← Vetro Attest · Free Art. 12/14 checker · Free EU AI Act tools

NIST AI RMF evidence for AI agents

The NIST AI Risk Management Framework (AI RMF 1.0, January 2023) is voluntary guidance for managing AI risk, organised in four functions: Govern, Map, Measure, Manage. NIST also published a Generative AI Profile (NIST AI 600-1) that applies the framework to generative systems.

Being voluntary does not make it optional in sales: US enterprise security questionnaires increasingly ask how an AI vendor applies it. A short answer backed by records beats a long policy document.

Govern

Policies, roles and accountability for AI risk. For agents, the most concrete form of governance is policy as code: the rules an agent must follow, versioned, reviewed and enforced at the call site. Evidence: the policy files, their change history, and log events showing each rule firing.

Map

Context, intended use and the risks that follow from it. Evidence: the list of tools the agent can call and what each can do in the world, plus the misuse cases you considered.

Measure

Quantitative and qualitative assessment of the risks. For agents this includes task success, wrong tool calls, cost per run, injection attempts detected and escalation rates. Evidence: recorded evaluation runs and production metrics derived from the run log.

Manage

Prioritising and acting on risks, including incident response. Evidence: the chain from a monitored finding to a new rule or test, and the runs where the new rule fired. Replaying recorded runs after a fix shows the measure works.

Integrity makes the rest credible

Every function above ends in "show me the records". Records your own team can rewrite are weak evidence for a buyer's risk team. Signed, hash-chained run logs make the answer checkable (see tamper-evident logs). The same evidence maps to ISO/IEC 42001 and the EU AI Act.

Check your own logs

Paste a Vetro ledger or an OpenTelemetry GenAI trace export into the free checker: it verifies integrity and shows which record-keeping obligations your evidence covers, in your browser. When you need something to hand to an auditor or a customer, the countersigned EU AI Act report costs 49 USD, one-off: an ed25519 counter-signature over your evidence plus a mapping to the articles, including an explicit list of what the log cannot show.

See a sample ledger verified in one click, check your own logs free or get the countersigned EU AI Act report.