Where it applies, and to whom.
Any organisation that designs, develops, deploys or uses AI — adoption is voluntary.
How Prefactor maps to NIST AI RMF.
NIST AI Risk Management Framework, issued by US National Institute of Standards and Technology, applies to us federal ai deployments; broadly adopted in industry. This page covers what affects AI agent teams specifically and how to map controls to it.
Source: official NIST AI RMF reference. This page is practical guidance — confirm interpretation with your counsel.
What it requiresAccountability, policies and culture for AI risk
How Prefactor addresses itPer-agent ownership and registry, policy-as-code, and versioned eval and policy history make governance accountable and documented.
What it requiresIdentify context and where risk arises
How Prefactor addresses itTrace data maps every action, tool call and decision, and surfaces where an agent has drifted from its design.
What it requiresAnalyse, benchmark and track AI risks
How Prefactor addresses itEval suites score quality, groundedness and cost on real traffic, with benchmarks and regression detection.
What it requiresPrioritise and act on risks
How Prefactor addresses itRuntime guardrails block, throttle or route high-risk actions, with human-in-the-loop and full incident traces.
What it requiresTrack performance after deployment
How Prefactor addresses itDrift detection and alerting on quality, cost and behaviour — a live feed, not a periodic check.
What it requiresProvide evidence and disclosure
How Prefactor addresses itEval results, trace samples and policy history per agent version, exportable as dated technical documentation.
The detail, in full.
Frequently asked questions
Does using a 'compliant' provider make us compliant?
Can Prefactor make us compliant?
Key provisions for AI agents
- Four functions: Govern, Map, Measure, Manage
- Trustworthy AI characteristics
- Lifecycle approach
- GenAI Profile (NIST AI 600-1) for generative AI
Who is affected
US federal AI deployments; broadly adopted in industry
Evidence collection
Auditors and reviewers typically expect:
- Continuous, dated evidence — not point-in-time snapshots
- Override and intervention records — proof humans actually retained control
- Eval results tied to specific agent versions
- Risk decisions tied to changes
- Incident records, even minor ones
- Plain-language documentation
Common gaps in NIST AI RMF for AI agents
1. Logs not tamper-evident — application database isn't audit evidence.
2. Human oversight is theoretical — system allows override but nobody uses it.
3. Post-market monitoring is reactive — only investigated when something breaks.
4. No change management — prompts edited in production with no record.
5. Retrieval corpus not in scope of data governance — only training data is considered.
Implementation timeline
30 days: Inventory agents in scope. Begin technical documentation. Enable comprehensive tamper-evident logging.
90 days: Operate risk management. Stand up human oversight. Establish post-market monitoring cadence. First self-assessment.
180 days: Complete documentation. Pre-conformity review. Incident reporting workflow. Full readiness.