{
  "id": 1695194,
  "title": "How I Built a NIST AI RMF-Compliant RAG System for Regulated Domains",
  "url": "https://urgent.news/2026/08/18/how-i-built-a-nist-ai-rmf-compliant-rag-system-for-regulated-domains",
  "topic": "ai",
  "section": "AI",
  "published": "2026-08-18T11:15:09.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/lakshman-ai/how-i-built-a-nist-ai-rmf-compliant-rag-system-for-regulated-domains-jch"
  },
  "original_language": "en",
  "account": "Title: How I Built a NIST AI RMF-Compliant RAG System for Regulated Domains\n\nThe author of this article successfully implemented a production RAG (retrieval-augmented generation) system for UK arts and culture clients, ensuring compliance with the NIST AI Risk Management Framework (AI RMF). The system is specifically designed for low-risk retrieval-grounded use cases and has been deployed in an EU data residency environment, meeting GDPR requirements.\n\nThe architecture of the system consists of several key components:\n\n1. Frontend: Streamlit Cloud\n2. Vector Database: Supabase pgvector (EU-West-2)\n3. Embeddings: Voyage AI (1024 dimensions)\n4. LLM: Claude Haiku 4.5 (direct REST API)\n5. Observability: Langfuse Integration\n6. MCP server for Claude Desktop\n\nThe NIST AI RMF consists of four main functions: GOVERN, MAP, MEASURE, and MANAGE. The author documents how the system implements each of these functions.\n\n**GOVERN**\n\n1. Decision Authority: Solo architect with client stakeholder approval loops.\n2. Data Governance (ADR-001): Use Supabase pgvector in EU-West-2 (London) due to UK public-sector cultural clients requiring UK/EU data residency for GDPR compliance. Risk of vendor dependency is mitigated through an evaluation framework and ADRs.\n3. Stakeholder Roles: Developer (Lakshman), Client (UK public-sector stakeholder), Operations (future).\n4. Policy: All user data stays in EU. API calls to Claude/Voyage are transient, with no data stored in the US.\n5. Measurement: Langfuse audit trail logs every query's origin and destination.\n\n**MAP**\n\n1. Risk Inventory: Hallucination (Medium), Embedding Quality Drift (Medium), Data Drift (Low), Vendor Outage (Low), PII Leakage (Low), Prompt Injection (Low)\n2. Mitigations: Prompt constraints, eval suite thresholds, monthly re-evaluation against golden questions, fallback to Ollama (local, offline), Microsoft Presidio redaction at ingestion, input validation\n3. Risk Rating: LOW-RISK, as the system is retrieval-grounded and limited to a small, controlled corpus with no real-time safety-critical decisions.\n\n**MEASURE**\n\n1. Eval Framework (Phase 2): Built ragas-based evaluation suite with 18 golden questions and metrics for faithfulness, context precision, context recall, and answer relevancy.\n2. Observability (Phase 3): Langfuse integration traces every production query with metrics such as input/output tokens, cost, latency, and trace name.\n3. Cost Per Query: $0.0031 (embedding + generation), and a latency target of 2 seconds (currently ~1.2s).\n\n**MANAGE**\n\n1. Safeguards: Prompt engineering, error handling, rate limiting, and cost ceiling.\n2. Real-world trade-offs and decision-making: ADRs detailing the choice between Supabase pgvector and self-hosted PostgreSQL, Voyage AI and Ollama, and direct Claude API access versus using Microsoft Presidio for PII redaction and CI/CD regression gates.\n\nThe author effectively demonstrates how the RAG system adheres to the NIST AI RMF guidelines while balancing trade-offs and implementing safeguards to manage identified risks.",
  "summary": "How I Built a NIST AI RMF-Compliant Production RAG System By Lakshman Pandey | August 2026 Introduction I shipped a production RAG (retrieval-augmented generation) system serving UK arts and culture clients. This article documents how the system implements NIST AI Risk Management Framework controls, with real decisions, trade-offs, and measurable outcomes. TL;DR: Designed for low-risk…",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}