NIST & US Law

The AI Risk Management Framework and America’s patchwork of AI rules

• NIST AI RMF Deep Dive: Govern, Map, Measure, Manage — The voluntary framework that became America’s de facto AI governance standard: where it came from, how risk and the seven trustworthiness characteristics actually work, every category of the four functions, profiles and the Playbook, the ISO 42001 and EU AI Act crosswalk, and why a non-binding document keeps showing up in statutes and courtrooms. (5 lessons, 60 min)
• Generative AI Risks and Bias: NIST-AI-600-1 and SP 1270 — NIST’s two most consequential companion documents: the Generative AI Profile’s twelve risk categories with the real incidents behind them, how its suggested actions plug into the RMF functions, and SP 1270’s socio-technical account of bias — systemic, statistical, and human-cognitive — with the fairness math and the state laws it prefigured. (5 lessons, 55 min)
• The Federal Posture: Executive Orders, OMB, and the Preemption Fight — How US federal AI policy actually works when Congress won’t legislate: the whiplash from EO 14110 to EO 14179, America’s AI Action Plan and its companion orders, the OMB memos that run agency AI, the escalating war over state-law preemption, and how to plan compliance inside a policy regime that can reverse itself in a single afternoon. (5 lessons, 55 min)
• Sectoral Enforcement: FTC, EEOC, CFPB, FDA, and Financial Regulators — How AI actually gets policed in America without an AI statute: the FTC’s deception and unfairness playbook and the delete-your-model remedy, Title VII and ECOA applied to algorithms, FDA’s lifecycle regime for adaptive medical devices, SR 11-7 as the original model-risk framework, and the map of which enforcer reaches which harm. (5 lessons, 60 min)
• State AI Laws in Depth: Colorado, California, Texas, Illinois, NYC, and Beyond — The real AI law of the United States is state law. Colorado’s repeal-and-replace saga, California’s four-statute stack, Texas TRAIGA’s intent-based prohibitions, Illinois and NYC on hiring algorithms, Utah’s disclosure regime, New York’s RAISE Act — and the ten patterns that let you read any new state bill in five minutes. (6 lessons, 60 min)
• Capstone: Building and Defending a US AI Compliance Program — One company, one multistate deployment, worked end to end: build the program on the NIST RMF spine, crosswalk one control set to ten regimes, run an LL144-grade bias audit, survive an incident with three regulator clocks running, and defend it all — privilege, cure periods, RMF defenses, and preemption scenario planning included. (5 lessons, 60 min)