Why AI Use Matters Under NIST AI RMF
For an organization that uses AI rather than builds it, the first steps are knowing what AI is in use, why, and who decided. Those are the Govern and Map functions, and they are where most organizations have no evidence.
Controls ProctoredAI Evidences
| Control | Evidence in the Monthly Report |
|---|---|
| GOVERN 1.6 AI system inventory | AI apps discovered across endpoints, with sanction status. |
| MAP 1.1 Context and purpose of AI use | Each AI use case documented with purpose, owner and risk class. |
| MANAGE 2.4 Disengage / deactivate | Unapproved and blocked AI apps controlled at the endpoint. |
Each client's report lists these controls with a status. Evidenced means the mechanism produced records in the period; Active means it is enforced with nothing to record; Not configured means the feature is off for that client.
Policy Packs Applied
Selecting NIST AI RMF for a client applies these packs in one step:
- Visibility Baseline. Log every sensitive-data finding, even when nothing is blocked.
- Prompt Injection & Jailbreaks. Block prompts that try to override the model's instructions or extract its system prompt, and uploaded content that carries hidden directives for the AI.
The Setup Checklist
Some steps live outside the policy rules. The console hands the provider this list:
- Build the AI register so GOVERN 1.6 and MAP 1.1 have evidence
- Review tenant-connected AI under Applications
What the Auditor Receives
- A monthly AI Governance Report for the client, stored with a SHA-256 digest so the copy an auditor holds can be matched to the console.
- An evidence bundle with every non-usage event in the period, the client's audit-log entries and the head hash of the audit chain.
- The AI Use Policy generated from the client's real configuration, with each employee's acknowledgment and version.
Questions
Is the NIST AI RMF mandatory?
No. It is voluntary, but customers, insurers and regulators use it as a reference, which makes it a practical structure for a client's AI program.
Which functions does ProctoredAI support?
Govern (an inventory of AI systems in use), Map (the purpose and context of each use case) and Manage (deactivating unapproved AI at the endpoint), with the evidence listed on this page.
What does the checklist add?
Building the AI register and reviewing AI connected to the client's identity tenant. Policy rules alone do not cover those steps.
ProctoredAI supports a client's compliance program; it does not by itself make a client compliant, and it is not legal advice. All frameworks · The MSP AI governance guide