NIST AI RMF Generative AI Profile (NIST AI 600-1)

NIST released NIST AI 600-1, "Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile", in July 2024. The AI RMF page of NIST gives July 26, 2024 as the release date. NIST AI 600-1 is "a cross-sectoral profile of and companion resource for the AI Risk Management Framework (AI RMF 1.0) for Generative AI" (Section 1). NIST AI 600-1 and AI RMF 1.0 (NIST AI 100-1) are voluntary guidance for organizations and AI actors. They are not law.

NIST AI 600-1 uses this text from Executive Order 14110 for generative AI: "the class of AI models that emulate the structure and characteristics of input data in order to generate derived synthetic content". Then it adds: "for purposes of this document, GAI generally refers to generative foundation models". AI 600-1 "was developed per Section 4.1(a)(i)(A) of EO 14110". Executive Order 14148 of January 20, 2025 revoked EO 14110 in its Section 2.

As of October 2026, the AI RMF page of NIST has this text: "The AI RMF 1.0 is being revised as part of the White House AI Action Plan." No new text of the AI RMF is available. The NIST AI RMF page gives more information about the revision.

Primary sources

NIST AI 600-1, "Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile", July 2024: Section 1 with footnotes 1 and 2, Sections 2 to 2.12, Section 3, and Appendix A. The NIST AI 600-1 PDF has the full text. Executive Order 14148, Sec. 2(ggg), revoked EO 14110.

How the Generative AI Profile fits into NIST AI RMF 1.0

NIST AI 100-1 divides its Core into four functions (GOVERN, MAP, MEASURE, and MANAGE), with categories and subcategories. NIST AI 600-1 applies this Core to generative AI (GAI). In AI 600-1, a profile is "an implementation of the AI RMF functions, categories, and subcategories for a specific setting, application, or technology". A profile is "based on the requirements, risk tolerance, and resources of the Framework user". AI 600-1 is a cross-sectoral profile because "GAI covers risks of models or applications that can be used across use cases or sectors". For the three types of AI RMF profiles, see NIST AI RMF profiles.

NIST AI 600-1 has these parts:

• Section 2 identifies 12 risks "unique to or exacerbated by the development and use of GAI". AI 600-1 "focuses on risks for which there is an existing empirical evidence base at the time this profile was written". For example, "speculative risks that may potentially arise in more advanced, future GAI systems are not considered".
• Section 3 gives suggested actions to manage GAI risks. The suggested actions "are organized by relevant AI RMF subcategories". Not all subcategories are in AI 600-1: "Suggested actions are listed for only some subcategories."
• Appendix A gives more information about four primary considerations: Governance, Content Provenance, Pre-deployment Testing, and Incident Disclosure. Section 1 refers to the NIST Generative AI Public Working Group (GAI PWG) and has this text: "The focus of the GAI PWG was limited to four primary considerations relevant to GAI". The suggested actions "primarily address these considerations".

Each table in Section 3 starts with one AI RMF subcategory. Each suggested action has an Action ID that shows the function and the subcategory. For example, GV-1.1-001 is the first suggested action for GOVERN 1.1. Each suggested action also has tags that show the GAI risks related to it.

Section 3 also tells organizations that "AI risk management activities and actions set forth in the AI RMF 1.0 and Playbook are already applicable for managing GAI risks". It adds: "Organizations are encouraged to apply the activities suggested in the AI RMF and its Playbook when managing the risk of GAI systems."

Section 1 of AI 600-1 also has this text: "Future revisions of this profile will include additional AI RMF subcategories, risks, and suggested actions based on additional considerations of GAI as the space evolves and empirical evidence indicates additional risks."

The 12 risks

NIST AI 600-1, Section 2, gives 12 risks "unique to or exacerbated by the development and use of GAI". Section 2 gives a short text for each risk. Sections 2.1 to 2.12 give more information about each risk. Each of these sections ends with the related characteristics of trustworthy AI. AI 600-1 maps each risk "to relevant Trustworthy AI Characteristics" of the AI RMF. The sections below give the characteristics with their names from Section 3 of NIST AI 100-1.

