
• Long-term thinking in architectural decisions

Applying it to small teams

The NIST AI RMF was designed with large organizations in mind. Adapting it for a startup:

The principle: scaled-down governance is better than no governance.

Practical implementation: a 90-day governance setup

Days 1-30: Foundation

• Write the AI Use Policy v1.0 (1-2 pages)
• Define the accountability matrix (5-7 roles)
• Set up a quarterly governance review

Days 31-60: Procedures

• Write the deployment checklist (linked to the M7 Ethics Checklist)
• Define the incident response procedure
• Set up a periodic bias review (the M2 deliverable applied)

Days 61-90: Embedding

• Onboard the team to the policies
• Run the first governance review meeting
• Document the first 1-2 cases

Investment: ~10-20 hours total across 90 days. Sustainable.

Common traps

Trap 1 — A policy library nobody reads. If your wiki has 20 pages but the team doesn't use them, that's a fail. Keep them short and actionable.

Trap 2 — Accountability with no authority. "The Tech Lead is responsible for ethics" but they have no authority to block a deployment. Fail.

Trap 3 — A quarterly review that gets cancelled. With no discipline, the meeting keeps getting postponed. Calendar block + a standing agenda.

Trap 4 — Over-engineering governance for 5 people. NIST AI RMF's Govern has dozens of sub-categories. Pick the 5-6 that matter at your size.

Trap 5 — No escalation path for concerns. An engineer sees an ethical issue. Who do they go to? If there's no clear path, they don't report it.

Exercise

For your AI system (the path Capstone):

1. Draft the AI Use Policy v1.0 (1 page)
2. Create the accountability matrix (5-7 roles)
3. Define the deployment procedure (high level, 5-7 steps)
4. What's your escalation path for ethics concerns?

1. AI systems serving users require:
   - A lawful basis documented in the RoPA
   - A privacy assessment
   - A bias testing baseline
   - Human-in-the-loop for high-impact decisions

2. The pre-production checklist (M7 Ethics Checklist) must be completed

3. Production AI requires monitoring of:
   - Performance metrics
   - Bias metrics (the M2 deliverable)
   - User feedback

4. Quarterly review of all production AI systems

5. Incidents must be reported within 24h via [process]

Summary

You learned:

• ✅ The 6 categories of NIST Govern (Policies, Accountability, Workforce, Engagement, Risk culture, Sustainability)
• ✅ Adapting it for a startup (no enterprise overhead)
• ✅ A 90-day setup plan
• ✅ The traps: unread policies, over-engineering, no escalation

Checkpoint: if your team has written policies + an accountability matrix + an escalation path, governance is OK.

Next capsule

03 — NIST AI RMF: the Map function. Once you're governed, you map the specific context and risks of the system.

Resources

1. NIST AI RMF Playbook — Govern — the full detail.
2. AI Governance for Startups — WEF guidance.
3. Anthropic's RSP (Responsible Scaling Policy) — an example.
4. Google AI Principles — an example corporate policy.