CRI AI RMF
Operationalize AI risk management with the Cyber Risk Institute's Financial Services AI Risk Management Framework (FS AI RMF), built on the NIST AI RMF — with assessments, governance workflows, and a clear view of AI risk.
Product Overview
Apply CRI and NIST AI RMF to Govern AI Risk at Scale
CRI AI RMF is a specialized solution that enables organizations to operationalize the Cyber Risk Institute's Financial Services AI Risk Management Framework (FS AI RMF), released in February 2026 and built on the NIST AI Risk Management Framework (AI RMF). SmartSuite’s CRI AI RMF software gives organizations a scalable system for managing AI risk — aligned with emerging regulatory expectations and industry practice.
SmartSuite enables organizations to inventory AI use cases, assess risks related to bias, transparency, and operational impact, and implement governance controls aligned with both CRI principles and NIST AI RMF guidance. With a central system of record, teams can manage AI risk assessments, controls, and documentation in a way that is repeatable, auditable, and defensible.
The FS AI RMF is structurally aligned with the NIST AI RMF and expanded with 230 control objectives for financial services, which gives institutions a familiar approach to new regulatory expectations. CRI designed it for financial institutions of all sizes and their third-party providers.
SmartSuite dashboards show AI risk posture as records change, so organizations can track AI system usage, monitor risk exposure, and confirm that governance controls are implemented. This supports responsible AI adoption while reducing regulatory, operational, and reputational risk.
As part of SmartSuite’s connected GRC architecture, CRI AI RMF extends beyond standalone assessments.
AI risk insights are informed by:
- Enterprise and operational risk assessments
- AI governance policies and controls
- Privacy risk and data governance activities
- Incident and issue management related to AI systems
- Third-party AI vendors and external model dependencies
AI risk management therefore sits inside the wider governance program instead of beside it.
The product supports a wide range of AI risk use cases, including:
- NIST AI RMF implementation and assessment
- AI risk identification and impact analysis
- AI governance program development
- Regulatory and supervisory readiness for AI
An AI risk management program built on SmartSuite is:
- Defensible for regulators and supervisory bodies
- Aligned with CRI and NIST AI RMF practice
- Transparent for risk, compliance, and AI leaders
What is CRI AI RMF?
CRI AI RMF is a solution for managing AI risk using CRI-aligned governance and the NIST AI Risk Management Framework. It lets organizations assess AI systems, implement controls, and adopt AI responsibly.
Core Capabilities
SmartSuite’s CRI AI RMF product covers the capabilities needed to manage AI risks across their lifecycle: assessments, governance workflows, and live dashboards in one platform. Each capability works with other SmartSuite products, so risk, compliance, privacy, and operational workflows stay aligned.
AI System Inventory
Keep one inventory of AI systems, models, and use cases across the organization.
AI Risk Assessments (NIST AI RMF)
Conduct assessments aligned with NIST AI RMF categories and functions.
CRI-Aligned Governance Structure
Apply CRI-based governance principles to AI risk management and oversight processes.
AI Use Case Classification
Classify AI systems by risk level, criticality, and regulatory requirements.
Control Definition & Mapping
Define and map controls aligned with AI RMF guidance and organizational policies.
Risk Dashboards & Analytics
Monitor AI risk exposure, compliance status, and governance metrics through real-time dashboards.
Workflow Automation
Automate assessments, approvals, and governance workflows using no-code automation.
Cross-Product Integration
Link AI risks to enterprise risk, privacy, compliance, and incident workflows.
Role-Based Access Control
Control who can see AI systems, risk data, and governance workflows.
The AI Risk Lifecycle
SmartSuite supports the full AI risk lifecycle, from inventory through governance, with linked workflows and dashboards.
Inventory AI Systems
Identify and catalog AI models, use cases, and associated data.
Assess AI Risks
Evaluate risks related to bias, fairness, transparency, and operational impact.
