Artificial Intelligence Risk Management Framework (AI RMF 1.0)

Probably not a substantial claim: may not pass S2 (checkable), S3 (load-bearing), S4 (based).

These practices can increase the likelihood that risks arising in social contexts are managed appropriately.

“These practices can increase the likelihood that risks arising in social contexts are managed appropriately.”

Probably not a substantial claim: may not pass S4 (based). May combine two claims.

Deployment of AI systems which are inaccurate, unreliable, or poorly generalized to data and settings beyond their training creates and increases negative AI risks and reduces trustworthiness.

“Deployment of AI systems which are inaccurate, unreliable, or poorly generalized to data and settings beyond their training creates and increases negative AI risks and reduces trustworthiness.”

Classified as probably not a substantial claim.

Dealing with tradeoffs requires taking into account the decision-making context.

“Dealing with tradeoffs requires taking into account the decision-making context.”

Probably not a substantial claim: may not pass S2 (checkable), S4 (based). May combine two claims.

Understanding and managing the risks of AI systems will help to enhance trustworthiness, and in turn, cultivate public trust.

“Understanding and managing the risks of AI systems will help to enhance trustworthiness, and in turn, cultivate public trust.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

Representing complex human phenomena with mathematical models can come at the cost of removing necessary context.

“Representing complex human phenomena with mathematical models can come at the cost of removing necessary context.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based). May combine two claims.

Biases can stem from end-user decision-making tasks and be introduced across the AI lifecycle via human assumptions, expectations, and decisions during design and modeling tasks.

“Biases can stem from end-user decision-making tasks and be introduced across the AI lifecycle via human assumptions, expectations, and decisions during design and modeling tasks.”

• AssumptionRests on an assumption: Decisions that go into the design, development, deployment, evaluation, and use of AI systems reflect systemic and human cognitive biases.
• AssumptionRests on an assumption: AI actors bring their cognitive biases, both individual and group, into the process.

Probably not a substantial claim: may not pass S3 (load-bearing).

Implementation of the MAP function is enhanced by incorporating perspectives from a diverse internal team and engagement with those external to the team that developed or deployed the AI system.

“Implementation of this function is enhanced by incorporating perspectives from a diverse internal team and engagement with those external to the team that developed or deployed the AI system.”

Probably not a substantial claim: may not pass S2 (checkable), S3 (load-bearing).

This broader collective perspective creates opportunities for surfacing problems and identifying existing and emergent risks.

“This broader collective perspective creates opportunities for surfacing problems and identifying existing and emergent risks.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

Where tradeoffs among the trustworthy characteristics arise, measurement provides a traceable basis to inform management decisions.

“Where tradeoffs among the trustworthy characteristics arise, measurement provides a traceable basis to inform management decisions.”

Probably not a substantial claim: may not pass S2 (checkable), S4 (based). May combine two claims.

Trustworthy AI depends upon accountability.

“Trustworthy AI depends upon accountability.”

Probably not a substantial claim: may not pass S4 (based).

Identifying and managing AI risks and potential impacts -both positive and negative -requires a broad set of perspectives and actors across the AI lifecycle.

“Identifying and managing AI risks and potential impacts -both positive and negative -requires a broad set of perspectives and actors across the AI lifecycle.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based). May combine two claims.

Accuracy and robustness contribute to the validity and trustworthiness of AI systems, and can be in tension with one another in AI systems.

“Accuracy and robustness contribute to the validity and trustworthiness of AI systems, and can be in tension with one another in AI systems.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

When variations in human-AI interaction are judiciously taken into account in organizing human-AI teams, they can result in complementarity and improved overall performance.

“When these variations are judiciously taken into account in organizing human-AI teams, however, they can result in complementarity and improved overall performance.”

• AssumptionRests on an assumption: Human-AI interaction results vary.

Classified as probably not a substantial claim. May combine two claims.

Safe operation of AI systems is improved through responsible design, development, and deployment practices; clear information to deployers on responsible use; responsible decision-making by deployers and end users; and explanations and documentation of risks based on empirical evidence of incidents.

