SMF Outputs as AI Governance Evidence¶
Type: Non-normative
This is a mapping, not legal or audit advice. Confirm it with your own governance and audit functions.
AI governance frameworks ask organizations to show that AI systems are tested, monitored and controlled. SMF's Assurance outputs are concrete evidence that an AI consumer handles business meaning as intended.
NIST AI Risk Management Framework¶
The AI RMF organizes activities into four functions: Govern, Map, Measure, Manage.
| AI RMF function | SMF evidence |
|---|---|
| Govern: accountability, policies, roles | Ownership records; conflict records with owners; resolution rules approved by named owners |
| Map: context and intended use | Context definitions; resolution rules stating which meaning applies where; certification scopes on metric contracts |
| Measure: testing and evaluation | Suites of checks and pass/fail results per consumer and release; clarification and ungoverned-term rates |
| Manage: responding to and tracking risks | Failed checks and failed claim trace verifications routed to existing incident and change processes; versioned, effective-dated contracts |
ISO/IEC 42001 (AI management system)¶
ISO/IEC 42001 follows the common management-system structure. SMF evidence is most relevant to:
| Management-system area | SMF evidence |
|---|---|
| Operational planning and control | Resolution rules and context packages that constrain how an AI consumer interprets business terms |
| Performance evaluation (monitoring, measurement, analysis) | Assurance test results over time; claim verification results |
| Improvement | Regression cases added after failures; contract version history |
What this evidence does and does not show¶
- Shows: the consumer resolves, clarifies and discloses business meaning as the organization defined it, for the tested cases.
- Does not show: that the underlying data is correct, that the model is safe in general, or that untested questions behave correctly.