# NIST AI RMF Core Functions Reference for ERP AI > Source: https://netray.co/tools/nist-ai-rmf-core-functions-reference-for-erp-ai > Publisher: Netray (netray.co), AI and integration engineering for ERP and manufacturing systems. > Section: Free Tools ## Short answer See what the four NIST AI RMF functions ask for and what each looks like for an ERP assistant or agent. ## Category compliance-legal ## Audience - CIO - Risk manager - IT manager ## Tool **Kind:** worksheet **Mode:** reference **Columns:** #### Function **Key:** function **Type:** text #### Category **Key:** category **Type:** text #### Intent in plain words **Key:** intent **Type:** text #### What it looks like for ERP AI **Key:** erp **Type:** text **Rows:** **Function:** GOVERN **Category:** Govern 1 **Intent:** Policies, processes and practices for AI risk are in place **Erp:** Written AI policy covering which ERP data models may see and who approves new use cases **Function:** GOVERN **Category:** Govern 2 **Intent:** Accountability structures so teams are empowered and trained **Erp:** Named owner for each assistant or agent, with escalation path **Function:** GOVERN **Category:** Govern 3 **Intent:** Workforce diversity, equity and inclusion considered in AI risk work **Erp:** Include planners, buyers and shop-floor users, not only IT, in reviews **Function:** GOVERN **Category:** Govern 4 **Intent:** Culture that considers and communicates AI risk **Erp:** Blameless review of wrong answers; users know how to report them **Function:** GOVERN **Category:** Govern 5 **Intent:** Engagement with relevant AI actors and affected parties **Erp:** Feedback loop with users and with customers if outputs reach them **Function:** GOVERN **Category:** Govern 6 **Intent:** Policies for third-party software, data and supply chain risk **Erp:** Vendor questionnaire, model license check and data flow review **Function:** MAP **Category:** Map 1 **Intent:** Context is established and understood **Erp:** Document purpose, users, ERP modules and data touched **Function:** MAP **Category:** Map 2 **Intent:** The AI system is categorized **Erp:** Classify as read-only assistant, recommender or agent that writes **Function:** MAP **Category:** Map 3 **Intent:** Capabilities, usage, goals, benefits and costs are understood **Erp:** Baseline time per task and expected error cost before the pilot **Function:** MAP **Category:** Map 4 **Intent:** Risks and benefits mapped for all components including third-party **Erp:** List model, retrieval layer, connectors and any hosted services **Function:** MAP **Category:** Map 5 **Intent:** Impacts to people and organizations are characterized **Erp:** Consider wrong purchase, wrong price quote or wrong compliance answer **Function:** MEASURE **Category:** Measure 1 **Intent:** Appropriate methods and metrics are identified and applied **Erp:** Golden question set with expected answers and a pass rate **Function:** MEASURE **Category:** Measure 2 **Intent:** Systems are evaluated for trustworthy characteristics **Erp:** Test accuracy, security, privacy, bias and robustness to odd inputs **Function:** MEASURE **Category:** Measure 3 **Intent:** Mechanisms to track identified risks over time are in place **Erp:** Dashboards for wrong-answer reports, refusals and drift after ERP upgrades **Function:** MEASURE **Category:** Measure 4 **Intent:** Feedback on measurement efficacy is gathered **Erp:** Review whether the test set still reflects real user questions **Function:** MANAGE **Category:** Manage 1 **Intent:** Risks are prioritized, responded to and managed **Erp:** Risk register with owner, mitigation and residual risk **Function:** MANAGE **Category:** Manage 2 **Intent:** Strategies to maximize benefits and minimize harm are planned **Erp:** Human approval for any write-back; narrow tool scopes **Function:** MANAGE **Category:** Manage 3 **Intent:** Risks from third-party entities are managed **Erp:** Exit plan if a hosted model or vendor changes terms **Function:** MANAGE **Category:** Manage 4 **Intent:** Risk treatments, incident response and recovery are documented **Erp:** Runbook to disable an agent and roll back its actions **Function:** Trait **Category:** Valid and reliable **Intent:** Output is accurate and consistent for its purpose **Erp:** Answers trace back to ERP rows