Framework · AI risk management
NIST AI RMF, with evidence behind it.
The NIST AI Risk Management Framework organizes AI risk work into four functions: govern, map, measure and manage. Meilynx classifies every subcategory against what it can evidence and supplies the operating record for the AI traffic it governs.
Four functions, applied across the AI lifecycle.
The framework is voluntary. Each function breaks into subcategories that describe an outcome an organization works toward, from accountability and context to measurement and response.
- Govern: policies, accountability and oversight for AI risk.
- Map: the context, purpose and impacts of each AI system.
- Measure: analysis and tracking of AI risks over time.
- Manage: prioritized responses, monitoring and incident handling.
Each subcategory, classified.
Where Meilynx produces evidence from live traffic, the subcategory names it. The rest are attested in your own program or marked out of scope.
NIST AI RMF → Meilynx controls
| Requirement | How Meilynx maps | Examination artifact |
|---|---|---|
Keep an inventory of AI systems NIST AI RMF · GOVERN 1.6 | The models and AI systems in use are inventoried from live traffic through the proxy, so the inventory starts from what actually runs. | AI system inventory, generated from traffic |
Monitor AI systems in production NIST AI RMF · MEASURE 2.4, MANAGE 4.1 | Model allow and deny lists, once configured, apply on every call, and changes to system prompts and agent tool access are compared against the approved baseline. | Monitoring record and change findings |
A transparent, traceable risk process NIST AI RMF · GOVERN 1.4, MEASURE 2.8 | Each AI response the proxy delivers and each request it blocks is recorded with its governance decision on a tamper-evident, hash-chained trail. | Examination-ready audit trail |
Examine privacy risk NIST AI RMF · MEASURE 2.10 | Personal data in AI inputs and outputs is detected when the detector is enabled, and each finding is recorded with the action taken. | Detection findings log |
Monitor third-party AI NIST AI RMF · GOVERN 6.1, MANAGE 3.1 | Calls routed through the proxy are recorded by model and provider, so third-party model use is observed at the boundary. | Provider usage record per system |
Keep an inventory of AI systems
NIST AI RMF · GOVERN 1.6
Maps to · The models and AI systems in use are inventoried from live traffic through the proxy, so the inventory starts from what actually runs.
Examination artifact · AI system inventory, generated from traffic
Monitor AI systems in production
NIST AI RMF · MEASURE 2.4, MANAGE 4.1
Maps to · Model allow and deny lists, once configured, apply on every call, and changes to system prompts and agent tool access are compared against the approved baseline.
Examination artifact · Monitoring record and change findings
A transparent, traceable risk process
NIST AI RMF · GOVERN 1.4, MEASURE 2.8
Maps to · Each AI response the proxy delivers and each request it blocks is recorded with its governance decision on a tamper-evident, hash-chained trail.
Examination artifact · Examination-ready audit trail
Examine privacy risk
NIST AI RMF · MEASURE 2.10
Maps to · Personal data in AI inputs and outputs is detected when the detector is enabled, and each finding is recorded with the action taken.
Examination artifact · Detection findings log
Monitor third-party AI
NIST AI RMF · GOVERN 6.1, MANAGE 3.1
Maps to · Calls routed through the proxy are recorded by model and provider, so third-party model use is observed at the boundary.
Examination artifact · Provider usage record per system
What you show an assessor.
The audit trail renders into an evidence package organized by the four functions, with every subcategory listed and its evidence located.
In the package
- Every subcategory, with its classification and where the evidence sits.
- AI system inventory, drawn from traffic.
- Control coverage across the period.
- Versioned governance policy snapshot.
NIST AI RMF and the proxy.
Is this a NIST AI RMF certification?
No. The framework is voluntary and outcome-based, with no certification and no pass mark. The package supports your own assessment: operating evidence for the AI traffic Meilynx governs, and a clear line around the subcategories your program covers itself.
What stays with our own program?
Model development, testing and fairness evaluation are your own work, and the package lists them as attested in your program. Subcategories about team composition, stakeholder feedback and business value sit outside what Meilynx can observe and are marked out of scope.
We also use ISO/IEC 42001. Do the two packages agree?
Yes. The ISO/IEC 42001 package carries the same subcategory classification, so an organization that uses both frameworks reads one consistent view of the same evidence.
See exactly what an examiner receives
Request a sample examination package: model inventory, control coverage, a governance policy snapshot, and a SHA-256 integrity hash.