Define Controls & Governance
Establish governance structures and controls aligned with CRI and NIST AI RMF.
Monitor & Validate
Monitor AI systems and validate compliance with governance requirements.
Report & Improve
Provide reporting and refine governance practices based on outcomes.
Connected Risk Ecosystem
CRI AI RMF shares data with other SmartSuite GRC products, so AI risk and governance can be reviewed alongside risk, compliance, and operational work.
Track AI models, assess risk, and document compliance across your enterprise in one platform.
Centralize enterprise risk management with standardized assessments, dashboards, and linked workflows that align risk, controls, and mitigation across your organization.
Capture and resolve incidents with structured workflows, real-time visibility, and integrated response across risk, compliance, and operations.
Standardize vendor due diligence, centralize assessments, and monitor ongoing risk exposure to ensure supplier reliability and compliance.
Who This Product Is For
The CRI AI RMF product supports stakeholders across risk, compliance, data, and AI teams, from AI risk assessment through governance.
Chief Risk Officer
Chief Data and AI Officer
Compliance Manager
IT Risk Manager
Internal Auditor
Executive / Board Member
Frequently Asked Questions
Answers to the questions readers ask most about this topic.
The Cyber Risk Institute's Financial Services AI Risk Management Framework (FS AI RMF), released in February 2026, builds on the NIST AI RMF to help financial institutions manage risks associated with artificial intelligence. It provides guidance on governance, risk identification, controls, and oversight for AI systems. As AI adoption accelerates, organizations face growing regulatory scrutiny and operational risks related to model usage, bias, and transparency. SmartSuite lets organizations operationalize the CRI AI RMF in one platform and apply it consistently across AI initiatives, so teams can demonstrate compliance and strengthen risk management against an industry-recognized framework.
SmartSuite turns the CRI AI RMF into workflows, controls, and data models that apply across AI systems. Organizations define governance processes, track risk assessments, and manage controls in the platform, and each AI system can be evaluated against framework requirements. Teams document evidence and track compliance activities as they work, which moves governance beyond static documentation.
Organizations keep one inventory of AI systems in SmartSuite, with each system’s purpose, ownership, and risk classification. Systems are categorized by impact, complexity, and regulatory requirements, and linked to governance workflows and controls so every AI initiative falls under oversight. Financial institutions that must keep tight control over model usage see all AI assets in one place.
Organizations assess AI risks in SmartSuite using methodologies aligned with the CRI AI RMF. Risks are evaluated on factors such as model impact, bias, explainability, and regulatory exposure, and each risk is tracked in the platform and linked to mitigation actions and controls. Integration with enterprise risk management workflows places AI risk next to the rest of the organization’s risk exposure.
Organizations define and implement controls aligned with CRI AI RMF requirements, map them to AI systems, and test them for effectiveness. Evidence is captured and stored in the platform with traceability, so compliance activities are documented and ready for audit. Because controls connect to workflows, governance is enforced in daily work.
SmartSuite connects CRI AI RMF with enterprise risk, compliance, and audit workflows, so AI governance belongs to the wider GRC program. AI risks link to enterprise risk registers and controls align with broader compliance frameworks, which keeps governance activities consistent, removes silos, and helps organizations meet regulatory expectations for risk management.
Yes. SmartSuite supports enterprise-scale environments with multiple AI systems, teams, and regulatory requirements, using flexible data models, role-based access, and scalable workflows. Organizations manage AI governance across business units and geographies in one platform while accommodating local complexity.
SmartSuite keeps an audit trail of AI governance activities, including risk assessments, control implementation, and evidence collection, so organizations can demonstrate compliance with the CRI AI RMF and other regulatory requirements. With documentation and dashboards in one place, teams can respond quickly to audits and regulatory inquiries.
Operationalize AI Risk with Confidence and Control
SmartSuite delivers a GRC platform for managing AI risk using the CRI and NIST AI RMF frameworks.