“Safe operation of AI systems is improved through: • responsible design, development, and deployment practices; • clear information to deployers on responsible use of the system; • responsible decision-making by deployers and end users; and • explanations and documentation of risks based on empirical evidence of incidents.”

Probably not a substantial claim: may not pass S4 (based).

Outcomes in the MAP function are the basis for the MEASURE and MANAGE functions.

“Outcomes in the MAP function are the basis for the MEASURE and MANAGE functions.”

Probably not a substantial claim: may not pass S2 (checkable), S4 (based).

Treating AI risks along with other critical risks, such as cybersecurity and privacy, will yield a more integrated outcome and organizational efficiencies.

“Treating AI risks along with other critical risks, such as cybersecurity and privacy, will yield a more integrated outcome and organizational efficiencies.”

Probably not a substantial claim: may not pass S2 (checkable), S4 (based).

Maintaining organizational practices and governing structures for harm reduction, like risk management, can help lead to more accountable systems.

“Maintaining organizational practices and governing structures for harm reduction, like risk management, can help lead to more accountable systems.”

Probably not a substantial claim: may not pass S4 (based).

Approaches which enhance AI trustworthiness can reduce negative AI risks.

“Approaches which enhance AI trustworthiness can reduce negative AI risks.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

The relationship between risk and accountability associated with AI and technological systems more broadly differs across cultural, legal, sectoral, and societal contexts.

“The relationship between risk and accountability associated with AI and technological systems more broadly differs across cultural, legal, sectoral, and societal contexts.”

Probably not a substantial claim: may not pass S2 (checkable), S3 (load-bearing), S4 (based).

This is difficult to systematize since AI systems carry out different tasks -and perform tasks differently -than humans.

“This is difficult to systematize since AI systems carry out different tasks -and perform tasks differently -than humans.”

Probably not a substantial claim: may not pass S2 (checkable), S3 (load-bearing), S4 (based).

Organizations' risk management efforts will be enhanced by identifying and tracking emergent risks and considering techniques for measuring them.

“Organizations' risk management efforts will be enhanced by identifying and tracking emergent risks and considering techniques for measuring them.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based). May combine two claims.

Privacy-related risks may influence security, bias, and transparency and come with tradeoffs with these other characteristics.

“Privacy-related risks may influence security, bias, and transparency and come with tradeoffs with these other characteristics.”

Probably not a substantial claim: may not pass S4 (based).

Accountability presupposes transparency.

“Accountability presupposes transparency.”

Probably not a substantial claim: may not pass S2 (checkable), S3 (load-bearing), S4 (based).

Strong governance can drive and enhance internal practices and norms to facilitate organizational risk culture.

“Strong governance can drive and enhance internal practices and norms to facilitate organizational risk culture.”

Probably not a substantial claim: may not pass S4 (based). May combine two claims.

Systems in which predictions are somewhat balanced across demographic groups may still be inaccessible to individuals with disabilities or affected by the digital divide or may exacerbate existing disparities or systemic biases.

“For example, systems in which predictions are somewhat balanced across demographic groups may still be inaccessible to individuals with disabilities or affected by the digital divide or may exacerbate existing disparities or systemic biases.”

Probably not a substantial claim: may not pass S3 (load-bearing).

This loss of context may in turn make it difficult to understand individual and societal impacts that are key to AI risk management efforts.

“This loss of context may in turn make it difficult to understand individual and societal impacts that are key to AI risk management efforts.”

Classified as probably not a substantial claim.

Bias is broader than demographic balance and data representativeness.

“Bias is broader than demographic balance and data representativeness.”

Probably not a substantial claim: may not pass S3 (load-bearing).

Contextual information gleaned from expert consultation and input from relevant AI actors, established in GOVERN and carried out in MAP, is utilized in the MANAGE function to decrease the likelihood of system failures and negative impacts.

“Contextual information gleaned from expert consultation and input from relevant AI actors -established in GOVERN and carried out in MAP -is utilized in this function to decrease the likelihood of system failures and negative impacts.”

Probably not a substantial claim: may not pass S2 (checkable), S3 (load-bearing), S4 (based).

Organizations' risk management efforts will be enhanced by recognizing and considering these differences.

