NIST AI RMF: a practical guide for Canadian companies

What the NIST AI RMF actually asks for, what Govern, Map, Measure and Manage look like in a real company, and how to produce the evidence enterprise buyers ask for.

By Krikor Tengerian · Co-founder, SecuritAI Technologies Ltd. · July 2026

That last part is why it matters commercially. Canada does not currently have an AI specific statute in force, so the question arriving in your security questionnaire is rarely which law you are complying with. It is closer to show us how you manage this, and the NIST AI RMF is the vocabulary the person asking already speaks.

What the NIST AI RMF is, and what it is not

The National Institute of Standards and Technology released AI RMF 1.0 on January 26, 2023, describing it as a framework to better manage risks to individuals, organizations, and society associated with artificial intelligence. NIST states it is intended for voluntary use.

Three consequences follow from that word voluntary, and teams miss all three.

• There is no certificate. Nobody audits you against the NIST AI RMF and issues a pass. Any vendor selling you NIST AI RMF certification is selling you something NIST does not offer.
• There is no control list to tick. The framework describes outcomes and leaves implementation to you, which is freeing if you have judgement and difficult if you were hoping for a checklist.
• Your evidence is what proves adoption. Saying you follow it means nothing. Showing what you produced under each function means everything.

The four functions, translated

Here is what each function looks like inside a company of thirty people rather than a research lab.

Govern. This is the function everything else hangs from, and the one most teams skip because it produces no code. You need a named owner for AI risk, a written statement of what your organization will and will not use AI for, and a decision record showing who approved shipping the feature. The smallest version that still counts is a one page AI use policy, an owner, and a short record of each AI feature approved with the date and the approver. If a buyer asks who signed off on your AI assistant and the answer is a shrug, you have failed this function regardless of how good your engineering is.

Map. Map is about knowing what you actually have. List every AI system in the business, including the ones bought rather than built, because a third party AI feature inside a tool your team adopted is still your risk. For each system record the purpose, the data it can reach, the people affected by its output, the tools or actions it can trigger, and the worst realistic outcome if it behaves badly. That last column is what turns a list into a risk map.

Measure. Measure is where claims become results, and it fails most often because teams substitute intent for evidence. Measuring an AI system means testing it adversarially and writing down what happened: what inputs produced unsafe output, whether a user could reach data belonging to someone else, whether the model could be talked into using a tool it should not have used, and how much effort a bypass took. This is the work our AI red teaming and LLM penetration testing practice exists to do, and the report is the artifact this function needs. Keep every successful attack as a regression test, because a result from March is not evidence in July.

Manage. Manage is what you do about what you found. Each finding becomes one of three things: a fix, a risk formally accepted by a named person, or a runtime control that blocks the whole class of problem rather than the specific input. This function also covers monitoring in production, a route for users to report bad output, and a tested ability to turn the feature off. Being able to disable an AI feature quickly is a control, and surprisingly few teams have proven they can.

Where Canadian law actually sits

Two points worth being precise about, because there is a lot of confused writing on this.

Canada’s proposed federal AI statute was introduced inside Bill C-27 and did not pass into law. Parliament’s own record shows it never advanced beyond committee consideration. Plan for your customers’ requirements, not for a statute that does not exist.

What does apply is PIPEDA, and it applies to AI systems the same way it applies to everything else. If your model processes personal information in the course of commercial activity, your existing privacy obligations follow the data into the model, including safeguards and breach reporting. An AI feature does not create a privacy exemption, and training data assembled without a lawful basis is a privacy problem wearing a machine learning hat.

For the governance and audit evidence side, including how AI controls sit alongside ISO 27001 and SOC 2 programmes, SecuritComply covers it for Canadian companies, and its free AI Governance Readiness Checklist is a reasonable starting point.

Three mistakes that show up in questionnaires

• Claiming alignment with nothing behind it. Writing that you align with the NIST AI RMF invites a follow up question, which is always some version of show me. If that has no answer, the claim costs you credibility you would still have had if you said you were working on it.
• Treating bought AI as out of scope. The AI features inside your CRM, your support desk and your code editor process your data and your customers’ data. A buyer assessing you does not care that you did not build them.
• Testing once and calling it done. A single report dated eighteen months ago reads worse than no report, because it shows the team knew testing mattered and then stopped.

A realistic first ninety days

If you are starting from nothing, sequence it rather than adopting the whole framework at once. Weeks one and two, do Map, because you cannot govern what you have not listed and the inventory almost always surprises people. Weeks three and four, do the minimum Govern: name the owner, write the one page policy, start the decision log. Weeks five to eight, do Measure on your highest risk system only, because one system tested properly beats five tested superficially. Weeks nine to twelve, do Manage: work the findings, add the runtime controls that block whole categories, and set the retesting schedule.

At the end you will have something more useful than a framework adoption claim. You will have an inventory, an owner, a test report and a fix log, which is exactly the evidence set a buyer asks for.

References

1. NIST AI Risk Management Framework
2. Parliament of Canada, Bill C-27 (LEGISinfo)
3. Office of the Privacy Commissioner of Canada, PIPEDA in brief
4. OWASP Gen AI Security Project, LLM01:2025 Prompt Injection

← Back to the blog