Why AI Governance Frameworks Are Hard to Adopt: A Role-Based Stress Test of the NIST AI RMF
| Source: arXiv AI
Tags: NIST AI RMF, AI governance, risk management, consumer lending, LLM compliance, enterprise AI
A role-based stress test of the NIST AI Risk Management Framework in consumer lending finds the framework fits bounded ML models cleanly but poorly for workflow-embedded LLM copilots — structural fit, not adoption intent, is the primary barrier to governance value.
Details
This paper treats AI governance as a translation problem: whether framework language becomes role-usable, authority-connected governance in practice. Using LLM-based role simulation across a 4×2×3 design (four organizational roles, two AI deployments, three governance hard cases), it generates 120 scored responses applying the NIST AI RMF to consumer lending. Key finding: local translation is not the main failure point. Simulated actors understood their assigned roles and translated the RMF into local activity. The harder problem is whether that activity generates governance value — specifically risk reduction in the AI system-in-use. Actor role was strongly associated with cross-level governance value and authority connection. Deployment type was strongly associated with Structural Fit: the RMF fits a bounded ML underwriting model well but fits poorly for a workflow-embedded LLM underwriting copilot. Risk reduction only appeared when governance value AND structural fit were both present — neither condition alone was sufficient. For AI teams implementing NIST compliance, this implies that the framework's assumptions about clear system boundaries and defined authority structures break down for agentic or copilot deployments, requiring supplemental governance design rather than standard RMF adoption.