MP-1.1 Intended purpose, potentially beneficial uses, context-specific laws, norms and expectations, and prospective…
Intended purpose, potentially beneficial uses, context-specific laws, norms and expectations, and prospective settings in which the AI system will be deployed are understood and documented. Considerations include: specific set or types of users along with their expectations; potential positive and negative impacts of system uses to individuals, communities, organizations, society, and the planet; assumptions and related limitations about AI system purposes; uses and risks across the development or product AI lifecycle; TEVV and system metrics. Context is captured before build: who the users are and what they expect, the positive and negative impacts of the intended uses, the assumptions and limits on purpose, and the settings the system will actually run in.
Source: NIST AI RMF 1.0, MP-1.1. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open NIST AI RMF 1.0 in the compliance library.
These are the artefacts auditors commonly ask for on this requirement, our guidance rather than text from the standard. Your assessor decides what is sufficient in your context, and asks for samples across the period when a report covers one.
system holds itEvidence a system already holds
none for this control
periodic reviewEvidence produced at each review
- Analysis of foreseeable misuse and repurposing of the deployed system · Document repository
governing documentDocuments that govern the control
- A documented statement of intended purpose and the uses considered beneficial · Document repository
- Identification of user types and their expectations of the system · Document repository
- The laws, norms and expectations specific to the deployment setting · Policy repository / GRC workspace
- Recorded assumptions and limitations about purpose, and the uses ruled out · Document repository
First move
Common gaps auditors find
- Purpose written at product-marketing level, too broad to bound anything
- Foreseeable misuse omitted because it is outside the intended use
- Documented once at concept and never reconciled with how the system is actually used
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetMN-4.3 Incidents and errors are communicated to relevant AI actors including affected communities, and processes for… · MP-1.2 Inter-disciplinary AI actors, competencies, skills and capacities for establishing context reflect…