Footnote 5 of AI 600-1 tells organizations that the risks "can be further categorized by organizations".

NIST AI 600-1Generative AI Profile, 12 risks

CBRN information or capabilitiesChemical, biological, radiological, or nuclear weapons

ConfabulationConfidently stated but erroneous or false content

Dangerous, violent, or hateful contentIncludes recommendations for self-harm or illegal activities

Data privacyLeakage, unauthorized use, disclosure, or de-anonymization

Environmental impactsHigh compute resource use in training or operation

Harmful bias or homogenizationAmplified biases, performance disparities, homogeneity

Human-AI configurationAnthropomorphizing, automation bias, over-reliance

Information integrityContent that may not distinguish fact from opinion or fiction

Information securityOffensive cyber capabilities, larger attack surface

Intellectual propertyCopyrighted, trademarked, or licensed content, trade secrets

Obscene, degrading, and/or abusive contentIncludes CSAM and NCII

Value chain and component integrationThird-party components, supplier vetting

CBRN Information or Capabilities

NIST AI 600-1, Section 2: Eased access to or synthesis of materially nefarious information or design capabilities related to chemical, biological, radiological, or nuclear (CBRN) weapons or other dangerous materials or agents.

Related characteristics of trustworthy AI (Section 2.1): safe, and explainable and interpretable.

Confabulation

NIST AI 600-1, Section 2: The production of confidently stated but erroneous or false content (known colloquially as “hallucinations” or “fabrications”) by which users may be misled or deceived.

Related characteristics of trustworthy AI (Section 2.2): fair – with harmful bias managed, safe, valid and reliable, and explainable and interpretable.

Dangerous, Violent, or Hateful Content

NIST AI 600-1, Section 2: Eased production of and access to violent, inciting, radicalizing, or threatening content as well as recommendations to carry out self-harm or conduct illegal activities. Includes difficulty controlling public exposure to hateful and disparaging or stereotyping content.

Related characteristics of trustworthy AI (Section 2.3): safe, and secure and resilient.

Data Privacy

NIST AI 600-1, Section 2: Impacts due to leakage and unauthorized use, disclosure, or de-anonymization of biometric, health, location, or other personally identifiable information or sensitive data.

Related characteristics of trustworthy AI (Section 2.4): accountable and transparent, privacy-enhanced, safe, and secure and resilient.

Environmental Impacts

NIST AI 600-1, Section 2: Impacts due to high compute resource utilization in training or operating GAI models, and related outcomes that may adversely impact ecosystems.

Related characteristics of trustworthy AI (Section 2.5): accountable and transparent, and safe.

Section 2.5 tells organizations that "Methods for creating smaller versions of trained models, such as model distillation or compression, could reduce environmental impacts at inference time, but training and tuning such models may still contribute to their environmental impacts." Section 2.5 also has this text: "Currently there is no agreed upon method to estimate environmental impacts from GAI."

Harmful Bias and Homogenization

NIST AI 600-1, Section 2: Amplification and exacerbation of historical, societal, and systemic biases; performance disparities between sub-groups or languages, possibly due to non-representative training data, that result in discrimination, amplification of biases, or incorrect presumptions about performance; undesired homogeneity that skews system or model outputs, which may be erroneous, lead to ill-founded decision-making, or amplify harmful biases.

In Section 2, item 6 gives this risk the name "Harmful Bias or Homogenization". Section 2.6 uses the name "Harmful Bias and Homogenization".

Related characteristics of trustworthy AI (Section 2.6): fair – with harmful bias managed, and valid and reliable.

