On This Day in AI: January 26, 2023
On January 26, 2023, the United States National Institute of Standards and Technology released version 1.0 of its Artificial Intelligence Risk Management Framework. Developed through workshops, public comments, and collaboration with organizations across government, industry, academia, and civil society, the voluntary guide was designed to help teams address risks throughout an AI system’s life cycle. NIST organized practical work around four functions: govern, map, measure, and manage. The framework also described characteristics of trustworthy AI, including validity, safety, security, transparency, explainability, privacy, and fairness. It was intended for organizations of different sizes and sectors rather than for one technology or legal regime.
AI risk can emerge from training data, model design, human use, organizational incentives, or the environment in which a system operates. A model that performs well in a laboratory may fail when data changes, when users rely on it too heavily, or when its errors fall disproportionately on particular groups. NIST’s framework encouraged organizations to define responsibilities, understand context, test performance, document uncertainty, involve affected communities, and respond to identified problems. The functions were not a checklist to complete once. They formed a continuing cycle in which governance shaped evaluation and new evidence changed how risks were managed.
The January 26 release did not create mandatory federal rules or certify that products following it were safe. Organizations still had to choose meaningful measurements, provide resources, and make difficult tradeoffs among performance, privacy, access, and accountability. A broad framework could also be implemented superficially if leaders treated documentation as a substitute for reducing harm. NIST later added a profile focused on generative AI and continued developing supporting resources. The original framework nevertheless became an influential common language for companies, auditors, procurement teams, and policymakers. Its importance came from connecting technical testing with organizational decisions and affected people. Instead of treating trustworthiness as one score, it asked who was responsible, what context mattered, how evidence would be gathered, and what action followed. That structure helped move AI governance from abstract ethics principles toward repeatable risk-management practice.
Another strength was that the framework could be used before a system launched. Mapping a proposed context might reveal that a model lacked representative data, that no one owned incident response, or that the benefit did not justify the risk. Addressing those findings early was cheaper than repairing harm after deployment. This prevention-oriented view helped organizations see risk management as part of product design and procurement, not a final compliance review added after important choices were already fixed.
Govern establishes policies and responsibility, map defines context, measure gathers evidence, and manage prioritizes and responds to risk.
The functions operate as a cycle because systems, data, users, and operating conditions can change after deployment.
NIST described validity, safety, security, transparency, explainability, privacy, and fairness as connected characteristics rather than one universal score.
Improving one quality can create tension with another, so teams must document tradeoffs and consider the people affected by a system.
The framework did not impose legal obligations or certify products. Its effectiveness depended on serious implementation, resources, and meaningful testing.
It nevertheless supplied shared terminology for procurement, auditing, internal governance, and later guidance on rapidly evolving generative systems.
Explore more of "On This Day ..."
Discover more events from the same date across news, politics, technology, sports, and other fields. Each link highlights significant moments that shaped history on different fronts.