“Organizations' risk management efforts will be enhanced by recognizing and considering these differences.”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

These analyses can highlight the existence and extent of tradeoffs between different measures, but they do not answer questions about how to navigate the tradeoff.

“These analyses can highlight the existence and extent of tradeoffs between different measures, but they do not answer questions about how to navigate the tradeoff.”

Classified as probably not a substantial claim.

Explainable and interpretable AI systems offer information that will help end users understand the purposes and potential impact of an AI system.

“Explainable and interpretable AI systems offer information that will help end users understand the purposes and potential impact of an AI system.”

• AssumptionThe authors state this as an assumption: Perceptions of negative risk stem from a lack of ability to make sense of, or contextualize, system output appropriately.

Probably not a substantial claim: may not pass S3 (load-bearing).

Security and resilience are related but distinct characteristics.

“Security and resilience are related but distinct characteristics.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

Neglecting these characteristics can increase the probability and magnitude of negative consequences.

“Neglecting these characteristics can increase the probability and magnitude of negative consequences.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

The inability to appropriately measure AI risks does not imply that an AI system necessarily poses either a high or low risk.

“The inability to appropriately measure AI risks does not imply that an AI system necessarily poses either a high or low risk.”

Probably not a substantial claim: may not pass S4 (based). May combine two claims.

While bias is not always a negative phenomenon, AI systems can potentially increase the speed and scale of biases and perpetuate and amplify harms to individuals, groups, communities, organizations, and society.

“While bias is not always a negative phenomenon, AI systems can potentially increase the speed and scale of biases and perpetuate and amplify harms to individuals, groups, communities, organizations, and society.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

These biases, which are not necessarily always harmful, may be exacerbated by AI system opacity and the resulting lack of transparency.

“These biases, which are not necessarily always harmful, may be exacerbated by AI system opacity and the resulting lack of transparency.”

• AssumptionRests on an assumption: Decisions that go into the design, development, deployment, evaluation, and use of AI systems reflect systemic and human cognitive biases.
• AssumptionRests on an assumption: AI actors bring their cognitive biases, both individual and group, into the process.

Classified as probably not a substantial claim. May combine two claims.

Systemic bias can be present in AI datasets, the organizational norms, practices, and processes across the AI lifecycle, and the broader society that uses AI systems.

“Systemic bias can be present in AI datasets, the organizational norms, practices, and processes across the AI lifecycle, and the broader society that uses AI systems.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

Many of the data-driven approaches that AI systems rely on attempt to convert or represent individual and social observational and decision-making practices into measurable quantities.

“Many of the data-driven approaches that AI systems rely on attempt to convert or represent individual and social observational and decision-making practices into measurable quantities.”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

This risk-based approach also enables Framework users to compare their approaches with other approaches and to gauge the resources needed (e.g., staffing, funding) to achieve AI risk management goals in a costeffective, prioritized manner.

“This risk-based approach also enables Framework users to compare their approaches with other approaches and to gauge the resources needed (e.g., staffing, funding) to achieve AI risk management goals in a costeffective, prioritized manner.”

Classified as probably not a substantial claim.

Attempting to eliminate negative risk entirely can be counterproductive in practice because not all incidents and failures can be eliminated.

“Attempting to eliminate negative risk entirely can be counterproductive in practice because not all incidents and failures can be eliminated.”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

A risk management culture can help organizations recognize that not all AI risks are the same, and resources can be allocated purposefully.

“A risk management culture can help organizations recognize that not all AI risks are the same, and resources can be allocated purposefully.”

Probably not a substantial claim: may not pass S4 (based).

Successful risk management depends upon a sense of collective responsibility among AI actors shown in Figure 3.

“Successful risk management depends upon a sense of collective responsibility among AI actors shown in Figure 3.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

Both AI and traditional software technologies and systems are subject to rapid innovation.

“Both AI and traditional software technologies and systems are subject to rapid innovation.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

Bias is tightly associated with the concepts of transparency as well as fairness in society.

“Bias is tightly associated with the concepts of transparency as well as fairness in society.”

Probably not a substantial claim: may not pass S2 (checkable), S4 (based). May combine two claims.

