{"slug":"us-nist-ai-rmf-govern","id":"AIPT-OBL-0112","permanent_url":"https://aipolicytracker.org/id/AIPT-OBL-0112","title":"Establish AI governance policies, roles and accountability (Govern)","short_title":"Govern function","category":"governance_accountability","summary":"Govern covers policies and procedures for AI risk, roles and responsibilities, workforce diversity and training, organisational culture, stakeholder engagement, and third-party risk management. It is the cross-cutting function that supports the other three.\n","practical_action":"Adopt an AI policy, assign owners, and set a risk-tolerance statement approved by leadership.","is_binding":false,"applies_from":null,"section":"Part 2: Core","source_reference":"GOVERN function","official_source_url":"https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.100-1.pdf","review_status":"verified","confidence_level":"high","last_verified_at":"2026-09-26","reviewed_by":"Bhaskar Bhatt","actors":["provider","deployer"],"sectors":["cross_sector"],"use_cases":["hiring_and_hr","generative_ai"],"applicability":[{"description":"Voluntary; any organisation adopting the framework.","actors":["provider","deployer"],"conditions":null}],"evidence_examples":[{"title":"AI governance policy","description":null,"artifact_type":"document"}],"framework_mappings":[{"framework":"iso_42001","framework_name":"ISO/IEC 42001:2023","reference":"Clauses 4–5 and 7","note":"Original editorial mapping: leadership, context and support.","confidence_level":"high","is_original":true}],"controls":[{"slug":"ai-governance-policy-and-accountability","title":"AI governance policy and accountability structure","kind":"policy","relationship":"satisfies","note":"Policy, roles, risk tolerance and culture map to the Govern outcomes.","confidence_level":"high","url":"https://aipolicytracker.org/controls/ai-governance-policy-and-accountability"},{"slug":"ai-literacy-and-role-based-training","title":"AI literacy and role-based training programme","kind":"training","relationship":"supports","note":"Workforce training outcomes.","confidence_level":"high","url":"https://aipolicytracker.org/controls/ai-literacy-and-role-based-training"},{"slug":"third-party-ai-due-diligence","title":"Vendor and third-party AI due diligence","kind":"process","relationship":"supports","note":"Third-party risk management outcomes.","confidence_level":"high","url":"https://aipolicytracker.org/controls/third-party-ai-due-diligence"}],"url":"https://aipolicytracker.org/obligations/us-nist-ai-rmf-govern","policy":{"slug":"us-nist-ai-rmf","title":"NIST AI Risk Management Framework (AI RMF 1.0) and Generative AI Profile","status":"voluntary_standard","jurisdiction":"us","url":"https://aipolicytracker.org/policies/us-nist-ai-rmf"}}