NIST AI RMF

NIST AI RMF Advanced

Name: eurocompliant.com AI Compliance Copilot
Price: 299 EUR
Author: eurocompliant.com

Complex NIST AI RMF scenarios: generative AI profile considerations, cross-framework mapping, and organisational maturity.

10 questions · 80% to pass · free

eurocompliant.com is not an accredited certification body. This is a self-paced educational assessment; the certificate confirms completion only, not a professional, statutory, or accredited qualification.

Your details

Name *

Email *

We'll email your certificate here if you pass. We may occasionally follow up about eurocompliant.com - you can unsubscribe any time.

Question 1 of 10

NIST published a Generative AI Profile as a companion resource to the AI RMF. What is the purpose of such 'profiles'?

Profiles replace the four core functions entirely with a new structureProfiles are only used for marketing purposes with no risk management contentProfiles apply the core Govern-Map-Measure-Manage functions to specific use cases or technology types (e.g. generative AI), highlighting risks and actions particularly relevant to that contextProfiles are mandatory certifications issued by NIST

Question 2 of 10

Which of the following are risks specifically emphasised in NIST's Generative AI Profile guidance, beyond the general AI RMF's core concerns?

Select all that apply.

Risks of generating harmful, biased, or intellectual-property-infringing contentThe organisation's unrelated hiring budgetData privacy risks from training on or memorising sensitive dataConfabulation/hallucination of false but plausible content

Question 3 of 10

An organisation wants to map its existing SOC 2 and ISO/IEC 27001 controls to relevant NIST AI RMF activities. What is the main value of doing this?

Such mapping is explicitly prohibited by NISTIt can help the organisation avoid duplicating effort by identifying where existing controls already partially address AI RMF Map/Measure/Manage activities, and where AI-specific gaps remainNo value — the frameworks share no common groundIt would automatically grant NIST certification, which does not otherwise exist

Question 4 of 10

How should an organisation with multiple AI systems at different maturity/risk levels apply the AI RMF's four functions?

Apply every function identically and with equal intensity to every system regardless of riskThe AI RMF can only be applied to a single AI system per organisationApply the functions in a risk-based, proportionate way — higher-risk or higher-impact systems generally warrant more rigorous Map/Measure/Manage activity than lower-risk onesOnly the Govern function needs to be applied; Map/Measure/Manage are optional

Question 5 of 10

Why does the NIST AI RMF avoid prescribing specific numerical risk thresholds or pass/fail criteria?

NIST was unable to define any criteria due to lack of expertiseNumerical thresholds are provided but were omitted from public versionsThe framework is intended to be flexible and applicable across diverse sectors, use cases, and organisational risk tolerances, rather than imposing a one-size-fits-all standardThe framework only applies to non-technical risks, so numbers are irrelevant

Question 6 of 10

The NIST AI RMF explicitly recognises that AI risks can be interrelated, such that addressing one risk (e.g. improving accuracy) could introduce or exacerbate another (e.g. reduced explainability), requiring organisations to consider trade-offs.

TrueFalse

Question 7 of 10

An organisation's Govern function documentation exists but is not actually followed in day-to-day AI development practice. What maturity gap does this illustrate?

Governance documentation is explicitly discouraged by the frameworkNo gap — documentation alone satisfies the Govern function regardless of practiceThis scenario is outside the scope of anything the AI RMF addressesA gap between documented policy and operational practice, which undermines the AI RMF's goal of an organisational culture of risk management rather than a paper exercise

Question 8 of 10

How might 'Measure' function activities need to differ for a general-purpose foundation model versus a narrow, single-purpose AI system?

Foundation models cannot be measured at all under the frameworkA general-purpose model may need broader, more exploratory measurement across many potential downstream uses and emergent behaviours, while a narrow system can often be measured more precisely against its specific defined taskMeasurement approaches should always be identical regardless of system typeOnly narrow AI systems require any measurement

Question 9 of 10

Which of the following would be relevant inputs when an organisation tailors a NIST AI RMF-aligned programme to its own context, consistent with the framework's flexible design?

Select all that apply.

The specific AI use cases and their potential impactsAn unrelated competitor's internal org chartIts existing risk management maturity and available resourcesThe organisation's sector-specific regulatory obligations

Question 10 of 10

What is the significance of the AI RMF being developed through a multi-stakeholder, consensus-driven process involving industry, academia, civil society, and government?

Multi-stakeholder input was only sought after the framework's final publication, with no effect on its contentIt has no bearing on the framework's content or adoptionIt is intended to make the framework broadly applicable and credible across sectors, reflecting diverse perspectives on AI risk rather than a single narrow viewpointOnly government input was considered despite claims of broader consultation

0 of 10 answered