It is difficult to determine whether an opaque system possesses such characteristics, and to do so over time as complex systems evolve.

“However, it is difficult to determine whether an opaque system possesses such characteristics, and to do so over time as complex systems evolve.”

Probably not a substantial claim: may not pass S3 (load-bearing).

AI RMF profiles assist organizations in deciding how they might best manage AI risk that is well-aligned with their goals, considers legal/regulatory requirements and best practices, and reflects risk management priorities.

“AI RMF profiles assist organizations in deciding how they might best manage AI risk that is well-aligned with their goals, considers legal/regulatory requirements and best practices, and reflects risk management priorities.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based). May combine two claims.

Standards of fairness can be complex and difficult to define because perceptions of fairness differ among cultures and may shift depending on application.

“Standards of fairness can be complex and difficult to define because perceptions of fairness differ among cultures and may shift depending on application.”

Probably not a substantial claim: may not pass S2 (checkable), S4 (based).

Employing safety considerations during the lifecycle and starting as early as possible with planning and design can prevent failures or conditions that can render a system dangerous.

“Employing safety considerations during the lifecycle and starting as early as possible with planning and design can prevent failures or conditions that can render a system dangerous.”

Probably not a substantial claim: may not pass S3 (load-bearing).

Privacy and cybersecurity risk management considerations and approaches are applicable in the design, development, deployment, evaluation, and use of AI systems.

“Privacy and cybersecurity risk management considerations and approaches are applicable in the design, development, deployment, evaluation, and use of AI systems.”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

The information gathered while carrying out the MAP function enables negative risk prevention and informs decisions for processes such as model management, as well as an initial decision about appropriateness or the need for an AI solution.

“The information gathered while carrying out the MAP function enables negative risk prevention and informs decisions for processes such as model management, as well as an initial decision about appropriateness or the need for an AI solution.”

Probably not a substantial claim: may not pass S3 (load-bearing).

Different types of safety risks may require tailored AI risk management approaches based on context and the severity of potential risks presented.

“Different types of safety risks may require tailored AI risk management approaches based on context and the severity of potential risks presented.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based). May combine two claims.

Having a diverse team contributes to more open sharing of ideas and assumptions about purposes and functions of the technology being designed, developed, deployed, or evaluated, which can create opportunities to surface problems and identify existing and emergent risks.

“Having a diverse team contributes to more open sharing of ideas and assumptions about purposes and functions of the technology being designed, developed, AI RMF 1.0 deployed, or evaluated -which can create opportunities to surface problems and identify existing and emergent risks.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based). May combine two claims.

Transparency, explainability, and interpretability are distinct characteristics that support each other.

“Transparency, explainability, and interpretability are distinct characteristics that support each other.”

Probably not a substantial claim: may not pass S3 (load-bearing).

Privacy and cybersecurity risks are also considered as part of broader enterprise risk management considerations, which may incorporate AI risks.

“Privacy and cybersecurity risks are also considered as part of broader enterprise risk management considerations, which may incorporate AI risks.”

Classified as probably not a substantial claim.

This complexity and varying levels of visibility can introduce uncertainty into risk management practices.

“This complexity and varying levels of visibility can introduce uncertainty into risk management practices.”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

Robustness requires not only that the system perform exactly as it does under expected uses, but also that it should perform in ways that minimize potential harms to people if it is operating in an unexpected setting.

“Robustness requires not only that the system perform exactly as it does under expected uses, but also that it should perform in ways that minimize potential harms to people if it is operating in an unexpected setting.”

Probably not a substantial claim: may not pass S3 (load-bearing).

Privacy-enhancing technologies ('PETs') for AI, as well as data minimizing methods such as de-identification and aggregation for certain model outputs, can support design for privacy-enhanced AI systems.

“Privacy-enhancing technologies (“PETs”) for AI, as well as data minimizing methods such as de-identification and aggregation for certain model outputs, can support design for privacy-enhanced AI systems.”

Probably not a substantial claim: may not pass S2 (checkable). May combine two claims.

Risk management can enable AI developers and users to understand impacts and account for the inherent limitations and uncertainties in their models and systems, which in turn can improve overall system performance and trustworthiness and the likelihood that AI technologies will be used in ways that are beneficial.

