Mapping to Compliance
A reviewer rarely asks "is your AI good?" They ask "show me how your controls map to the framework." The architect who can draw that map — from concrete system mechanisms to the named controls a compliance officer expects — clears reviews quickly. This lesson connects the governance machinery from earlier in the module to the frameworks you'll actually be measured against.
The NIST AI Risk Management Framework
In the U.S. public sector, the NIST AI Risk Management Framework (AI RMF) is the common reference. It organizes AI risk work into four functions:
- Govern — establish the policies, roles, and accountability that wrap everything else.
- Map — understand the context and identify where the AI system can cause harm.
- Measure — assess and track those risks with evidence (evaluation records, quality scores).
- Manage — act on the risks: gates, mitigations, monitoring, and the ability to roll back.
NIST is deliberately not a checklist of code; it's a structure you map your existing controls onto. Your job is to show that each function is satisfied by something real in the system.
The controls a reviewer expects
Beneath the framework sit a recurring set of control families — the same ones in NIST 800-53, public-sector security baselines, and most enterprise audits:
- Access control — only authorized identities can invoke models, approve content, or read sensitive outputs; least privilege throughout.
- Audit and accountability — an append-only, tamper-evident log of who did what, when, with which model version.
- Data-flow documentation — a clear record of what data enters the model, where it goes, and what leaves; essential for privacy and data-residency review.
- Human oversight — documented approval gates and escalation paths so a human is accountable for consequential decisions.
Mapping LyraLearn's mechanisms
The payoff is that LyraLearn's controls map cleanly onto these expectations:
| Reviewer control | LyraLearn mechanism | |---|---| | Govern / accountability | Named approver recorded per AI action | | Audit and accountability | Append-only audit log of every AI call | | Measure | Per-call evaluation record with quality score | | Data-flow documentation | Model-version registry + provenance on every artifact | | Human oversight | Human approval gate before generated content takes effect |
The lesson for an architect: build the registry, audit log, evaluation record, and approval gate first, and compliance becomes a mapping exercise rather than a scramble. You are not inventing evidence under audit pressure — you are pointing at controls that have been running, and logging, since day one.