Measure and test trustworthiness characteristics (Measure)

Practical action

Define a test plan with metrics for each trustworthiness characteristic and record results.

Who does it apply to?

Voluntary; any organisation adopting the framework.

Actors

Provider / developer

Sectors

Cross-sector / all sectors

Use cases

Biometrics and facial recognitionGenerative AI and foundation modelsSafety-critical and infrastructure

Which controls meet this duty?

Satisfies: the control, operated properly, does the work the duty asks for. Supports: it contributes but the duty needs more. Each control page lists every other duty it serves, so work done once can be counted once.

• satisfiesTechnical measureQuality or testing lead · at launch and on material change
  Accuracy, robustness, fairness and security testing

  Serves 15 recorded duties · evidence: Pre-release test report, Test plan and acceptance criteria, Release test sign-off

  Metrics and test methods for each trustworthiness characteristic.

• supportsTechnical measureAI security or safety lead · at launch and on material change
  Adversarial and red-team testing for generative AI

  Serves 8 recorded duties · evidence: Red-team exercise report, Red-team rules of engagement and scenario library, Adversarial findings tracker

  Red-teaming and independent review for generative AI.

• supportsTechnical measureAI system owner · continuous
  Post-deployment monitoring and drift detection

  Serves 10 recorded duties · evidence: Post-market monitoring plan, Monitoring dashboard or periodic monitoring report, Monitoring review decision

  Tracking metrics over time.

Templates that cover this duty

Generated from the records. Free · no account · links emailed to your work address. This duty is cited in each file with its source reference and a link back here.

• AI Risk Register (MIT AI Risk Repository taxonomy)

  Register · XLSX · v4

• ISO/IEC 42001 Gap Assessment and Statement of Applicability

  Assessment · XLSX · v3

• NIST AI RMF ↔ EU AI Act ↔ ISO/IEC 42001 Crosswalk

  Crosswalk · XLSX · v3

• AI Audit Evidence Tracker

  Register · XLSX · v1

All 7 templates that cover it →

What evidence would a reviewer expect?

Framework mappings

Original editorial crosswalks. They cite clause numbers only and reproduce no standard text; confidence reflects how direct the mapping is.

See every United States duty mapped this way →

Frequently asked questions

Cite this record

AIPolicyTracker (2026). “Measure and test trustworthiness characteristics (Measure) (NIST AI RMF)” [AIPT-OBL-0114, verified 26 September 2026 by Bhaskar Bhatt]. https://aipolicytracker.org/id/AIPT-OBL-0114 (accessed 27 October 2026). Data licensed CC BY 4.0.

Permanent id AIPT-OBL-0114: it never changes or gets reused, and its address keeps working if this page moves.

Cite the official text alongside it: Artificial Intelligence Risk Management Framework (AI RMF 1.0), National Institute of Standards and Technology, https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.100-1.pdf.

@misc{aipolicytracker2026_measureandtesttrustworth,
  author       = {{AIPolicyTracker}},
  title        = {{Measure and test trustworthiness characteristics (Measure) (NIST AI RMF)}},
  year         = {2026},
  howpublished = {\url{https://aipolicytracker.org/obligations/us-nist-ai-rmf-measure}},
  url          = {https://aipolicytracker.org/obligations/us-nist-ai-rmf-measure},
  urldate      = {2026-10-27},
  note         = {Data licensed CC BY 4.0. Accessed 27 October 2026}
}

Change history

Similar obligations in other instruments

• Manage systemic risk for high-impact general-purpose models — EU AI Act, European Union
• Large frontier developers must publish a frontier AI framework — California SB 53, California (United States)
• Large frontier developers must send periodic summaries of catastrophic-risk assessments to the state — California SB 53, California (United States)
• Operators of AI above the compute threshold must run lifecycle risk management and report safety results — AI Basic Act, South Korea