NIST Opens 45-Day Comment on AI Risk Management Draft

NIST released a draft update to its AI Risk Management Framework on June 11, 2024, and opened a 45-day public comment period, directly impacting how regulated enterprises must approach AI governance and risk controls NIST.

NIST published a draft revision of its AI Risk Management Framework (AI RMF) and is inviting public comments until July 26, 2024. The update aims to address new and emerging AI risks, clarify guidance for enterprise adoption, and ensure the framework remains relevant as AI technologies and regulatory expectations evolve. This move affects all organizations deploying or developing AI systems, particularly those in regulated sectors such as healthcare, finance, and critical infrastructure NIST Tech Policy Journal.

NIST’s AI RMF is a foundational reference for U.S. enterprises seeking to align with federal guidance and international best practices on AI risk management. The draft update responds to stakeholder feedback and the shifting regulatory landscape, including the EU AI Act and White House Executive Order on AI, by refining definitions of AI risks, clarifying roles and responsibilities, and expanding guidance on transparency, accountability, and incident response. For regulated industries, the framework’s evolution directly informs compliance programs, procurement standards, and third-party risk assessments, especially as agencies like the SEC and FDA increase scrutiny of AI-enabled products and services NIST Tech Policy Journal White House.

CTOs, CISOs, and Compliance Officers should review the draft framework and submit organizational feedback by July 26, 2024. Over the next 30-90 days, enterprises should assess their current AI risk management practices against the proposed changes, identify potential compliance gaps, and prepare for likely updates to internal policies and vendor requirements. Early engagement in the comment process can help shape final guidance and ensure alignment with both U.S. and international regulatory trends.

What This Means for Enterprise AI

NIST’s draft update is likely to become the de facto baseline for AI risk management in the U.S., especially for organizations subject to HIPAA, GLBA, or SEC oversight. Enterprises should immediately map the draft’s new requirements—such as expanded incident response protocols and clarified accountability structures—against their existing AI governance frameworks to identify areas needing remediation NIST.

The 45-day comment window is a critical opportunity for regulated entities to advocate for practical, sector-specific guidance. Participation can influence how NIST addresses issues like model transparency, third-party risk, and sectoral compliance overlaps (e.g., with the EU AI Act or FDA’s Good Machine Learning Practice) Tech Policy Journal White House.

Failure to align with the forthcoming NIST AI RMF update could expose enterprises to regulatory enforcement, reputational risk, and operational disruptions as federal and state agencies increasingly reference NIST standards in audits and investigations. Action items: assign cross-functional teams to review the draft, prepare formal feedback, and update internal controls in anticipation of the final framework.