; (B) how the organization integrates characteristics of trustworthy artificial intelligence, which include valid, reliable, safe, secure, resilient, accountable, transparent, globally and locally explainable, interpretable, privacy-enhanced, and fair with harmful bias managed, into organizational policies, processes, procedures, and practices; (C) a methodology to determine the needed level of risk management activities based on the organization’s risk tolerance; and (D) how the organization establishes risk management processes and outcomes through transparent policies, procedures, and other controls based on organizational risk priorities. (2) The structure, context, and capabilities of the critical-impact artificial intelligence system or critical-impact foundation model, including— (A) how the context was established and understood; (B) capabilities, targeted uses, goals, and expected costs and benefits; and (C) how risks and benefits are mapped for each system component. (3) A description of how the organization employs quantitative, qualitative, or mixed-method tools, techniques, and methodologies to analyze, assess, benchmark, and monitor artificial intelligence risk, including— (A) identification of appropriate methods and metrics; (B) how artificial intelligence systems are evaluated for trustworthy characteristics; (C) mechanisms for tracking artificial intelligence system risks over time; and (D) processes for gathering and assessing feedback relating to the efficacy of measurement. (4) A description of allocation of risk resources to map and measure risks on a regular basis as described in paragraph (1), including— (A) how artificial intelligence risks based on assessments and other analytical outputs described in paragraphs (2) and (3) are prioritized, responded to, and managed; (B) how strategies to maximize artificial intelligence benefits and minimize negative impacts were planned, prepared, implemented, documented, and informed by input from relevant artificial intelligence deployers