THE FIVE LENSES

Good judgment makes its assumptions visible.

Use these lenses to structure a conversation, not to calculate a leadership score.

This original discussion aid complements, rather than replaces, an organization’s risk, security and legal processes. NIST’s voluntary AI Risk Management Framework organizes risk work through Govern, Map, Measure and Manage. It is not a prescribed sequence or a simple compliance checklist. Our five questions below are an editorial learning exercise, not a NIST assessment or certification. Read the NIST AI RMF Core.

1. Purpose: what choice are we actually making?

Replace a broad aspiration with a bounded decision. “Use AI in customer service” hides several choices. Drafting a reply for human review is different from issuing a refund or changing a customer’s account. Name the action, its scope and the existing alternative.

Ask: What problem is important enough to solve, and why is this approach preferable to a process change without AI? Record: the intended benefit, excluded uses and the owner of the business outcome.

2. Evidence: what supports the claim?

Separate a demonstration from a representative test. A polished example can show possibility without showing dependable behavior. Ask which cases were tested, what failed and whether the test conditions resemble the intended setting.

Ask: What evidence would make us change our recommendation? Record: evidence references, limitations, open questions and a person responsible for resolving each material uncertainty. Do not turn an unmeasured assumption into a percentage.

3. People: who experiences the consequences?

The team buying a tool is not always the group most affected by its errors. Consider employees, customers, people whose data is used and people who may have difficulty challenging a result. An efficient process can still create an unacceptable burden elsewhere.

Ask: Who is absent from this conversation, and how can their concerns be heard? Record: affected groups, accessible routes to human review and unresolved concerns. OECD’s AI Principles include human rights, fairness, transparency and accountability; these are useful prompts, not a substitute for applicable obligations. Read the OECD AI Principles.

4. Authority: who may decide and who may stop?

“Human oversight” is incomplete unless a role has the time, information and authority to intervene. Distinguish recommending a decision from authorizing it. Identify who may approve a scope change, handle an exception or suspend use.

Ask: Can the named reviewer reject the output in practice? Record: the accountable role, escalation route and limits of delegated authority. Use role names in shared learning materials rather than private contact details.

5. Reversibility: what happens when conditions change?

A decision should include a way to revisit it. A changed model, new data source or broader audience can invalidate the evidence that supported the original choice. Identify which changes require renewed review.

Ask: What would trigger a pause, and what must be true before restarting? Record: monitoring responsibilities, reopening triggers and the fallback process. Reversibility is not guaranteed merely because a product has an off switch.