KairoNull / Insights / NIST AI RMF
Risk Management · Updated October 2026
The NIST AI Risk Management Framework is a voluntary framework for managing AI risk. NIST describes it as flexible, use-case agnostic and intended for voluntary use. It is not a regulation and does not prescribe a particular cryptographic evidence architecture.
The framework is organised around Govern, Map, Measure and Manage. These functions address organisational governance, context and impact assessment, measurement, and risk response. The accompanying Playbook provides suggested actions and documentation practices.
Organisations implementing these functions may need operational records, measurement outputs, decisions, approvals, incidents and other documentation to support their own governance and assurance processes. The exact evidence required depends on the organisation, use case and other applicable obligations.
This is where KairoNull can be useful: it records the AI decision context your integration sends, links the event to the applicable control state, and produces structured evidence for later review. That is a product capability, not an assertion that NIST mandates the underlying technology.
The EU AI Act is a separate legal framework. Article 12 contains a specific record-keeping obligation for high-risk AI systems, including automatic recording of events and traceability requirements. That legal obligation should not be presented as if it were a requirement of the NIST AI RMF.
The useful question is not whether NIST requires cryptography. It is whether an organisation can reconstruct a consequential AI decision later, identify the controls and context that applied, and produce the records needed for its governance, assurance or regulatory obligations.
If the existing stack can already do that reliably, a cryptographic evidence layer may add limited incremental value. If it cannot, runtime evidence capture is the more fundamental problem to solve.