“Risk management can enable AI developers and users to understand impacts and account for the inherent limitations and uncertainties in their models and systems, which in turn can improve overall system performance and trustworthiness and the likelihood that AI technologies will be used in ways that are beneficial.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

Identifying contextual factors in the MAP function will assist AI actors in determining the level of risk and potential management efforts.

“Identifying contextual factors in the MAP function will assist AI actors in determining the level of risk and potential management efforts.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

Systemic biases at the organizational level can influence how teams are structured and who controls the decision-making processes throughout the AI lifecycle.

“Systemic biases at the organizational level can influence how teams are structured and who controls the decision-making processes throughout the AI lifecycle.”

• AssumptionRests on an assumption: Decisions that go into the design, development, deployment, evaluation, and use of AI systems reflect systemic and human cognitive biases.
• AssumptionRests on an assumption: AI actors bring their cognitive biases, both individual and group, into the process.

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

GOVERN is a cross-cutting function that is infused throughout AI risk management and enables the other functions of the process.

“GOVERN is a cross-cutting function that is infused throughout AI risk management and enables the other functions of the process.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

Maintaining the provenance of training data and supporting attribution of the AI system's decisions to subsets of training data can assist with both transparency and accountability.

“Maintaining the provenance of training data and supporting attribution of the AI system's decisions to subsets of training data can assist with both transparency and accountability.”

Probably not a substantial claim: may not pass S4 (based).

Transparency is often necessary for actionable redress related to AI system outputs that are incorrect or otherwise lead to negative impacts.

“Transparency is often necessary for actionable redress related to AI system outputs that are incorrect or otherwise lead to negative impacts.”

Probably not a substantial claim: may not pass S2 (checkable), S3 (load-bearing), S4 (based). May combine two claims.

Effective risk management is realized through organizational commitment at senior levels and may require cultural change within an organization or industry.

“Effective risk management is realized through organizational commitment at senior levels and may require cultural change within an organization or industry.”

Probably not a substantial claim: may not pass S4 (based). May combine two claims.

Explainable systems can be debugged and monitored more easily, and they lend themselves to more thorough documentation, audit, and governance.

“Explainable systems can be debugged and monitored more easily, and they lend themselves to more thorough documentation, audit, and governance.”

• AssumptionThe authors state this as an assumption: Perceptions of negative risk stem from a lack of ability to make sense of, or contextualize, system output appropriately.

Classified as probably not a substantial claim.

Comparing Current and Target Profiles likely reveals gaps to be addressed to meet AI risk management objectives.

“Comparing Current and Target Profiles likely reveals gaps to be addressed to meet AI risk management objectives.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

Risk management of AI systems that are intended to augment or replace human activity, for example decision making, requires some form of baseline metrics for comparison.

“Risk management of AI systems that are intended to augment or replace human activity, for example decision making, requires some form of baseline metrics for comparison.”

Classified as probably not a substantial claim. May combine two claims.

Addressing AI trustworthiness characteristics individually will not ensure AI system trustworthiness; tradeoffs are usually involved, rarely do all characteristics apply in every setting, and some will be more or less important in any given situation.

“Addressing AI trustworthiness characteristics individually will not ensure AI system trustworthiness; tradeoffs are usually involved, rarely do all characteristics apply in every setting, and some will be more or less important in any given situation.”

Probably not a substantial claim: may not pass S2 (checkable).

Anticipating, assessing, and otherwise addressing potential sources of negative risk can mitigate this uncertainty and enhance the integrity of the decision process.

“Anticipating, assessing, and otherwise addressing potential sources of negative risk can mitigate this uncertainty and enhance the integrity of the decision process.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based). May combine two claims.

Systematic documentation practices established in GOVERN and utilized in MAP and MEASURE bolster AI risk management efforts and increase transparency and accountability.

“Systematic documentation practices established in GOVERN and utilized in MAP and MEASURE bolster AI risk management efforts and increase transparency and accountability.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

Under certain conditions such as data sparsity, privacy-enhancing techniques can result in a loss in accuracy, affecting decisions about fairness and other values in certain domains.

