AI policies from the AI Policy Builder
Acceptable use, model lifecycle and oversight policies to start from, tagged to the AI frameworks they serve.
AI Policy Builder
Purplecop AIMS · NIST AI RMF
The NIST AI RMF, put into practice
The NIST AI RMF is voluntary, which is why it often stays a document rather than a practice. Purplecop turns it into owned controls, policies and a model register on the same library as ISO 42001 and the EU AI Act.
The difference
From a reference document to a working practice
How the RMF becomes something your teams actually do.
Why Purplecop
What only Purplecop brings to the NIST AI RMF
A voluntary framework made concrete, on the same library as the mandatory ones.
The NIST AI RMF built into the platform
The NIST AI RMF is not a ready-made framework in the library yet. Our practitioners author its clauses in the platform and map them to the controls you already run, so you start from existing work.
Framework authoring + services
One control, many frameworks
A control shared across frameworks is created once in the library, not rebuilt for each one. The work you do for the RMF counts toward everything else you hold.
Map once, satisfy many
Every model on one register
Purplecop AIMS records each model with its owner, its purpose and its risk classification.
Model inventory
AI risk scored on autonomy
Model risk is scored on impact and autonomy, not likelihood alone, so an agent that acts by itself is weighed differently.
AI risk register
Risk scored the same way every time
Likelihood times impact on 1 to 5 scales, inherent and residual, with a heatmap and a risk appetite questionnaire.
Risk register
What you get
Built on one platform, with people who use it
Platform
Purplecop AIMS
Model inventory, AI risk, AI controls and the evidence that an AI system is governed, mapped to ISO 42001, the NIST AI RMF and the EU AI Act.
AI frameworksFramework authoringModel inventoryAI policies
Services
Practitioners beside the platform
The team that runs your engagement works inside the same system, so the work they do stays with you.
Also on the platform
TPRM
Onboard, assess, score and continuously monitor every vendor in one workflow.
Third-party risk
Asset Intelligence
Asset discovery, network monitoring and the audit log in one module, so every asset’s data lives in one place.
Asset Intelligence
Phishing Simulation
Live phishing campaigns with per-user risk scores, run entirely in-house.
Human layer
LMS
Role-based security awareness training for every employee, tracked to completion.
Human layer
People
A directory of the people in scope for training, policy sign-off and access reviews.
People
RBAC
Role-based access control with granular permissions, on a least-privilege model.
Access control
Questions
What teams ask us about the NIST AI RMF
Is the NIST AI RMF mandatory?
No. NIST released it in January 2023 for voluntary use.
Is the RMF in the control library?
AI policy templates are tagged for it; the framework itself is authored into your controls by our practitioners.
How does it relate to ISO 42001?
They overlap; shared controls are created once.
How much faster is it?
It scales with how much you integrate: the more connectors you turn on, the more evidence is collected automatically, saving up to 70% of the time you used to spend preparing for each review.
See it against your own scope
We will walk the product against your scope and show you what runs on day one and what needs configuring.