NIST AI RMF, MapMAP 2.3

If you are the provider of a high-risk AI system that uses techniques involving the training of AI models, develop it on training, validation and testing data sets that meet the criteria below, whenever you use such data sets.

Apply data governance and management practices appropriate to the system's intended purpose, covering your design choices; how you collected the data and, for personal data, why you originally collected it; your data-preparation operations, such as annotation, labelling, cleaning, updating, enrichment and aggregation; the assumptions you made about what the data measures and represents; an assessment of whether the data sets you need are available, sufficient in quantity, and suitable; examination of the data for biases likely to affect health and safety, harm fundamental rights, or lead to discrimination prohibited under Union law, especially where one operation's data outputs become a later operation's inputs; and measures to detect, prevent and mitigate any bias you find.

If you are the deployer of a high-risk AI system and you exercise control over its input data, ensure that input data is relevant and sufficiently representative in view of the system's intended purpose.

Base any determination an AI, algorithm, or other software tool makes in utilization review on the enrollee's own medical or clinical history, individual clinical circumstances, or other relevant clinical information in the enrollee's record, never solely on a group dataset.

Post training-data documentation on your website before making a generative AI system publicly available to Californians, and again before any substantial modification

Cover the datasets and their sources and owners, an approximate count and description of the data points, whether the data includes copyrighted or personal information, and whether synthetic data generation was used

Publish a training-content summary if you provide a general-purpose model

Publicly post documentation describing the datasets used to train a generative AI model or service made available to New York users, including their sources, whether they contain copyrighted, personal or aggregate consumer information, the collection period, and whether synthetic data generation was used.

Verify and maintain oversight of the data your AI systems process so that outputs remain correct, reliable, and obtained transparently.

If you are a health benefit plan provider using artificial intelligence to make medical-necessity determinations on prior-authorization requests, base each determination on the enrollee's own medical history, the clinical circumstances the treating provider presents, and other clinical information in the enrollee's record, not a group dataset.

If you develop a generative AI system made available to Californians, publicly post documentation of your training datasets before each release or substantial modification, starting January 1, 2026.