The NIST AI RMF Playbook lists suggested actions for each subcategory of the framework. NIST says it is not a checklist and that you can use as many or as few suggestions as fit your case. Pick actions by risk, give each an owner and a due date, and record what you skip and why.
What the Playbook contains
For each subcategory under Govern, Map, Measure and Manage, the Playbook gives background and suggested actions. NIST states that suggestions are voluntary and that the Playbook will be updated after the AI RMF revision, with updates expected about twice a year.
Because it moves, record which version you used when you build a mapping.
A selection method that works
- Start with your inventory. List the AI systems and rank them by impact.
- For your top two systems, read the Map and Measure subcategories and mark the ones you cannot currently evidence.
- Read the Govern subcategories that apply to everything: policy, roles, inventory, third parties.
- Choose a small first set, about five to ten actions.
- Turn each into a task with an owner, an evidence artifact and a review date.
Example: GOVERN 1.6, the inventory
The Playbook's suggested actions for the inventory subcategory are concrete. Set policies for creating and maintaining inventories, name a person or team responsible for upkeep, define which systems are inventoried (full coverage is preferred, with high-risk systems as the minimum), and define which attributes to record, such as documentation, source code links, incident response plans, data dictionaries and contacts.
That reads like a task list you can finish in a week.
Example: GOVERN 1.2, the policy
The suggested actions for policy include defining key AI terms and scope, connecting AI governance to existing risk controls, specifying testing and validation, setting monitoring frequency, outlining change management, creating a way for staff to report serious concerns, and specifying and trialing incident response plans. Use it as a table of contents for your AI policy.
Record deliberate skips
An unaddressed subcategory looks like an oversight. A documented skip ("not applicable, we do not train models") looks like a decision. Keep a simple table with the subcategory, status, owner, evidence link and note.
Common mistakes
Teams often export the Playbook into a spreadsheet and assign every row. That creates hundreds of tasks, none with a clear owner, and the effort stalls. Another mistake is treating suggested actions as pass or fail tests. They describe ways to reach an outcome, and a different action that reaches the same outcome is fine. Keep the outcome statement from the subcategory next to your own evidence, and review the list every quarter.
Quick check
Do I have to implement every suggested action?
No. NIST says the Playbook is neither a checklist nor meant to be followed in its entirety.
Where do I put the evidence?
Anywhere your team already keeps compliance records, as long as each action points to a dated artifact such as a policy, a review record or a test report.
Sources
Last reviewed: 19 October 2026.