Human-AI Configuration

NIST AI 600-1, Section 2: Arrangements of or interactions between a human and an AI system which can result in the human inappropriately anthropomorphizing GAI systems or experiencing algorithmic aversion, automation bias, over-reliance, or emotional entanglement with GAI systems.

Related characteristics of trustworthy AI (Section 2.7): accountable and transparent, explainable and interpretable, fair – with harmful bias managed, privacy-enhanced, safe, and valid and reliable.

Information Integrity

NIST AI 600-1, Section 2: Lowered barrier to entry to generate and support the exchange and consumption of content which may not distinguish fact from opinion or fiction or acknowledge uncertainties, or could be leveraged for large-scale dis- and mis-information campaigns.

Related characteristics of trustworthy AI (Section 2.8): accountable and transparent, safe, valid and reliable, and explainable and interpretable.

Information Security

NIST AI 600-1, Section 2: Lowered barriers for offensive cyber capabilities, including via automated discovery and exploitation of vulnerabilities to ease hacking, malware, phishing, offensive cyber operations, or other cyberattacks; increased attack surface for targeted cyberattacks, which may compromise a system’s availability or the confidentiality or integrity of training data, code, or model weights.

Related characteristics of trustworthy AI (Section 2.9): privacy-enhanced, safe, secure and resilient, and valid and reliable.

Intellectual Property

NIST AI 600-1, Section 2: Eased production or replication of alleged copyrighted, trademarked, or licensed content without authorization (possibly in situations which do not fall under fair use); eased exposure of trade secrets; or plagiarism or illegal replication.

Related characteristics of trustworthy AI (Section 2.10): accountable and transparent, fair – with harmful bias managed, and privacy-enhanced.

Obscene, Degrading, and/or Abusive Content

NIST AI 600-1, Section 2: Eased production of and access to obscene, degrading, and/or abusive imagery which can cause harm, including synthetic child sexual abuse material (CSAM), and nonconsensual intimate images (NCII) of adults.

Related characteristics of trustworthy AI (Section 2.11): fair – with harmful bias managed, safe, and privacy-enhanced.

This risk includes, for example, "synthetic child sexual abuse material (CSAM)" and "nonconsensual intimate images (NCII) of adults". It also includes other "obscene, degrading, and/or abusive imagery which can cause harm".

Value Chain and Component Integration

NIST AI 600-1, Section 2: Non-transparent or untraceable integration of upstream third-party components, including data that has been improperly obtained or not processed and cleaned due to increased automation from GAI; improper supplier vetting across the AI lifecycle; or other issues that diminish transparency or accountability for downstream users.

Related characteristics of trustworthy AI (Section 2.12): all seven characteristics (see The seven characteristics).

In Section 3, most suggested actions for GOVERN 6.1, GOVERN 6.2, and MANAGE 3.1 have the tag for this risk. For these outcomes of NIST AI 100-1, see GOVERN 6 and MANAGE 3.

The Generative AI Profile in Modulos

Modulos gives NIST AI RMF 1.0 as two Frameworks: MFF-3 for an AI System and OFF-3 for the Organization. Each Requirement of these Frameworks has the name of one subcategory of NIST AI 100-1. No Modulos Framework or Requirement is for NIST AI 600-1. The Frameworks do not hold the Profile or its suggested actions. An organization can apply the Profile and its suggested actions without the Frameworks.

The risk register of an AI System can hold GAI risks. See AI System Risks.

For the work that the Frameworks do not hold, see Operationalizing NIST AI RMF in Modulos.

Generative AI in other laws and standards

NIST AI 600-1 is voluntary guidance. The EU AI Act and Texas H.B. 149 are law, and ISO/IEC 42001 is a standard.

