rai-standards

整合式負責任AI標準參考：NIST AI RMF 1.0、AI STRIDE威脅建模覆蓋層、歐盟AI法案風險層級，以及開放標準目錄，包含…

npx skills add https://github.com/microsoft/hve-core --skill rai-standards

RAI Standards Skill

This skill is the reusable standards package for the RAI Planner. It consolidates the embedded NIST AI RMF content, the AI STRIDE threat-modeling overlay, and a paraphrased EU AI Act reference so the phase playbook can stay focused on workflow and orchestration.

Attribution and licensing posture

NIST AI RMF 1.0 is a U.S. Government document and is reproduced here as public-domain reference material with attribution. Public-domain material carries no license obligation, so it adds no term to the package license expression.
EU AI Act content in this skill is paraphrased and attributed rather than quoted verbatim, consistent with the open legal-text posture used in the repository. The paraphrase is this repository's own expression.
The AI STRIDE overlay is Microsoft-authored reference material for threat-modeling reuse in the RAI workflow.

Every file in this package is therefore governed by the repository-original license. The table records the source each file draws on.

Path	License	Origin
`references/nist-ai-rmf-govern.md`	CC-BY-4.0	Adapted from NIST AI RMF 1.0 (public domain)
`references/nist-ai-rmf-map.md`	CC-BY-4.0	Adapted from NIST AI RMF 1.0 (public domain)
`references/nist-ai-rmf-measure.md`	CC-BY-4.0	Adapted from NIST AI RMF 1.0 (public domain)
`references/nist-ai-rmf-manage.md`	CC-BY-4.0	Adapted from NIST AI RMF 1.0 (public domain)
`references/eu-ai-act.md`	CC-BY-4.0	Paraphrase of EU AI Act 2024/1689, not reproduced
`references/ai-stride-overlay.md`	CC-BY-4.0	Repository-original
`SKILL.md` and remaining package content	CC-BY-4.0	Repository-original

Framework index

NIST AI RMF trustworthiness characteristics

Key	Characteristic	Description
validReliable	Valid and Reliable	Base characteristic for correctness, robustness, and stability
safe	Safe	Safety and harm prevention under normal and adversarial conditions
secureResilient	Secure and Resilient	Resistance to attack, misuse, and failure
accountableTransparent	Accountable and Transparent	Governance, auditability, and decision provenance
explainableInterpretable	Explainable and Interpretable	Understandability of model behavior and outputs
privacyEnhanced	Privacy-Enhanced	Protection of personal data and confidentiality
fairBiasManaged	Fair with Harmful Bias Managed	Bias detection, mitigation, and equitable outcomes

Phase-to-framework mapping

RAI phase	Primary standards package	Notes
Phase 1 Scoping	NIST AI RMF Govern + Map	Context, purpose, stakeholders, and policy framing
Phase 2 Risk Classification	NIST AI RMF Govern	Governance culture, DEI&A, and stakeholder engagement
Phase 3 Standards Mapping	NIST AI RMF Govern + Measure	Core standards mapping and TEVV alignment
Phase 4 Security Model Analysis	AI STRIDE overlay + Measure	Threat modeling and overlap with security analysis
Phase 5 Impact Assessment	NIST AI RMF Manage	Risk prioritization, mitigation, and monitoring
Phase 6 Review and Handoff	NIST AI RMF Manage + EU AI Act	Regulatory review, incident response, and evidence handoff

Customer extension pattern

The default framework remains NIST AI RMF 1.0. When a customer supplies an additional framework, preserve the default NIST mapping as a baseline and layer the custom framework on top with explicit attribution. This keeps the planner interoperable while allowing organizations to add ISO, sector, or regional references without rewriting the core playbook.

Open-standards catalog

Use the links below as the reference catalog for open standards and governance resources. Do not reproduce normative text verbatim when the license posture does not allow it.