By Howard Fienberg, Insights Association, and Juliana Wood, CIRQ
As employee enthusiasm and management expectations accelerate AI adoption, many insights agencies and brand-side teams are struggling to establish clear policies that enable responsible use while meeting client data privacy requirements and maintaining rigorous data quality controls.
Insights leaders grappling with this challenge would benefit from consulting the Artificial Intelligence Risk Management Framework (AI RMF 1.0) developed by the U.S. National Institute of Standards and Technology (NIST) to help organizations address the risks associated with AI while promoting its responsible development and use.
The framework is intended to be "voluntary, rights-preserving, non-sector-specific, and use-case agnostic," providing flexibility for organizations of different sizes and across industries.
NIST identifies seven characteristics of trustworthy AI systems: "valid and reliable, safe, secure and resilient, accountable and transparent, explainable and interpretable, privacy-enhanced, and fair with harmful bias managed."
The framework centers on four interconnected functions:
- GOVERN: Establish organizational policies, accountability, oversight, and a culture of AI risk management.
- MAP: Identify how AI systems will be used, their potential benefits, and associated risks.
- MEASURE: Use testing, evaluation, and monitoring to assess AI risks and system performance.
- MANAGE: Prioritize identified risks and implement appropriate safeguards and responses.
Importantly, NIST emphasizes that AI risk management should be proportional to the risks involved: "Policies and resources should be prioritized based on the assessed risk level and potential impact of an AI system." It also acknowledges that "Different organizations may have varied risk tolerances due to their particular organizational priorities and resource considerations."
For the insights industry, the framework's emphasis on data quality, representativeness, methodological rigor, privacy, and transparency is particularly relevant. NIST specifically calls for consideration of "scientific integrity" and "experimental design, data collection and selection (e.g., availability, representativeness, suitability)," as well as system validation.
The use of this framework may have some utility as research and insights organizations navigate the rapidly evolving AI landscape and its impact. Consider the new ISO 20252:2026 Market, opinion and social research, including insights and data analytics, which introduces new requirements for AI development, ethical use and human oversight of AI in research, and applications and use of synthetic data. These requirements were developed by industry professionals who serve on ISO Technical Committee 225, the global group of research professionals managing regular updates to the market research standard.
While ISO 20252 does not veer into the requirements of establishing an artificial intelligence management system, ISO 42001:2023 Information technology — Artificial intelligence — Management system does. However, this standard may be too robust for the current needs and/or widespread adoption within the insights industry, which is already served by ISO 20252 and ISO 27001:2022 Information security, cybersecurity and privacy protection.
Ultimately, the NIST framework can serve as another tool in the researcher’s toolbox since it offers a flexible, risk-based approach to responsible AI without imposing a one-size-fits-all regulatory regime. As NIST explains, it is intended to be "outcome-focused and non-prescriptive," providing "a catalog of outcomes and approaches”.
About the Authors
Howard Fienberg is Senior VP Advocacy at the Insights Association.
Juliana Wood is the Managing Director at CIRQ, the ANAB-accredited certification body of the Insights Association.