For reviewers and buyers
Compliance mapping
The eleven chapters are written against the frameworks security, privacy, and audit teams already use. This page shows which chapter carries which obligation.
| Chapter | What it covers | NIST AI RMF | Other references |
|---|---|---|---|
| 01Purpose and Scope | Who the rules cover, roles, and how this guide relates to other company policies. | AI RMF GOVERN 1.1, GOVERN 4.1 | SP 800-53 AT-2 (literacy and training) · ISO/IEC 42001 A.2 (policies) |
| 02Approved AI Tools | Approved tools and information types, work versus personal accounts, requesting new tools. | AI RMF GOVERN 6.1, MAP 1.1; AI 600-1 GOVERN 6 | SP 800-53 SA-9 (external system services) · EU AI Act Article 4 (AI literacy) |
| 03Protecting Company Information | Information that must never enter an AI tool, re-identification risk, files, uploads, chat history. | AI RMF MAP 4.1, MEASURE 2.10; AI 600-1 GOVERN 3 (information security) | SP 800-53 AT-2, AC-4 · OWASP LLM02 (sensitive information disclosure) |
| 04Safe Prompting | Five prompting habits, synthetic examples, unsafe versus safe prompt rewrites, secrets handling. | AI RMF MEASURE 2.10; AI 600-1 GOVERN 3, DATA PRIVACY | OWASP LLM02, LLM06 · GDPR Article 5 (data minimisation), where applicable |
| 05Checking AI Outputs | How answers go wrong, the SCAN check, and when a person must approve AI-assisted work. | AI RMF MEASURE 2.5, MANAGE 2.2; AI 600-1 Confabulation | EU AI Act Article 14 (human oversight) · ISO/IEC 42001 A.8 (operation) · SP 800-53 AT-3 |
| 06AI Agents and Integrations | What agents can do, least-privilege access, and actions a person must authorise each time. | AI RMF GOVERN 3.2, MANAGE 1.3, MANAGE 2.4 | SP 800-53 AC-6 (least privilege), CM-3 · OWASP LLM08 (excessive agency) · EU AI Act Article 14 |
| 07Prompt Injection and Scams | Where hidden instructions hide, warning signs, AI-assisted phishing, voice cloning, deepfakes. | AI RMF MEASURE 2.6, MEASURE 2.7; AI 600-1 Information Security | OWASP LLM01 (prompt injection) · SP 800-53 SI-3, AT-2 · CISA phishing guidance |
| 08Common Workplace Tasks | Email, meetings, research, code, customers, marketing, and HR: good uses, limits, approvals. | AI RMF GOVERN 1.2, MAP 3.4 | SP 800-53 AT-2 · ISO/IEC 42001 A.7 (competence), A.9 (use) · EU AI Act Article 4 |
| 09Privacy, IP, and Transparency | Personal data in AI, voices and recordings, copyright, and disclosing AI involvement. | AI RMF GOVERN 5.2, MEASURE 2.10; AI 600-1 Data Privacy, Intellectual Property | EU AI Act Article 50 (transparency) · ISO/IEC 42001 A.5 · OWASP LLM02 |
| 10Reporting an Incident | What counts as an AI incident, the first fifteen minutes, what to report, no-blame protection. | AI RMF MANAGE 3.1, MANAGE 4.1 | SP 800-53 IR-6 (incident reporting) · NIST SP 800-61r3 · ISO/IEC 42001 A.8 |
| 11Before You Use AI | Four pre-flight checklists and plain-English definitions of the terms used in the guide. | AI RMF GOVERN 3.1, GOVERN 3.2 | SP 800-53 AT-2, AT-3 (assessment) · ISO/IEC 42001 A.7 |
What the training evidences
- Every employee gets a scored twenty-question assessment with a 75% pass mark, so completion is evidenced, not self-reported.
- Each passing employee receives a certificate with a unique ID that an employer can check on the verification page.
- All attempts are recorded with name, work email, score, date, and certificate ID, and can be exported as a CSV per organization.
- Each narrated clip carries a written transcript, and the guide is text-based throughout, which supports WCAG 2.1 AA and Section 508 review.
Securities regulation coverage
Full regulation mapReg S-PPrivacy of consumer financial information
Chapters 03 and 09 keep non-public customer information out of unapproved AI tools; chapter 10 makes reporting a suspected exposure immediate rather than at month end.
Reg S-IDIdentity theft red flags
Chapter 07 covers AI-assisted phishing, voice cloning, and deepfakes, and the identity checks to run before acting on a suspicious request.
Item 1.05 of Form 8-KMaterial cybersecurity incident disclosure
Chapter 10 defines what counts as an AI incident and what to report, so the four-day clock is not lost inside a chat window.
Reg S-K Item 106Cybersecurity risk management, strategy, and governance
A recorded, scored, exportable completion log is the evidence that people, not just policies, carry the controls.
Rules 17a-3 and 17a-4Books and records
Chapters 02 and 06 limit work to approved tools and company-managed accounts, and require authorisation for agent actions.
Regulation Best Interest and the Marketing RuleCare, honesty, and no misleading statements
Chapter 05 verifies AI output before anyone relies on it; chapter 09 covers disclosing AI involvement and avoiding overstated capability claims.
How to describe this training
Say “aligned with the NIST AI Risk Management Framework, NIST SP 800-53 awareness training controls, and the SEC rules on privacy, identity theft red flags, and incident disclosure”. NIST does not certify, accredit, or endorse training providers, and neither NIST nor the SEC issues that credential, so this page is a mapping for your reviewers rather than a certification.
NIST AI RMF, framework sourceThis training supports your organization’s compliance programme. It does not replace legal advice, your own policies, or a formal control assessment.