The source record
Evidence at a glance
Dates identify the source or documented event. A published claim is not automatically a demonstrated outcome.
| Record and date | What it establishes | What it does not establish |
|---|---|---|
| 29 July 2021 Request for information | NIST invited input on a voluntary AI risk framework. [1] | An invitation does not establish who had the capacity to participate. |
| 17 March 2022 Initial draft released | NIST announced the draft, a comment deadline and a March workshop. [2] | The announcement describes a process, not its representativeness. |
| 29 April 2022 Microsoft comment | The submission requested consolidation of trustworthiness categories. [3] | A recommendation is not evidence it was accepted because of that author. |
| 18 August 2022 Second draft | Section 4 groups the trustworthiness characteristics together. [4] | A textual comparison does not assign authorship. |
| 29 September 2022 ACLU comment | The submission argued for a stronger role for impacted communities and consideration of non-AI alternatives. [5] | A published position does not prove its weight in the final decision. |
| 26 January 2023 Framework released | NIST’s development record dates the release of version 1.0. [10] | Release does not establish implementation or effectiveness. |
Research and interpretation
Identify the instrument before asking who shaped it
This investigation follows one voluntary technical framework. NIST’s July 2021 notice explicitly described the AI RMF as voluntary and sought information to guide its development. That is the instrument examined here; calling every AI governance document a law obscures who can change it and how it operates. [1]
Our reporting approach is to establish the issuing institution, document version, decision date, participation route and claimed effect before investigating influence. A school board adopting a vendor checklist, a legislature passing a statute and an agency publishing guidance require different records. For this case, the relevant comparison is between public submissions and successive NIST texts. We make no finding about a particular procurement or enforcement decision.
Research and interpretation
A worked comparison with a corporate submission
On April 29, 2022, Microsoft submitted comments asking NIST to combine separate classes of risks and characteristics into one list. It argued that separate categories could confuse developers and deployers about their responsibilities and recommended explaining their roles across the AI lifecycle. These are Microsoft’s expressed arguments, not this publication’s endorsement. [3]
The August 18 second draft presents trustworthiness characteristics together in section 4. The January 2023 final framework also presents a combined set in section 3, describing the characteristics as attributes of sociotechnical systems. The observed structure is consistent with the consolidation Microsoft requested. The documents do not establish that Microsoft originated the idea or uniquely caused its inclusion. [4] [6]
Our analysis: a responsible influence claim needs an additional evidentiary link. That could be an agency explanation assigning a change to a submission, a documented drafting exchange, or minutes recording the decision. Even then, agreement with an external recommendation would not by itself establish improper conduct. This comparison is a method for locating the next question, not a finding of capture.
Research and interpretation
Other voices are part of the record
The ACLU’s September 29, 2022 submission sought stronger roles for affected communities, consideration of non-AI alternatives and attention to institutional incentives. This demonstrates a materially different set of recommendations in the same process. It does not establish whether the final text adopted each proposal. [5]
NIST’s second-draft comment directory includes companies, civil-society organizations, researchers and individuals. Among its entries are Microsoft, Google, the ACLU, the Electronic Frontier Foundation and individual contributors. A list of submitters establishes visible participation; it is not a demographic census or a measurement of whose views received the most weight. [7]
Our analysis: counting submissions is useful only after defining the unit. One organization may submit through a trade association and separately in its own name. Several people may sign one submission. A large document is not necessarily more influential than a short one. Any future participation count should publish its classification rules, duplicate-handling method and denominator.
Research and interpretation
What lobbying disclosures can and cannot establish
The Senate-hosted statutory text lists specific issues and, where practicable, bill numbers and executive branch actions among the required report fields. Our reading approach is to use those fields to distinguish broad themes from named proposals rather than classify every technology reference as AI lobbying. [8]
The Senate-hosted statutory text identifies report fields covering issues, congressional chambers or federal agencies contacted, lobbyists and financial estimates. The joint disclosure guidance explains income for outside firms and expenses for organizations lobbying on their own behalf. These are different reporting measures. [8] [9]
Our analysis: do not label a registrant’s entire quarterly total as spending on one AI provision merely because that provision appears among several issues. Do not add a client’s reported expenses and its retained firm’s income without examining overlap. A report can be a lead for examining participation, but it does not provide a meeting transcript, the position taken in every conversation or an agency’s causal reasoning.
This brief does not quantify AI lobbying or accuse a named participant of undisclosed activity. A defensible spending analysis would require a defined filing period, identified registrations and amendments, a reproducible search method, and explicit treatment of mixed-issue filings. Current filing obligations should be checked against the applicable version of the law and guidance; the records here are used to explain evidence limits.
Keep the distinctions visible
Claims, findings and unknowns
A company submitted recommendations, so it wrote the rules.
What the evidence supports: The selected comment and later texts establish participation and a comparable structural change. [3] [4] [6]
What remains open: The reviewed record does not assign that change exclusively to the company. A decision trail is needed.
The process was open, so all affected people were represented equally.
