Impact and oversight
Show where AI exposure sits before anything gets deployed.
This page is written for the person who has to justify a decision to someone above them. It maps each layer of the F.O.C.U.S. Framework to a function of the NIST AI Risk Management Framework, names what is exposed when a layer is weak, and states what the first thirty days address. It contains no cost estimates and no savings claims, because readiness is not a number you can invent.
What NIST is, and why it belongs on this page
NIST is the National Institute of Standards and Technology, the federal agency that writes the standards other agencies and organizations are expected to follow. Its AI Risk Management Framework is the reference document a public body reaches for when it has to answer how it is governing artificial intelligence. Using it means your readiness record rests on a recognized federal standard rather than on any single consultant's opinion.
- Govern
- Who is accountable, what the policy says, and who signs off.
- Map
- Where artificial intelligence is actually in use and what could go wrong.
- Measure
- How you test whether it works and whether it is causing harm.
- Manage
- What you do about the risks you found, and who keeps watching over time.
F.O.C.U.S. layers mapped to NIST AI Risk Management Framework functions| F.O.C.U.S. layer | Protects | NIST function |
|---|
| F Foundation | Clarity | Govern |
| O Opportunity | Capacity | Map |
| C Create | Visibility | Map + Measure |
| U Uplift | Trust | Manage |
| S Support | Freedom | Manage + Govern |
Exposure by layer
Each block states what is exposed when the layer is weak, which NIST function the failure lands under, and the first action the diagnostic assigns.
- What is exposed
- No named owner for artificial intelligence decisions, no written policy, and no shared record of what the organization actually values. Questions from legal, procurement, or an oversight body have no documented answer.
- Guiding question
- What must this system, season, goal, relationship, project, or decision understand about my values, reality, responsibilities, boundaries, needs, and desired direction?
- First thirty days
- Gather the ten sources that best represent the truth of the area you want to strengthen. Identify what is current, private, outdated, or missing.
- What is exposed
- No inventory of where artificial intelligence is already in use. Staff adopt tools quietly, sensitive information moves into systems nobody approved, and the first time leadership hears about it is after something goes wrong.
- Guiding question
- Where am I repeatedly sorting, deciding, delaying, avoiding, rebuilding, overthinking, or carrying something alone?
- First thirty days
- Choose one area that feels heavy or stuck. Write what is happening from beginning to end, then mark the places where clarity, simplification, delegation, automation, help, or a better rhythm could create relief.
C. Create
NIST Map + Measure
- What is exposed
- Work gets built and published without a check on sources, accuracy, or who reviewed it. Errors reach constituents, clients, or the public record before anyone inside the organization catches them.
- Guiding question
- What needs to be expressed, built, practiced, shared, designed, written, organized, or made?
- First thirty days
- Select one meaningful idea and turn it into one concrete expression. A plan, conversation, habit, offer, resource, piece of content, routine, prototype, experience, or decision.
- What is exposed
- People affected by a decision are not told how it was made, cannot reach a human, and have no route to correct something that is wrong about them. Trust erodes quietly and is expensive to rebuild.
- Guiding question
- Where could clearer communication, better timing, more care, or thoughtful personalization help someone feel seen, supported, and guided?
- First thirty days
- Review the experience from first contact through follow-up. Choose one moment where someone commonly feels confused, delayed, unsupported, unseen, or forgotten.
S. Support
NIST Manage + Govern
- What is exposed
- The policy exists on paper and nothing maintains it. Reviews stop happening, staff turnover erases the reasoning, and the organization drifts back to where it started while believing it is covered.
- Guiding question
- What rhythms, reviews, relationships, resources, and maintenance practices will help this grow without becoming another abandoned idea?
- First thirty days
- Schedule a monthly F.O.C.U.S. review. What is working, what is outdated, what needs attention, what should be simplified, what should be celebrated, what should be released?
What a completed diagnostic produces
Every run ends in a record you can hand to someone else. Nothing here requires a follow-up purchase to be useful.
- A five-layer score map showing where readiness is strong and where it is thin.
- A named bottleneck layer, with the guiding question and first action attached to it.
- A thirty day install plan written against that bottleneck.
- A monthly review template so the record stays current after the first month.
- A jurisdictional roll up that groups results by location. Individual scores are never released, and a group with fewer than five participants releases nothing but its participant count.
- A print ready export for board packets, council briefings, and audit files.
Human-centered commitments
- Privacy
- Know what information enters each tool, notebook, database, conversation, or shared space, and what should remain protected.
- Permission
- Get meaningful consent before using another person's words, data, likeness, story, or private information.
- Verification
- Check important facts, sources, calculations, assumptions, and outputs before they shape decisions or reach other people.
- Bias
- Examine whose assumptions, experiences, needs, and perspectives may be missing or distorted.
- Human Accountability
- Keep a named person responsible for consequential decisions, sensitive communication, and the final standard of care.
