NIST AI RMF DATA INFRASTRUCTURE MODEL

Risk identification and analysis

Part of: MP: MAP — Context & Risk Identification

Description

AI risks and benefits are identified, assessed, prioritized, and documented covering technical, societal, and ethical dimensions. Comprehensive risk identification is the single most valuable activity in AI risk management — you cannot mitigate risks you haven't identified.

Suggested Actions

1

Conduct multi-dimensional risk assessment covering: technical failures (model collapse, adversarial attacks, data poisoning), societal harms (bias, discrimination, privacy violations), legal exposure (regulatory penalties, litigation, contractual breach), and reputational damage

2

Use structured risk identification methods: threat modeling (STRIDE/PASTA adapted for AI), failure mode analysis (FMEA for AI systems), and red team exercises simulating adversarial scenarios

3

Analyze potential benefits and positive impacts alongside risks — risk management is about optimizing the risk-benefit ratio, not eliminating all risk

4

Prioritize risks using a consistent scoring methodology (likelihood x impact) with separate scores for different harm categories (financial, physical safety, privacy, dignity)

5

Document risk-benefit analysis that explicitly justifies deployment decisions — the analysis should be specific enough that a reviewer can assess whether the decision was reasonable

6

Identify cascading and systemic risks: How could a failure in this AI system affect downstream systems, dependent processes, or interconnected decisions?

Related Controls

AI Red Teaming and Adversarial Testing AI Risk Self-Assessment