United States — NIST Cybersecurity Framework 2.0: Quick-Start Guide for Using Artificial Intelligence (AI) for CSF Analysis and Reporting (NIST SP 1353, Initial Public Draft)

NIST's draft demonstrates something genuinely useful: AI can reduce some of the administrative burden involved in formal governance. It can organise evidence, compare documentation against a framework, identify gaps and help produce reports and other governance artefacts. But producing the artefacts of governance is not quite the same as governing. An AI system can determine whether a policy contains appropriate language without establishing whether an organisation behaves accordingly. It can organise evidence without knowing whether that evidence accurately represents organisational reality, and it can produce a sophisticated risk register without deciding which risks an organisation should ultimately accept. The concern is therefore not simply that AI might produce poor governance documentation. AI increasingly makes it possible to produce the appearance of mature governance: policies, assessments, registers, reports and organised evidence, without necessarily changing how decisions are made. For organisations with limited governance capacity, AI could genuinely make frameworks such as CSF 2.0 more accessible. The unresolved question is where automation of governance work should stop, and where judgement, accountability and external assurance still need to come from.