Official resource
Generative AI Profile (NIST AI 600-1)
The generative-AI companion to the AI Risk Management Framework, covering risks specific to systems that produce text and images.
AI Governance and Policy
Establish the rules before widespread adoption. Define acceptable uses, sensitive information, human responsibility, records requirements, procurement expectations, and what must happen when AI is wrong.
The short version
An AI policy should not begin by banning or approving a list of products — products change too quickly. Good governance establishes principles: how AI may be used, what information may be entered, which decisions require human review, who is accountable, and how much risk the organisation is willing to accept. A workable frame is three tiers. Low risk is AI assisting administrative or creative work with output routinely reviewed. Moderate risk is AI influencing analysis, recommendations or organisational decisions, requiring documented human validation. High risk is anything that could affect safety, clinical care, dispatch, personnel rights or significant money. The higher the consequence of being wrong, the stronger the governance. And do not write a policy that assumes AI output is either always trustworthy or always dangerous — neither is true, and both produce rules people quietly ignore.
Start here
If you read one thing on this subject, read this.
Official resource
AI RMF Playbook
Suggested actions for putting the AI Risk Management Framework into practice.
Why it matters
The closest thing to a starting draft for a department AI policy.
Go deeper
Official resource
AI Risk Management Framework
The federal framework for identifying and managing the risks of an AI system.
Why it matters
A defensible basis for an AI policy, rather than writing one from scratch under pressure.
Official resource
Concept Note: AI RMF Profile on Trustworthy AI in Critical Infrastructure
Work in progress. NIST is developing a critical-infrastructure profile of the AI framework; this is the concept note, not a finished standard.
Why it matters
Worth watching rather than citing. Emergency services sit inside critical infrastructure, so this will land on us.
Hub guide
Step 10 · Data, Integrations, and Cybersecurity
Related guide on the Hub.
Hub guide
Cybersecurity for Fire & EMS Leaders
Related track: vendor and third-party risk, identity, backups and what you are protecting.
Questions to ask your vendor
- What model is being used?
- Can the vendor change models without telling us?
- What department data is retained?
- Is our information used for model training?
- Where is information processed?
- What subcontractors or model providers are involved?
- How does the vendor evaluate accuracy?
- How does the vendor evaluate bias?
- What logs are retained?
- Can we audit significant decisions?
- How are incidents reported?
- Can we disable AI features without losing the underlying product?
This is a reading list, not a guide
Everything above was published by someone else, and is here because it is the clearest treatment of the subject we could find and verify. The Hub’s own guide to this topic is still being written. If you know a better source than the ones listed, that is worth telling us before it is.
Send a note