Implementation & Adoption
For the reader ready to build or adopt AI governance infrastructure: framework templates, risk assessment and risk registers, compliance checklists, and how-to guides for standing up an internal AI safety programme.
Guides
AI Washing: What the SEC and FTC Have Actually Charged
No one has ever been charged with “AI washing” — but the SEC censured Delphia and Global Predictions in March 2024 over false AI claims, and the FTC brought five matters under Operation AI Comply that September. What each agency actually pleaded, why none of it needed an AI-specific statute, and a four-question claim-review gate derived from the DoNotPay order.
Chief AI Officer: Scope and Mandate
Six SEC filings from FactSet, Stagwell, RGP, Unity, Xerox, and United Therapeutics show three different ways companies are using the “Chief AI Officer” title — a dedicated CEO-reporting seat, a title folded into an existing role, and an outside credential disclosed in a director bio — plus where NIKOLAI’s own N9 crosswalk found the same title inside a frontier AI developer’s safety framework.
Assessing Third-Party AI Vendor Risk
What to check before you buy a SaaS product with an AI feature: training-data provenance, model-card review, the customer-data-training default, what an AI-output indemnification clause actually requires, sub-processor AI disclosure, and audit rights — distinct from building a risk register or commissioning a third-party AI audit.
AI Governance Maturity Model: Where Does Your Org Stand?
A five-stage self-scoring rubric (Ad Hoc to Optimizing) for AI governance maturity, routing each stage to the specific CASRAI template built for it.
AI Governance Best Practices: A Practical Checklist
A capstone checklist for enterprise AI governance best practices: stand up a committee, adopt a framework, document a policy, run risk assessments, build an audit function, and prepare for incident reporting — each step linked to CASRAI’s deep-dive guide.
NIST AI RMF Generative AI Profile: What AI 600-1 Adds
NIST AI 600-1, the Generative AI Profile, is a separate July 2024 publication that extends the base AI RMF (NIST AI 100-1) for generative AI specifically — naming twelve risks unique to or exacerbated by GAI (confabulation, CBRN information or capabilities, data privacy, and more) and suggesting actions tagged to the RMF’s Govern/Map/Measure/Manage subcategories.
Building an Internal Audit Function for Frontier AI Safety
An internal AI-safety audit function checks, on a schedule, whether safety commitments are actually being met — distinct from incident response, which reacts when something goes wrong, and from third-party evaluation, which supplies outside credibility.
EU AI Act High-Risk System Compliance Checklist
A practical checklist against the EU AI Act high-risk system deadlines as amended by the 2026 AI Omnibus: Annex III (2 December 2027), Annex I (2 August 2028), and what providers and deployers have to complete before each.
Building an AI Safety Framework with NIST’s Govern, Map, Measure, Manage Functions
A walkthrough of NIST AI RMF’s Govern, Map, Measure, and Manage functions as a methodology for building an AI safety framework from scratch, with a practical build sequence and verified subcategory detail.
Mapping Your AI Safety Program to the EU AI Act’s GPAI Code of Practice
Where an existing risk register, governance framework, and incident response program already satisfy the GPAI Code of Practice, and where they need extending.
AI Governance Framework Template: Councils, Risk Tiers, and Escalation Paths
The organizational layer an AI governance framework needs above a risk register: a governance council with defined authority, a risk-tiering methodology, escalation paths, and review cadence.
Responsible AI Usage Policy Template: Acceptable-Use and Prohibited-Use Clauses
A practical guide to writing an internal AI acceptable-use policy: what acceptable-use and prohibited-use clauses typically cover, how it differs from a governance framework, and where it fits with SB 53 and EU AI Act obligations.