or document passages **Function:** Trait **Category:** Safe **Intent:** Does not endanger life, health or property **Erp:** No control of machines or safety decisions without separate engineering review **Function:** Trait **Category:** Secure and resilient **Intent:** Resists attack and recovers from failure **Erp:** Prompt injection tests, least-privilege roles, fallback when AI is down **Function:** Trait **Category:** Accountable and transparent **Intent:** Information about the system is available to users **Erp:** Show the query or sources used for each answer **Function:** Trait **Category:** Explainable and interpretable **Intent:** Outputs can be understood in context **Erp:** Plain-language reason attached to each recommendation **Function:** Trait **Category:** Privacy-enhanced **Intent:** Protects human autonomy and identity **Erp:** Mask personal data and keep employee data out of prompts **Function:** Trait **Category:** Fair, with harmful bias managed **Intent:** Avoids unfair outcomes **Erp:** Check worker scheduling or supplier scoring for skewed results **Notes:** Category titles are paraphrased from the NIST AI Risk Management Framework 1.0 (January 2023) for orientation. NIST AI 600-1 adds a Generative AI Profile. Read the official publication for exact subcategory text. ## Content **Intro:** The NIST AI Risk Management Framework is voluntary but widely used as a common language for AI governance. This table condenses its four functions and seven trustworthiness traits into what an ERP assistant or agent team would actually do. **Sections:** #### How to use it **Body:** Walk the table top to bottom for one AI system at a time, and write the owner, evidence and status next to each row in your own risk register. Govern is organization-wide, so complete it once; Map, Measure and Manage repeat per system. Export the table to Excel and add columns for evidence links and review dates. #### The four functions **Body:** Govern builds the policies, roles and culture. Map establishes context and identifies what could go wrong. Measure tests and tracks those risks with defined metrics. Manage decides what to do about them, including incident response. The traits at the bottom are the lens: valid and reliable, safe, secure and resilient, accountable and transparent, explainable, privacy-enhanced and fair. **Bullets:** - Govern once, then Map, Measure and Manage per system - Use a golden question set to make Measure concrete - Tie Manage to a disable-and-rollback runbook - Revisit after every ERP upgrade or model change #### Common mistakes **Body:** Teams treat the framework as a certification, but it is guidance, so nobody can be certified as compliant. Others skip Measure and rely on demos. A frequent gap is third-party risk: the model, the vector database and the connector all count. Finally, remember that model behavior can change when you upgrade the model, so evidence should carry version numbers. **Cta:** Netray can help turn this into a working governance pack for a specific ERP assistant, including test sets, logs and approval flows. **Faq:** #### Is the NIST AI RMF mandatory? **Answer:** No, it is voluntary guidance. Some customers, regulators and contracts reference it, so aligning with it makes security questionnaires and audits easier to answer. #### How does it relate to the EU AI Act? **Answer:** They are separate. The AI Act is binding law with defined tiers. The RMF is a voluntary process framework that can help you build the risk management and documentation practices the Act expects. #### What is the Generative AI Profile? **Answer:** NIST AI 600-1 is a companion profile that applies the RMF to generative AI risks such as confabulation, data privacy and information security. It is useful for LLM-based ERP assistants. #### Where should a small team start? **Answer:** Start with Map 1 and Measure 1: document the purpose and data, then build a small test set. Those two steps expose most practical problems early. ## Search terms nist ai rmf govern map measure manage, nist ai rmf categories list, ai risk management framework for enterprise, nist ai 600-1 generative ai profile, ai rmf trustworthy characteristics, ai risk framework erp --- Talk to an engineer: https://netray.co/contact?intent=erp_ai | Machine catalog: https://netray.co/agent/catalog.json