MP-5.1: AI risk impacts on individuals + groups are documented
Privacy + fairness impact assessment per AI use case.
Last reviewed October 2026
Why MP-5.1 evidence is hard
Privacy and fairness impact per use case gets written up, reviewed and revisited. It is not a scan output. One measurement is available to cite inside it - paired prompts that vary a single protected attribute - though those findings are filed under the EU data-governance control rather than this one.
How Penaxtra maps to MP-5.1
NIST AI 600-1 asks what you measured and what you did about it. The MP-5.1 identifier rides the finding into the evidence export, and the append-only audit log carries the other half: which scans ran, against which assets, on what schedule. Every finding carries the probe that was sent, a SHA-256 digest of the response it provoked, the tier that decided the verdict and its status history from first observation to close. Identity survives a re-scan: a control you closed and that comes back reopens under the same row with a reopen count, rather than arriving as a new issue.
MP-5.1 capabilities
Findings tagged with the NIST AI 600-1 MP-5.1 identifier
Penaxtra severity for this control (medium)
Cross-framework identifiers attached to the same finding where controls overlap
PDF and JSON evidence export with the control identifier attached
MP-5.1 control coverage
Findings for MP-5.1 carry the NIST AI 600-1 MP-5.1 identifier along with the corresponding control identifiers in the other frameworks Penaxtra maps, so one result is reflected across each mapped framework.
Frequently asked
What is MP-5.1 (AI risk impacts on individuals + groups are documented)?
Privacy + fairness impact assessment per AI use case. It is a NIST AI 600-1 control; Penaxtra assesses it at medium severity.
How does Penaxtra test for MP-5.1?
NIST AI 600-1 asks what you measured and what you did about it. The MP-5.1 identifier rides the finding into the evidence export, and the append-only audit log carries the other half: which scans ran, against which assets, on what schedule. Every finding carries the probe that was sent, a SHA-256 digest of the response it provoked, the tier that decided the verdict and its status history from first observation to close. Identity survives a re-scan: a control you closed and that comes back reopens under the same row with a reopen count, rather than arriving as a new issue.
Does a finding for MP-5.1 help with an audit?
Each finding is tagged with the NIST AI 600-1 MP-5.1 identifier and exported in the PDF and JSON evidence pack, so it appears on the auditor control list with the identifier already attached.