> ## Content Index
> Fetch the complete content index at: https://www.aigl.blog/llms.txt
> Use this file to discover other available public pages before exploring further.

# Risk Discovery Protocol for AI Assurance (v1.0): Guidance for Administering the Protocol
- URL: https://www.aigl.blog/risk-discovery-protocol-for-ai-assurance-v1-0-guidance-for-administering-the-protocol/
- Published: 2026-09-19T09:17:09.000Z
- Updated: 2026-09-19T09:17:09.000Z
- Description: MITRE guidance for administering the Risk Discovery Protocol for AI Assurance (RDP-AIA), a four-phase interview-based methodology that helps teams unpack a mission problem and AI solution, elicit AI assurance needs, and prioritize them by assessed risk in a Priority Report.
- Author: Jakub Szarmach
- Tags: Guidance, Risk Management, AI Governance, AI Safety, Human Agency, Compliance & Audit, #aigl-library

## ⚡ Quick Summary

Published by The MITRE Corporation, this document provides guidance on administering the Risk Discovery Protocol for AI Assurance (RDP-AIA), a standardized, interview-based methodology developed for MITRE's AI Assurance and Discovery (AIAD) Lab. Its stated purpose is twofold: to give an overview of the RDP-AIA and to let any responsible party with minimal context administer it.

The protocol decomposes a specific mission problem and the associated AI solution, elicits and discovers AI assurance (AIA) needs, and prioritizes those needs by risk. It runs through four phases — UNDERSTAND, IDENTIFY, DISCOVER and PRIORITIZE — where each phase's outputs serve as inputs to the next, culminating in an RDP-AIA Priority Report.

Supporting artifacts include a Use Case Description, an AIA Landscape and Glossary (82 assurance needs in total, comprising 11 categories and 71 specific needs), severity, likelihood and risk scales drawn from NIST 800-30, and a Use Case Repository for retrieving similar past cases. The protocol is run as a facilitated Stakeholder interview, recommended in at least two and ideally three parts, in person or remotely.

## 🧩 What’s Covered

The document follows the protocol's own sequence, with supporting artifacts placed in ten appendices.

- **Set-up and preparation (Section 3):** the instigating event, the scheduling email, pre-interview questions sent for return at least two days ahead, document collection, and preparation such as tentatively filling in the Use Case Description.
- **UNDERSTAND phase (Section 4.1):** eight steps covering the mission problem, sector (a 16-item list adapted from the UN COFOG), AI application area, maturity level, solution workflow, algorithm type, human touchpoints and expected effects, producing a completed Use Case Description.
- **IDENTIFY phase (Section 4.2):** four steps to elicit Sponsor-specific AIA needs, resolved concerns, future or scaling issues, and other concerns, each need justified from a seven-item source list (Observed, Lesson Learned, Inferred, Policy, Authority, Tradition, Research).
- **DISCOVER phase (Section 4.3):** four steps that introduce the AIA Landscape, locate elicited needs within it, explore up to three similar past cases, and probe other AIA needs across the eleven categories.
- **PRIORITIZE phase (Section 4.4):** five steps that rank-order needs to roughly six, assess "as-is" risk using two likelihood scales, a severity scale and the NIST 800-30 risk matrix, prioritize needs against risk tolerance, forecast "at deployment" risk, and capture lessons learned.
- **Priority Report and follow-up (Sections 5 and 6):** the report's six parts and the seven steps for completing it, plus a follow-up email confirming the Use Case Description, priorities and permission to share the case.
- **Appendices:** Use Case Description fields and formats, repository query methods, the AIA Landscape and Glossary, the COFOG-derived sector explanation, interview aids and Risk Assessment Cards, the risk assessment scales, the Priority Report template, and example emails.

## 💡 Why it matters?

The resource gives assurance teams a repeatable front end for AI risk work: a structured way to unpack a mission problem and proposed AI solution, surface assurance needs that stakeholders may not articulate unaided, translate them into a shared taxonomy, and rank them by assessed risk and risk tolerance. It is aimed at discovering and prioritizing concerns before measurement and mitigation begin, and it ties its severity, likelihood and risk ratings to NIST 800-30 tables. The AIA Landscape and Glossary provide common terminology across the many assurance frameworks the document says were compiled into a domain-agnostic taxonomy.

## ❓ What’s Missing

The protocol is described as largely SME-driven and manual, and several elements are not yet available: the Use Case Repository is a future effort that emerges only after multiple engagements, topic-model and LLM-based retrieval are experimental methods for a repository of more than 25 cases, and the full Priority Report template with completion guidance is available only on request. Absolute risk magnitudes are stated as not directly comparable across participants who use different likelihood scales, and acceptable risk levels may shift with the scale chosen. The protocol stops at prioritization; measuring and mitigating the identified risks is left to the next AIAD Lab step. No validation data on the protocol's use are reported.

## 👥 Best For

AI assurance practitioners and facilitators running interview-based risk discovery with project teams; risk and compliance leads who need a structured, defensible method for eliciting and prioritizing AI assurance needs before mitigation; and programme or sponsor staff preparing for an assurance review and wanting to compare their case against similar past ones.

## 📄 Source Details

The document is *Risk Discovery Protocol for AI Assurance (v1.0): Guidance for Administering the Protocol*, published by The MITRE Corporation, McLean, VA, dated October 2024 and marked "Approved for Public Release; Distribution Unlimited. Public Release Case Number 24-2963". The named authors are Paul Ward, Jeff Stanley, Ron Ferguson, Colin M. Gladding and Kevin J. Burns. The PDF runs to 72 pages with ten appendices (A–J). The text extraction covered all 72 pages; no URL for the document is printed in it.