Module 6: Industry Standards and Frameworks

NIST AI RMF: The Map Function

Description

The Map function helps you understand the context of your AI system: who the users are, what decisions the system makes, what risks can occur. It's the discovery and identification phase, before you measure or manage.

Without Map, you waste time measuring things that don't matter and missing things that are critical. Map focuses you.

By the end you'll be able to:

Categorize the AI system's context using the NIST framework
Identify stakeholders, impacts, and risks
Classify AI risks by category (technical, societal, legal)
Produce a context document for your system

The 5 categories of Map

Map 1: Context Established

You document:

Purpose: what problem does the AI solve?
Users: who interacts with it (directly and indirectly)
Deployment context: production environment, geographies, scale
Lifecycle stage: planning, development, evaluation, deployment, operation
Use cases: specific, not generic

Map 2: Categorization

You classify the AI system:

The AI lifecycle phase
The application sector (healthcare, finance, education, etc.)
The specific tasks (classification, generation, recommendation)
The decision type (binary, multi-class, continuous, generative)

Map 3: AI Capabilities and Risks

You identify:

The system's capabilities (what it does)
Its known limitations
The risks that can materialize

Map 4: Impacts

For each stakeholder, what are the potential impacts?

Direct users: decisions that affect the people who interact with it
Indirectly affected: others who don't use it but are impacted
Societal: broader effects (employment, bias amplification)

Map 5: Risk identification

A comprehensive list of possible risks:

Performance risks: the model fails to perform
Robustness risks: it fails under unexpected inputs
Security risks: adversarial attacks, data exfiltration
Privacy risks: data exposure
Bias risks: unfair outcomes
Explainability risks: it can't justify its decisions

Risk categories specific to AI

1. Technical Risks
   - Hallucination (LLMs make things up)
   - Distribution shift (the model performs differently on new data)
   - Adversarial inputs (intentional manipulation)
   - Brittleness (small input changes → big output changes)
   - Catastrophic forgetting (in continually updated models)

2. Operational Risks
   - Insufficient monitoring → unnoticed degradation
   - Cost explosion (LLM tokens, GPU resources)
   - Latency exceeding the SLA
   - Dependency on third-party providers

3. Privacy Risks
   - Training data leakage
   - Inference of sensitive attributes
   - Profile inference enabling identification
   - Cross-tenant data exposure

4. Fairness Risks (covered in M2)
   - Demographic disparities
   - Disparate impact on protected groups
   - Feedback loops amplifying bias

5. Transparency Risks
   - Lack of explainability for affected individuals
   - Lack of disclosure (users don't know they're talking to AI)
   - Lack of human oversight options

6. Legal/Compliance Risks
   - GDPR violations (Art. 22, consent, transfers)
   - EU AI Act non-compliance
   - Discrimination law violations
   - IP infringement (training on copyrighted material)

7. Societal Risks
   - Worker displacement
   - Concentration of decision-making power
   - Amplification of misinformation
   - Environmental impact (compute)

Application: a Knowledge Assistant Map document

# Map Document — AI Knowledge Assistant

## Context (Map 1)

**Purpose**: Allow employees of client organizations to quickly find
information from internal knowledge bases through Slack/Discord.

**Users**:
- Direct: employees (≈10K-100K across 50 client orgs in Year 1)
- Indirect: the clients' customers (whose data may be in the KB)
- Stakeholders: org admins, security teams, executives

**Deployment**: Production B2B SaaS. Multi-region (US, EU). Multi-tenant.

**Lifecycle**: Operation (deployed, monitored continuously)

**Use cases**:
- Tech docs lookup
- Procedural questions
- Decision support
- NOT: hiring, firing, financial approvals, medical decisions

## Categorization (Map 2)

- **Phase**: Operation
- **Sector**: Cross-industry B2B SaaS
- **Tasks**: Question-answering with retrieval; generative responses
- **Decision type**: Generative (text); occasional categorization (intent)

## Capabilities & Risks (Map 3)

**Capabilities**:
- Answer factual questions from internal docs
- Cite sources
- Handle multi-turn conversations
- Multi-language (initially Spanish + English)

**Limitations**:
- Cannot answer questions not in the knowledge base
- May hallucinate if the context is insufficient
- Confidence calibration is imperfect
- Real-time data (very fresh updates) may not be reflected

## Impacts (Map 4)

**Direct users**:
- Saved time (positive)
- Productivity (positive)
- Risk: bad answers leading to wrong actions

**Indirectly affected**:
- The clients' customers (if the KB contains customer-related info)
- Employees not getting attention if the AI does most of the helping

**Societal**:
- Potential displacement of help desk roles
- Productivity gains at scale

## Risk Identification (Map 5)

Top 15 risks identified:

1. Hallucination — fabricated information
2. Stale information — KB updates not reflected
3. Tenant data leakage — Client A sees Client B's data
4. Training data leakage — the model memorizes confidential data
5. Bias in responses — different quality for different groups
6. Insufficient explainability — the user can't verify an answer
7. Over-reliance — the user trusts an incorrect AI answer
8. Privacy violations — sensitive info in the answers
9. Service degradation — LLM provider outage
10. Cost explosion — uncontrolled usage growth
11. Security — adversarial prompts extracting confidential data
12. Compliance — Art. 22 violations, GDPR violations
13. Worker displacement — replacing knowledgeable staff
14. Misuse — usage outside policy
15. Vendor lock-in — dependency on OpenAI

Common traps

Trap 1 — Listing generics, not specifics. "Risk: bias" → generic. "Risk: gender disparity in the tone of responses to support queries" → specific.

Trap 2 — Forgetting indirect stakeholders. You only think about the users who click the button. But the users' customers, society, etc. can be affected too.

Trap 3 — Risks identified but never mitigated. Map identifies; Manage (the next step) mitigates. Don't skip ahead without first identifying.

Trap 4 — A document you write once. Map has to be updated when the system changes significantly.

Exercise

For your system (the Capstone Knowledge Assistant):

Draft the 5 Map categories
List a minimum of 10 identified risks
Categorize them into the 7 risk categories (technical, operational, privacy, etc.)
Prioritize them: critical, high, medium, low

See the solution (priority overview)

Top priority risks:

Critical: tenant data leakage, hallucination affecting decisions
High: bias in responses, Art. 22 violations, training data leakage
Medium: cost explosion, vendor lock-in, a stale KB
Low: worker displacement (worth considering, but distant)

Priority criteria:

Severity × Likelihood × Visibility (audit/regulator)
Critical → must be mitigated before deployment
High → mitigate in the first sprint
Medium → plan for next quarter
Low → monitor

Summary

You learned:

✅ The 5 categories of Map (Context, Categorization, Capabilities/Risks, Impacts, Risk identification)
✅ The 7 risk categories specific to AI
✅ Concrete application to the Knowledge Assistant
✅ The traps: generics, indirect stakeholders, no updates

Checkpoint: if you have a Map document with risks identified and prioritized, you're ready for Measure.

Next capsule

04 — NIST AI RMF: the Measure function. Once mapped, you measure the identified risks with metrics and testing.

Resources

NIST AI RMF Playbook — Map.
AI Incident Database — for inspiration on risks.
Partnership on AI — Tenets — risk thinking.
Bias Audit Toolkit — your M2 deliverable.

← PreviousNIST AI RMF: The Govern Function Next →NIST AI RMF: The Measure Function