NIST publishes Generative AI Profile, NIST AI 600-1

NIST published NIST AI 600-1, Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile on 26 July 2024. The profile carries the voluntary AI RMF 1.0 over to generative AI, helping organizations spot the risks peculiar to that technology and pick actions to manage them.

What it is

NIST calls the document a cross-sectoral profile and companion resource to AI RMF 1.0, so it is written for every industry rather than one. It was produced under Executive Order 14110, the order on safe, secure and trustworthy AI signed on 30 October 2023.

The order behind it no longer stands. Executive Order 14179, signed in January 2025, refers to EO 14110 as revoked and orders a review of actions taken under it. NIST still lists the generative AI profile on its AI RMF program page.

What it requires

The profile imposes no obligations. Its abstract repeats that the parent framework, released in January 2023, is meant for voluntary use to build trustworthiness into AI design, development, use and evaluation.

Rather than a checklist, it offers suggested actions that each organization filters against its own goals and priorities. That design leaves the choice of controls, and the burden of justifying omissions, with the adopter.

What security leaders should do

• Treat the profile as the generative AI annex to existing AI RMF work, not as a separate program with its own owners.
• Walk each generative AI deployment, such as chat assistants, coding tools and retrieval systems, through the risks the profile identifies, and record which suggested actions you adopt and why the rest do not apply.
• Cite it internally as voluntary good practice rather than a federal mandate, since the order it was written under has been revoked.
• Reuse its vocabulary in supplier questionnaires so vendors answer against a public reference instead of their own marketing terms.