The AI Decision Journal · NovCog
Four memos for the AI decisions a board cannot delegate.
A working publication on how executives choose, govern and retire AI systems. Grounded in the NIST AI Risk Management Framework, written for the meeting where the decision actually gets made.
The memos
-
01 Buy, build or redesign the workflow?
Start from documented context and business value before choosing a route.
-
02 The first 90 days of AI leadership
Governance first, then map, measure and manage as an iterative loop.
-
03 Who owns the AI decision?
Roles, lines of communication, and executive responsibility for risk.
-
04 Choose a pilot you can actually evaluate
Define purpose, limits and oversight before committing budget.
Build a private board brief
The board brief builder assembles a one-page decision record from the four memos: the context you are deciding in, the risk you accept, and who owns the call. Nothing is transmitted; you keep the file.
The frame we use
The NIST AI Risk Management Framework is voluntary and intended to help organizations incorporate trustworthiness into design, development, use and evaluation. Its Core has four functions — govern, map, measure, manage — broken into categories and subcategories. NIST is explicit that these actions are not a checklist and not necessarily an ordered set of steps; risk management should be continuous and span the system lifecycle. A revised version is in progress, so treat subcategory wording as provisional.
Source: NIST Trustworthy and Responsible AI Resource Center (extracts captured 2026-11-01; NIST pages may since have changed), AI RMF Resources and AI RMF Core. The NIST / ISO 23894 crosswalk maps the functions to ISO/IEC 23894:2023 clauses.
Published by NovCog
These memos are an editorial product of NovCog, which also offers strategic consulting. For contact, see novcog.com. We do not publish client names or outcome claims here.