Skip to content
Gamut AI Gamut AI Docs

Functions and outcome catalogue

This page is a navigation aid for the NIST AI RMF Core as presented in Gamut. The short titles are product-safe summaries. Consult the official AI RMF Core for authoritative wording and context.

Catalogue totals

Section titled “Catalogue totals”
FunctionCategoriesOutcomes
GOVERN (GV)619
MAP (MP)518
MEASURE (ME)422
MANAGE (MG)413
Total1972

GOVERN

Section titled “GOVERN”

GOVERN establishes the organisation-wide conditions that support risk management throughout the AI lifecycle. It is cross-cutting and should continue as context, expectations and risks change.

GV-1 — Governance policies and practices

Section titled “GV-1 — Governance policies and practices”

Focus: transparent policies, controls, risk tolerance, monitoring, inventory and decommissioning.

IDAssessment focus
GV-1.1Legal and regulatory requirements
GV-1.2Trustworthy AI characteristics
GV-1.3Risk-management activity level
GV-1.4Risk-management controls
GV-1.5Monitoring and review cadence
GV-1.6AI system inventory
GV-1.7Safe decommissioning

GV-2 — Accountability structures

Section titled “GV-2 — Accountability structures”

Focus: roles, competence, communication and executive responsibility.

IDAssessment focus
GV-2.1Roles and communication lines
GV-2.2AI risk-management training
GV-2.3Executive responsibility

GV-3 — Workforce diversity and human-AI oversight

Section titled “GV-3 — Workforce diversity and human-AI oversight”

Focus: diverse decision-making and clear human-AI roles.

IDAssessment focus
GV-3.1Diverse AI risk decision-making
GV-3.2Human-AI roles and oversight

GV-4 — Organisational risk culture

Section titled “GV-4 — Organisational risk culture”

Focus: critical thinking, safety-first behaviour, risk communication, testing and incident learning.

IDAssessment focus
GV-4.1Critical thinking and safety-first mindset
GV-4.2Risk and impact communication
GV-4.3Testing, incident identification and sharing

GV-5 — Stakeholder engagement

Section titled “GV-5 — Stakeholder engagement”

Focus: obtaining, adjudicating and integrating external and relevant AI-actor feedback.

IDAssessment focus
GV-5.1External impact feedback
GV-5.2Adjudicated feedback integration

GV-6 — Third-party and supply-chain risk

Section titled “GV-6 — Third-party and supply-chain risk”

Focus: supplier risks, third-party rights and contingency planning.

IDAssessment focus
GV-6.1Third-party AI risk policies
GV-6.2High-risk third-party contingency

MAP

Section titled “MAP”

MAP establishes the system’s context and identifies benefits, costs, affected parties, limitations, impacts and risks. Weak MAP work undermines later measurement and treatment.

MP-1 — Context established

Section titled “MP-1 — Context established”

Focus: intended purpose, deployment context, mission, risk tolerance and socio-technical requirements.

IDAssessment focus
MP-1.1Intended purpose and deployment context
MP-1.2Interdisciplinary context input
MP-1.3Mission and AI goals
MP-1.4Business value or use context
MP-1.5Organisational risk tolerance
MP-1.6System requirements and socio-technical implications

MP-2 — AI system categorisation

Section titled “MP-2 — AI system categorisation”

Focus: tasks, methods, knowledge limits, human oversight and scientific integrity.

IDAssessment focus
MP-2.1Tasks and methods
MP-2.2Knowledge limits and human oversight
MP-2.3Scientific integrity and TEVV considerations

MP-3 — Capabilities, usage, benefits and costs

Section titled “MP-3 — Capabilities, usage, benefits and costs”

Focus: benefits, costs, application scope, competence and oversight.

IDAssessment focus
MP-3.1Potential benefits
MP-3.2Potential costs
MP-3.3Targeted application scope
MP-3.4Operator and practitioner proficiency
MP-3.5Human oversight processes

MP-4 — Risk and benefit mapping

Section titled “MP-4 — Risk and benefit mapping”

Focus: technology, legal, component and third-party risks and internal controls.

