Originally published at https://charz.ai/blog/ai-rmf-gap-assessment by Char-Z AI.
This article was drafted with AI assistance and reviewed for factual accuracy. AI-origin labeling applies under Article 50 of the EU AI Act.
Why Assess Your Gap First
Before you invest in AI governance, know where you stand. A gap assessment scores your current practices against the NIST AI RMF's four functions and identifies the highest-impact gaps (NIST, 2023). It is the natural first step for any team — it gives you a baseline, a prioritized roadmap, and evidence of progress over time.
Because the AI RMF is voluntary and non-certifying, a gap assessment is not a pass/fail test. It is an internal measurement of maturity that lets you compare yourself to the framework's practices and to your own prior baseline. It also produces the documentation that supports regulatory and procurement conversations later.
The Assessment Method
Step 1: Scope the assessment.
Decide what you are assessing — the whole organization, a business unit, or a single high-priority system. Most teams start organization-wide at a high level, then go deep on their riskiest system.
Step 2: Score each function.
For each of the four functions, rate your current practices against the framework's recommended actions. Use a simple maturity scale:
0 — Absent — no practice exists.
1 — Ad hoc — practice exists informally.
2 — Defined — practice documented + repeatable.
3 — Managed — practice tracked + measured.
4 — Optimized — practice improving via feedback.
Step 3: Gather evidence.
Score against real artifacts — an inventory, a risk register, a policy, a review log — not intentions. NIST emphasizes evidence of practices, not claimed intent (NIST, 2023).
Step 4: Prioritize gaps.
Rank gaps by two factors: how much each one compounds other risks, and how quickly it can close. The highest-leverage gaps are usually in Govern, because they enable the other three functions.
A Suggested Scorecard
Govern — key questions: named owner? risk appetite? policies? — evidence in: governance charter, policy, roles.
Map — inventory current? stakeholders mapped? — AI system inventory, impact maps.
Measure — scoring rubric? baselines? — methodology doc, risk register.
Manage — treatments tracked? monitoring active? — treatment plan, incident log.
Score each question 0–4, average per function, and you have a maturity profile like "Govern 1, Map 2, Measure 1, Manage 2" that tells you where to focus.
Interpreting Your Results
Govern below 2. Fix governance first. Without ownership and policy, improvements in the other functions will not stick.
Map strong, Measure weak. You know what you have but cannot quantify it. Build a rubric and baseline the high-priority systems.
Measure strong, Manage weak. You assess risk but do not act on it. Prioritize a treatment loop with owners and deadlines.
Everything at 2+. You have a functioning program. Move to deeper per-system assessments or the Generative AI Profile for your genAI systems (NIST, 2024).
Building an Assessment Loop
A gap assessment is most valuable when repeated. Re-run your organization-wide assessment annually, and re-run deep per-system assessments whenever a high-risk system changes materially. Record each baseline so you can demonstrate progress — structured, evidence-based assessment is a marker of a stronger governance program.
Free Starting Point
Our product includes an ISO 42001 readiness and AI risk management flow that walks you through a scored self-assessment and produces a maturity profile. It is a practical way to turn this method into a running, tracked process rather than a one-off exercise.
Sources
NIST. (2023). *Artificial Intelligence Risk Management Framework (AI RMF 1.0)*. National Institute of Standards and Technology. https://doi.org/10.6028/NIST.AI.100-1
NIST. (2024). *Generative Artificial Intelligence Profile (NIST AI 600-1)*. National Institute of Standards and Technology.
Top comments (0)