AI Strategy and Governance for CIOs: Using the NIST AI RMF

Most organizations are no longer deciding whether to use AI. Employees are already using generative AI tools, vendors are adding AI features to software you already own, and business units are asking for budget to build more. The CIO's job is to turn that scattered activity into a strategy with clear value and to put governance around it that is proportionate to the risk.

Those two jobs belong together. A strategy without governance invites incidents that destroy trust. Governance without strategy becomes a list of things people are not allowed to do, and the work moves somewhere you cannot see it.

This guide outlines a practical approach for CIOs and IT leaders, built on the U.S. National Institute of Standards and Technology's AI Risk Management Framework (AI RMF) and its Generative AI Profile. Both are voluntary.

Start the strategy with problems, not models

An AI strategy should read like any good technology strategy: it starts from business goals and real problems. Ask business leaders where decisions are slow, where skilled people spend time on repetitive work, and where better prediction or summarization would change an outcome.

Then build a portfolio of use cases and sort them by value, feasibility and risk. Feasibility usually depends less on the model than on data quality, process integration and whether people will change how they work. Risk depends heavily on context: a tool that drafts internal meeting notes is a different proposition from one that influences hiring, lending or medical decisions.

For each use case, decide whether to buy, configure or build, and what "good enough" means before you start. Our guide to writing an IT strategy the business will actually use covers how to tie this portfolio to funding and decision forums.

The NIST AI RMF in brief

NIST released AI RMF 1.0 (NIST AI 100-1) on January 26, 2023. It describes itself as voluntary, rights-preserving, non-sector-specific and use-case agnostic.

The framework lists characteristics of trustworthy AI: valid and reliable; safe; secure and resilient; accountable and transparent; explainable and interpretable; privacy-enhanced; and fair with harmful bias managed.

Its core has four functions:

• Govern: a cross-cutting function that cultivates a culture of risk management and sets policies, accountability and processes.
• Map: establishes the context to frame risks related to a specific AI system.
• Measure: uses quantitative, qualitative or mixed-method tools to analyze, assess, benchmark and monitor AI risk and related impacts.
• Manage: allocates risk resources to mapped and measured risks, including plans to respond to, recover from and communicate about incidents.

NIST says that after putting Govern outcomes in place, most users would start with Map and continue to Measure or Manage, iterating as needed.

Govern outcomes every CIO should own

Several Govern subcategories translate directly into CIO responsibilities:

• Legal and regulatory requirements involving AI are understood, managed and documented (GOVERN 1.1).
• Mechanisms are in place to inventory AI systems (GOVERN 1.6).
• There are processes for decommissioning AI systems safely (GOVERN 1.7).
• Roles, responsibilities and lines of communication are documented and clear (GOVERN 2.1), and staff and partners receive AI risk management training (GOVERN 2.2).
• Executive leadership takes responsibility for decisions about AI risks (GOVERN 2.3).
• Policies address AI risks from third-party software, data and supply chains, with contingency processes for failures in high-risk third-party systems (GOVERN 6.1 and 6.2).

The inventory deserves special attention. You cannot govern what you cannot see, and in many organizations the largest AI footprint is inside purchased software and personal use of public tools.

Adding the Generative AI Profile

NIST published the Generative Artificial Intelligence Profile (NIST AI 600-1) on July 26, 2024, as a companion to the AI RMF. It defines 12 risks that are unique to or made worse by generative AI: CBRN information or capabilities; confabulation; dangerous, violent or hateful content; data privacy; environmental impacts; harmful bias or homogenization; human-AI configuration; information integrity; information security; intellectual property; obscene, degrading or abusive content; and value chain and component integration.

The profile organizes suggested actions by AI RMF subcategory. For the inventory outcome, for example, it suggests enumerating generative AI systems in the AI inventory and considering entries such as data provenance, known issues, human oversight roles, intellectual property and sensitive-data considerations, and the underlying foundation models and versions. Its development focused on four primary considerations: governance, content provenance, pre-deployment testing and incident disclosure.

For most enterprises, confabulation, data privacy, information security, intellectual property and value chain risks will be the everyday concerns. NIST defines confabulation as "the production of confidently stated but erroneous or false content," commonly called hallucinations.

Turning frameworks into an operating model

A workable AI governance model for a midsize or large organization usually includes:

1. A short, readable policy covering approved tools, prohibited data, required human review and how to request new uses.
2. A use-case intake process that classifies risk by context and routes higher-risk cases to deeper review.
3. An inventory covering built, bought and embedded AI, with an owner for each entry.
4. Vendor due diligence questions about training data, data retention, model changes and incident notification.
5. Testing and monitoring proportionate to risk, including checks for accuracy in your own context.
6. An incident process that treats harmful AI output as a reportable event.
7. A cross-functional group, typically IT, security, legal, privacy, risk and business owners, that meets regularly.

If you already use ISACA's COBIT, ISACA has published guidance on applying it to AI governance. Organizations that want a certifiable management system can look at ISO/IEC 42001:2023, which ISO describes as specifying requirements for establishing, implementing, maintaining and continually improving an artificial intelligence management system.

Keep it current

This area changes quickly. NIST's AI RMF page states that AI RMF 1.0 is being revised and notes an April 7, 2026 concept note for a profile on trustworthy AI in critical infrastructure. Assign someone to watch for updates, and review your policy and inventory at least annually.

Key takeaways

• Build the AI strategy as a portfolio of business problems, sorted by value, feasibility and context-dependent risk.
• The voluntary NIST AI RMF 1.0 (January 26, 2023) organizes AI risk work into Govern, Map, Measure and Manage.
• An AI inventory that includes purchased and embedded AI is the foundation of governance.
• The Generative AI Profile (NIST AI 600-1, July 26, 2024) names 12 generative AI risks and suggests actions mapped to the AI RMF.
• Make governance proportionate and easy to follow, and revisit it as NIST and other bodies update guidance.

Sources

• National Institute of Standards and Technology, AI Risk Management Framework
• National Institute of Standards and Technology, Artificial Intelligence Risk Management Framework (AI RMF 1.0), NIST AI 100-1 (January 2023)
• National Institute of Standards and Technology, Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile, NIST AI 600-1 (July 2024)
• International Organization for Standardization, ISO/IEC 42001:2023 Information technology — Artificial intelligence — Management system
• ISACA, Leveraging COBIT for Effective AI System Governance (January 31, 2025)