“Under certain conditions such as data sparsity, privacyenhancing techniques can result in a loss in accuracy, affecting decisions about fairness and other values in certain domains.”

Probably not a substantial claim: may not pass S4 (based). May combine two claims.

Framework users will have enhanced capacity to manage the risks of deployed AI systems and to allocate risk management resources based on assessed and prioritized risks.

“Framework users will have enhanced capacity to manage the risks of deployed AI systems and to allocate risk management resources based on assessed and prioritized risks.”

Probably not a substantial claim: may not pass S4 (based). May combine two claims.

Early decisions in identifying purposes and objectives of an AI system can alter its behavior and capabilities, and the dynamics of deployment setting (such as end users or impacted individuals) can shape the impacts of AI system decisions.

“For example, early decisions in identifying purposes and objectives of an AI system can alter its behavior and capabilities, and the dynamics of deployment setting (such as end users or impacted individuals) can shape the impacts of AI system decisions.”

Probably not a substantial claim: may not pass S2 (checkable), S4 (based). May combine two claims.

Ultimately, trustworthiness is a social concept that ranges across a spectrum and is only as strong as its weakest characteristics.

“Ultimately, trustworthiness is a social concept that ranges across a spectrum and is only as strong as its weakest characteristics.”

Probably not a substantial claim: may not pass S4 (based). May combine two claims.

Measurement of validity, accuracy, robustness, and reliability contribute to trustworthiness and should take into consideration that certain types of failures can cause greater harm.

“Measurement of validity, accuracy, robustness, and reliability contribute to trustworthiness and should take into consideration that certain types of failures can cause greater harm.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based). May combine two claims.

These biases can also influence downstream decisions by end users, decision makers, and policy makers and may lead to negative impacts.

“These biases can also influence downstream decisions by end users, decision makers, and policy makers and may lead to negative impacts.”

• AssumptionRests on an assumption: Decisions that go into the design, development, deployment, evaluation, and use of AI systems reflect systemic and human cognitive biases.
• AssumptionRests on an assumption: AI actors bring their cognitive biases, both individual and group, into the process.

Probably not a substantial claim: may not pass S2 (checkable), S4 (based). May combine two claims.

Effectively managing the risk of potential harms could lead to more trustworthy AI systems and unleash potential benefits to people, organizations, and systems/ecosystems.

“Effectively managing the risk of potential harms could lead to more trustworthy AI systems and unleash potential benefits to people (individuals, communities, and society), organizations, and systems/ecosystems.”

Probably not a substantial claim: may not pass S2 (checkable), S3 (load-bearing), S4 (based). May combine two claims.

Use of the AI RMF alone will not lead to these changes or provide the appropriate incentives.

“Use of the AI RMF alone will not lead to these changes or provide the appropriate incentives.”

Probably not a substantial claim: may not pass S3 (load-bearing).

By promoting higher levels of understanding, transparency increases confidence in the AI system.

“By promoting higher levels of understanding, transparency increases confidence in the AI system.”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

Computational and statistical biases can be present in AI datasets and algorithmic processes, and often stem from systematic errors due to non-representative samples.

“Computational and statistical biases can be present in AI datasets and algorithmic processes, and often stem from systematic errors due to non-representative samples.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based). May combine two claims.

Documentation can enhance transparency, improve human review processes, and bolster accountability in AI system teams.

“Documentation can enhance transparency, improve human review processes, and bolster accountability in AI system teams.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based). May combine two claims.

Processes for independent review can improve the effectiveness of testing and can mitigate internal biases and potential conflicts of interest.

“Processes for independent review can improve the effectiveness of testing and can mitigate internal biases and potential conflicts of interest.”

Probably not a substantial claim: may not pass S4 (based). May combine two claims.

Bias exists in many forms and can become ingrained in the automated systems that help make decisions about our lives.

“Bias exists in many forms and can become ingrained in the automated systems that help make decisions about our lives.”

Probably not a substantial claim: may not pass S3 (load-bearing).

Profiles may illustrate and offer insights into how risk can be managed at various stages of the AI lifecycle or in specific sector, technology, or end-use applications.

