NIST AI 600-1 Generative AI Profile

NIST published Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile, numbered NIST AI 600-1, on July 26, 2024. It is a companion to AI RMF 1.0 and applies the framework’s functions, categories and subcategories to generative AI. NIST describes the underlying framework as intended for voluntary use. AI 600-1 therefore offers a common vocabulary and recommended risk-management actions; it does not itself impose legal duties or certify a product. The profile identifies 12 risks that are novel to or intensified by generative AI, including confabulation, harmful bias or homogenization, information integrity, information security, privacy, intellectual property, overreliance, environmental impacts, and value-chain or component-integration issues. It then provides suggested actions for managing those risks. Actions are organized against the AI RMF’s four functions: Govern establishes policies and accountability; Map identifies context and risks; Measure evaluates them; Manage prioritizes response and monitoring. Organizations can tailor the actions to their needs and priorities. AI 600-1 is cross-sectoral: it covers common generative-AI activities rather than one industry or model type. It can help developers, deployers, evaluators and buyers structure design reviews, procurement questions, testing and monitoring. A profile action may be useful even when it is not required by a regulation or contract. If an organization incorporates it into binding internal policy, procurement terms or a regulator-approved process, those separate sources can make compliance obligatory for that organization. A team should not mistake a voluntary NIST publication for law, a test pass, or evidence that all material risks have been eliminated.