IDAssessment focus
MP-4.1Technology and legal risk mapping
MP-4.2Internal risk controls

MP-5 — Impact characterisation

Section titled “MP-5 — Impact characterisation”

Focus: likelihood and magnitude of impacts and continuing engagement with relevant actors.

IDAssessment focus
MP-5.1Likelihood and magnitude of impacts
MP-5.2Regular engagement on impacts

MEASURE

Section titled “MEASURE”

MEASURE uses quantitative, qualitative or mixed methods to evaluate risks and trustworthy characteristics, monitor operation and validate whether the measurement approach remains useful.

ME-1 — Measurement methods

Section titled “ME-1 — Measurement methods”

Focus: risk metrics, control effectiveness and appropriate assessment participation.

IDAssessment focus
ME-1.1Risk-measurement approaches
ME-1.2Metric and control effectiveness
ME-1.3Independent and stakeholder-supported assessment

ME-2 — Trustworthy AI evaluation

Section titled “ME-2 — Trustworthy AI evaluation”

Focus: TEVV, performance, monitoring, safety, security, transparency, explainability, privacy, fairness and environmental impact.

IDAssessment focus
ME-2.1TEVV artefact documentation
ME-2.2Human-subject evaluation requirements
ME-2.3Deployment-like performance criteria
ME-2.4Production monitoring
ME-2.5Valid and reliable demonstration
ME-2.6Safety evaluation
ME-2.7Security and resilience evaluation
ME-2.8Transparency and accountability risks
ME-2.9Explainability and interpretability
ME-2.10Privacy risk examination
ME-2.11Fairness and bias evaluation
ME-2.12Environmental impact and sustainability
ME-2.13TEVV effectiveness

ME-3 — Risk tracking

Section titled “ME-3 — Risk tracking”

Focus: existing, unknown and emergent risks, including feedback and appeal.

IDAssessment focus
ME-3.1Existing and emergent risk tracking
ME-3.2Tracking where metrics are immature
ME-3.3End-user and impacted-community feedback

ME-4 — Measurement feedback

Section titled “ME-4 — Measurement feedback”

Focus: connecting measurement to context and validating whether results and trends remain useful.

IDAssessment focus
ME-4.1Context-connected measurement approaches
ME-4.2Trustworthiness-results validation
ME-4.3Performance-change tracking

MANAGE

Section titled “MANAGE”

MANAGE turns mapped and measured risk into decisions, treatment, resource allocation, response, recovery, communication and continual improvement.

MG-1 — Risk response

Section titled “MG-1 — Risk response”

Focus: proceed decisions, prioritisation, treatment and residual-risk communication.

IDAssessment focus
MG-1.1Proceed decision
MG-1.2Risk-treatment prioritisation
MG-1.3High-priority risk responses
MG-1.4Residual-risk documentation

MG-2 — Benefit maximisation and impact reduction

Section titled “MG-2 — Benefit maximisation and impact reduction”

Focus: resources, non-AI alternatives, sustained value, unknown risks and deactivation.

IDAssessment focus
MG-2.1Risk resources and non-AI alternatives
MG-2.2Sustaining deployed AI value
MG-2.3Previously unknown risk response
MG-2.4Supersede, disengage or deactivate

MG-3 — Third-party risk management

Section titled “MG-3 — Third-party risk management”

Focus: ongoing monitoring and control of third-party resources and pre-trained models.

IDAssessment focus
MG-3.1Third-party monitoring and controls
MG-3.2Pre-trained model monitoring

MG-4 — Treatment monitoring and incident communication

Section titled “MG-4 — Treatment monitoring and incident communication”

Focus: post-deployment monitoring, appeal, override, incident response, recovery, change and continual improvement.

IDAssessment focus
MG-4.1Post-deployment monitoring plans
MG-4.2Continual improvement in updates
MG-4.3Incident and error communication

How to use the catalogue

Section titled “How to use the catalogue”

For each outcome:

  1. Read the official Core wording.
  2. Confirm the selected system and context.
  3. Use the Gamut advisory to plan questions, evidence and testing.
  4. Record Current and Target Profile outcomes.
  5. Record assurance depth separately.
  6. Link evidence, tests and findings.
  7. Define monitoring and reassessment.