Map: Know What Your AI Is Actually Doing

In my federal grants compliance days, every dollar had a purpose written next to it before it moved. Nobody got to spend first and explain later. The Map function in the NIST framework works the same way: before you worry about managing AI risk, you write down what each AI tool is for, who it affects, and what could go wrong.

This sounds obvious, and almost nobody does it. Ask your team which AI tools they're using and you'll hear about three. Ask IT and you'll hear about ten. Somebody in marketing is pasting customer data into a chatbot nobody approved. Mapping is how you find that out on purpose instead of by accident.

One page per tool: what it does, whose data it touches, and the worst realistic outcome. Then rank them by stakes, so your limited attention goes to the tools that could actually hurt someone. Now you have a map. Now you can govern.

I explain frameworks; I don't give legal counsel.