Security of AI™AIRMAC
Open AIRMAC

Organizational assessment · NIST AI RMF 1.0

AI Risk Management Capability Assessment

AIRMAC measures how well an organization manages AI risk across every AI system it builds, buys or uses. You rate practices mapped to the NIST AI RMF, test whether they actually operate on a sample of systems, and finish with a maturity profile and a leadership roadmap.

For AI governance leads, risk managers, internal assessors and accountable executives. Free to use. It runs entirely in your browser; your assessment is never sent to a server.

Choose how to begin

ABOUT 15–25 MINUTES

Take the guided tour

Open a finished assessment of a fictional engineering company. Ten short steps explain each screen, the two gaps it found and how the maturity result was reached.

Start the guided tour
ABOUT 60–90 MINUTES

Practice with a case

Do the assessment yourself on the same fictional company. Scope, systems and evidence are prepared; you record the tests, rate the practices and write the findings, with instructions and expected answers at each step.

Open the practice case
YOUR ORGANIZATION

Start your own assessment

Begin a blank assessment of your organization or a business unit. A step-by-step checklist walks you through scope, inventory, testing, ratings, findings and sign-off.

Start a new assessment

Your work is saved in the browser you use. Save it as a JSON file from the Assessment menu to keep a copy, move it to another computer or share it with your team. If you already have work saved, AIRMAC asks before replacing it.

How an assessment works

  1. Scope the organization, period and people
  2. Inventory every AI system, including bought and embedded AI, then pick a sample
  3. Test whether processes actually ran on each sampled system
  4. Rate 33 practices on design and on operation
  5. Set maturity for each domain, within what the evidence supports
  6. Report findings, a roadmap and sign-off for leadership

What you get

  • A maturity scorecard: current and target level for eight domains
  • Findings in audit form, each with an owner, due date and closure criteria
  • A 30-day to 12-month improvement roadmap
  • A standalone report to print or save as PDF, plus CSV and JSON exports

Reference material