What the evidence supports: NIST published opportunities for input and a directory of received comments. [2] [7]
What remains open: Those records alone do not measure barriers, missing voices, resources or the weight given to each submission.
A lobbying total measures how much was spent securing one AI rule.
What the evidence supports: The reporting structure includes specific issues and overall financial estimates. [8] [9]
What remains open: The reviewed guidance does not supply an allocation of each registrant’s total to individual provisions or demonstrate that spending secured an outcome.
Recommended oversight questions
Questions for decision-makers
These questions are our recommendations. They identify the records needed to test a claim or evaluate a decision.
01Which submissions informed each material revision?
Why ask: A change log would connect participation with decisions more directly than similarity alone. [2] [3] [4] [6]
Who can answer: The issuing agency and the team responsible for the framework.
Records to request: Versioned drafts, redlines, comment dispositions and explanatory memoranda.
Link to this question →02Who participated through channels beyond written comments?
Why ask: A comment directory should not be treated as the complete universe of engagement. [10]
Who can answer: The agency’s consultation coordinators.
Records to request: Workshop agendas, attendance records, meeting calendars and publicly releasable meeting summaries, with privacy protections.
Link to this question →03How were affected communities able to participate and challenge assumptions?
Why ask: The ACLU’s submission makes participation a concrete issue to examine; a directory alone does not resolve it. [5] [7]
Who can answer: Consultation organizers and participating community organizations.
Records to request: Outreach plans, accessible participation formats, support offered, feedback received and explanations of how it was considered.
Link to this question →04What does each reported lobbying amount actually cover?
Why ask: Outside-firm income and an organization’s expenses are distinct measures, and a filing can cover multiple matters. [8] [9]
Who can answer: The registrant and the organization whose activity is reported.
Records to request: Original and amended reports, reporting-method descriptions and any available issue-level breakdown.
Link to this question →05What evidence would justify a claim of influence or improper preference?
Why ask: A public-interest investigation should define the test before selecting evidence that fits a suspicion. [3] [4] [6]
Who can answer: The agency decision-maker and the publication making the claim.
Records to request: Dated recommendations, decision explanations, relevant correspondence, alternatives considered and the applicable conflict-of-interest rules. Seek responses from the named parties before making adverse findings.
Link to this question →Source register
Sources reviewed 14 November 2026. Dates below identify the cited publication or version; undated documentation is labelled. Links open the original record.
- 01
NIST in the Federal Register · 29 July 2021
Artificial Intelligence Risk Management Framework request for information ↗
Primary process record; summary, dates and invitation. Defines voluntary scope.
- 02
NIST · 17 March 2022
NIST seeks comments on draft AI Risk Management Framework ↗
Primary agency announcement; initial draft, comment deadline and workshop.
- 03
Microsoft submission hosted by NIST · 29 April 2022
Comments of Microsoft Corporation on the initial draft ↗
Primary participant statement; opening recommendations on consolidating categories. Not an independent assessment.
- 04
NIST · 18 August 2022
AI Risk Management Framework second draft ↗
Historical draft; section 4, printed pages 10–11. Compared with the participant proposal and final text.
- 05
American Civil Liberties Union submission hosted by NIST · 29 September 2022
ACLU comments on the second draft ↗
Primary participant statement; executive summary, printed pages 1–2. Identifies recommendations, not agency adoption.
- 06
NIST · January 2023
Artificial Intelligence Risk Management Framework version 1.0 ↗
Final version examined; section 3, printed page 12. A voluntary framework, not a comprehensive statement of AI law.
- 07
NIST · Created 8 November 2022; updated 1 December 2022
Comments on the second draft of the AI Risk Management Framework ↗
Primary directory of published comments. Not a complete inventory of every engagement channel.
- 08
United States Senate · Statutory compilation reviewed 14 November 2026
Lobbying Disclosure Act section 5 ↗
Published reporting fields and financial estimates; verify governing law separately for compliance work.
- 09
Clerk of the House and Secretary of the Senate · Version retrieved 14 November 2026
Lobbying Disclosure Act guidance ↗
Sections on recording income and expenses. Explains distinct measures and potential overlap.
- 10
NIST · Reviewed 14 November 2026
AI RMF development chronology ↗
Agency chronology of the RFI, concept paper, draft consultations and January 2023 release.
Method and corrections history
Edition 1 reviewed 14 November 2026. We examined the original participant submissions, NIST draft and final text, agency process records and official lobbying-disclosure materials linked here. The case selection illustrates a reproducible method; it is not a representative sample of all rulemaking. We did not code the entire comment corpus, audit all meetings, calculate lobbying totals or obtain an agency attribution for the selected textual change. Findings concern the cited historical versions. Analysis and recommended questions are labelled; no finding of misconduct, exclusive authorship or motive is made. Corrections should identify the affected claim, replacement evidence and revision date.
- 14 November 2026 · Edition 1
- First publication of this brief, its connections companion and matching PDF and Word editions. No subsequent corrections are recorded in this edition.
New evidence and substantive corrections will be dated here. Read the corrections policy →