A water utility references NIST AI RMF language in policy but implements none of the framework functions. What finding is most appropriate?

A water utility that references NIST AI RMF language in policy but implements none of the framework functions has cosmetic governance, not adopted practice. The most appropriate finding is that policy name-dropping without implementing framework functions is insufficient AI governance practice because substantive adoption requires operating relevant Govern, Map, Measure, and Manage activities with evidence—not merely embedding terminology in titles. Claiming that completing an AI system inventory under the Map function addresses the Govern, Measure, and Manage expectations fails by concept: a single inventory activity under one function does not satisfy the separate Govern, Measure, and Manage expectations or constitute implemented framework functions. Asserting that issuing a risk tolerance statement for operations satisfies the Measure function for deployed treatment models fails by concept: a risk tolerance statement alone does not execute the Measure function's evidence, monitoring, and evaluation activities for deployed models. Claiming that referencing RMF terminology in procurement contracts demonstrates operating-stage risk management maturity fails by concept: procurement language alone is not operating-stage maturity; it requires executed controls and evidence. Exam caveat: AAIA framework-adoption items distinguish referenced language from implemented functions; auditors report gaps when municipalities cite NIST AI RMF without mapped practices and controls. Operational check: map utility AI systems to relevant RMF functions, identify missing activities and owners, implement prioritized Govern/Map/Measure/Manage practices, and retain artifacts showing the policy language is backed by operating controls.