From the wave-0 evidence ledger
Recorded claims
Each claim states what the inspected source says, at the recorded location—bounded by its scope and graded by its confidence. Nothing here is a synthesis across works.
AI RMF 1.0 organizes organizational risk work into four functions—Govern, Map, Measure, and Manage—and treats governance as cross-cutting across the AI lifecycle.
Scope: Voluntary, rights-preserving, use-case-agnostic risk management.
The Core and Playbook call for defined roles and training, AI inventories and decommissioning, explicit human-AI role boundaries, monitoring and incident handling, testing/evaluation, and third-party contingencies.
Scope: Organization-level control objectives to adapt by context.
Boundaries
Limitations & independence
Recorded at coding time, carried with the work forever. A claim without its limits is not evidence.
Recorded limitations
- Voluntary and use-case agnostic
- Version 1.0 was under revision at cutoff
- Practices do not demonstrate compliance or effectiveness
- Implementation must be risk- and context-specific
Source independence
US government voluntary framework developed through a public process; normative authority, not empirical control-effectiveness evidence.