EU AI Act: Regulation (EU) 2024/1689 is law in the European Union, and it does not refer to NIST AI 600-1. The EU AI Act has provisions on general-purpose AI models, on synthetic content, and on some prohibited AI practices:

• General-purpose AI models: A general-purpose AI model (Article 3(63)) is not the same as GAI in AI 600-1. Chapter V (Articles 51 to 56) gives the obligations of the providers of these models. Article 53 gives obligations to these providers, for example a copyright policy. It has no risk assessment obligation. Article 55(1) gives more obligations to providers of general-purpose AI models with systemic risk (Article 3(65)). One of them is to "assess and mitigate possible systemic risks at Union level".
• Synthetic content: Article 50(2) gives transparency obligations to providers of AI systems that make synthetic content. Article 50(4) gives transparency obligations to "Deployers of an AI system that generates or manipulates image, audio or video content constituting a deep fake". It also gives them to "Deployers of an AI system that generates or manipulates text which is published with the purpose of informing the public on matters of public interest". Each paragraph also gives exceptions.
• The prohibited AI practices of Article 5: Article 5(1), first subparagraph, points (ba) and (bb), are prohibited AI practices for an AI system that "generates or manipulates" some types of material. Article 5(1a) and (1b) give the conditions and the limits of these prohibited AI practices. Article 113, point (a), makes them apply from 2 December 2026.

For more information, see General-purpose AI models and Prohibited practices and transparency.

ISO/IEC 42001:2023: ISO/IEC 42001 has no clauses about generative AI. In clause 4.3, the organization sets the scope of its AI management system, and thus the AI systems that it includes. Clause 6.1.4 and clause 8.4 are about AI system impact assessment. See the page that compares ISO/IEC 42001 and NIST AI RMF.

Texas H.B. 149: Sec. 552.105(e)(2)(D) of this Texas law names the "Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile" in a condition of a defense in an action of the Texas attorney general. The condition names the Profile or "another nationally or internationally recognized risk management framework for artificial intelligence systems". This condition is not an obligation to use the Profile.

For the full condition in Texas H.B. 149, see Legal effect.

Where to go next

NIST AI RMF

The NIST AI RMF, its legal effect, the four functions of the Core, and the profiles

GOVERN function

The six GOVERN categories and 19 subcategories, with GOVERN 6 for third-party software and data

MAP function

The five MAP categories and 18 subcategories, for the context of an AI system and its impacts

MEASURE function

The four MEASURE categories and 22 subcategories, for the evaluation of AI systems

MANAGE function

The four MANAGE categories and 13 subcategories, with MANAGE 3 for AI risks and benefits from third-party entities

Sources of this page

• NIST AI 600-1, "Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile", July 2024 (PDF). This page uses these parts of it:
  • Section 1 with footnotes 1 and 2.
  • Section 2 with footnote 5, and Sections 2.1 to 2.12.
  • Section 3 and its tables of suggested actions.
  • The four primary considerations in Appendix A.
• NIST AI 100-1, "Artificial Intelligence Risk Management Framework (AI RMF 1.0)", January 2023 (PDF): Section 3 (names of the characteristics), Section 5, Table 1 (GOVERN 6), and Table 4 (MANAGE 3).
• NIST, AI Risk Management Framework page: the release date of NIST AI 600-1 and the text about the revision of AI RMF 1.0.
• NIST, AI RMF Playbook page: the Playbook is a voluntary companion resource of NIST, and it "will be updated after the AI RMF is revised".
• The White House, America's AI Action Plan, July 2025: the recommended policy action about the NIST AI RMF.
• Executive Order 14148 of January 20, 2025 (90 FR 8237): Sec. 2(ggg).
• Texas H.B. 149, text of the Texas Legislature: Sec. 552.105(e)(2)(D) and SECTION 10.
• Regulation (EU) 2024/1689 (EU AI Act), version of 27 July 2026: Articles 3(63), 3(65), 5(1) points (ba) and (bb), 5(1a), 5(1b), 50(2), 50(4), 53, 55(1), and 113.
• ISO/IEC 42001:2023 (AI management system): clauses 4.3, 6.1.4, and 8.4.

Disclaimer

This page gives general information. It is not legal advice.