“Profiles may illustrate and offer insights into how risk can be managed at various stages of the AI lifecycle or in specific sector, technology, or end-use applications.”

Probably not a substantial claim: may not pass S4 (based).

Creating trustworthy AI requires balancing each of these characteristics based on the AI system's context of use.

“Creating trustworthy AI requires balancing each of these characteristics based on the AI system's context of use.”

Probably not a substantial claim: may not pass S4 (based).

A transparent system is not necessarily an accurate, privacy-enhanced, secure, or fair system.

“A transparent system is not necessarily an accurate, privacy-enhanced, secure, or fair system.”

Probably not a substantial claim: may not pass S3 (load-bearing).

Some AI system features that present risks also can be beneficial.

“Some AI system features that present risks also can be beneficial.”

• AssumptionRests on an assumption: Pre-trained models and transfer learning can advance research and increase accuracy and resilience when compared to other models and approaches.

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

Human-cognitive biases are omnipresent in decision-making processes across the AI lifecycle and system use, including the design, implementation, operation, and maintenance of AI.

“Human-cognitive biases are omnipresent in decision-making processes across the AI lifecycle and system use, including the design, implementation, operation, and maintenance of AI.”

Probably not a substantial claim: may not pass S3 (load-bearing).

Frameworks like the NIST Cybersecurity Framework, NIST Privacy Framework, NIST Risk Management Framework, and Secure Software Development Framework may inform security and privacy considerations in the MAP, MEASURE, and MANAGE functions of the AI RMF.

“While there are significant differences between these frameworks based on the domain addressed -and because AI risk management calls for addressing many other types of risks -frameworks like those mentioned above may inform security and privacy considerations in the MAP, MEASURE, and MANAGE functions of the AI RMF.”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

Existing risk management frameworks such as the NIST Cybersecurity Framework, NIST Privacy Framework, NIST Risk Management Framework, and Secure Software Development Framework have some features in common with the AI RMF, are outcome-based rather than prescriptive, and are often structured around a Core set of functions, categories, and subcategories.

“These frameworks have some features in common with the AI RMF.Like most risk management approaches, they are outcome-based rather than prescriptive and are often structured around a Core set of functions, categories, and subcategories.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

Unrealistic expectations about risk may lead organizations to allocate resources in a manner that makes risk triage inefficient or impractical or wastes scarce resources.

“Unrealistic expectations about risk may lead organizations to allocate resources in a manner that makes risk triage inefficient or impractical or wastes scarce resources.”

Probably not a substantial claim: may not pass S2 (checkable), S4 (based).

Without contextual knowledge, and awareness of risks within the identified contexts, risk management is difficult to perform.

“Without contextual knowledge, and awareness of risks within the identified contexts, risk management is difficult to perform.”

Probably not a substantial claim: may not pass S3 (load-bearing).

Like safety and security, specific technical features of an AI system may promote or reduce privacy.

“Like safety and security, specific technical features of an AI system may promote or reduce privacy.”

Probably not a substantial claim: may not pass S2 (checkable), S4 (based).

Addressing, documenting, and managing AI risks and potential negative impacts effectively can lead to more trustworthy AI systems.

“Addressing, documenting, and managing AI risks and potential negative impacts effectively can lead to more trustworthy AI systems.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

AI risks or failures that are not well-defined or adequately understood are difficult to measure quantitatively or qualitatively.

“AI risks or failures that are not well-defined or adequately understood are difficult to measure quantitatively or qualitatively.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

AI systems can also present new risks to privacy by allowing inference to identify individuals or previously private information about individuals.

“AI systems can also present new risks to privacy by allowing inference to identify individuals or previously private information about individuals.”

Classified as probably not a substantial claim.

Together, explainability and interpretability assist those operating or overseeing an AI system, as well as users of an AI system, to gain deeper insights into the functionality and trustworthiness of the system, including its outputs.

“Together, explainability and interpretability assist those operating or overseeing an AI system, as well as users of an AI system, to gain deeper insights into the functionality and trustworthiness of the system, including its outputs.”

• AssumptionThe authors state this as an assumption: Perceptions of negative risk stem from a lack of ability to make sense of, or contextualize, system output appropriately.