NIST releases second draft of AI 800-1 misuse risk guidance for foundation models

NIST AI 800-1 is voluntary US government guidance on managing misuse risk for dual-use foundation models, produced by the U.S. AI Safety Institute (US AISI), which is housed within NIST. The second public draft of the document was released on January 15, 2025, opening a comment period that ran through March 15, 2025.

What it is

NIST AI 800-1 outlines voluntary best practices for identifying, measuring, and mitigating risks to public safety and national security across the AI lifecycle for dual-use foundation models. The second public draft followed an initial public draft released in July 2024 and incorporated feedback from more than 70 industry, academic, and civil society experts submitted during the initial comment period. The initial draft had itself been issued in response to the Executive order on Safe, Secure, and Trustworthy Development and Use of Artificial Intelligence issued on October 30, 2023.

What it requires

The updated draft added a new appendix detailing existing approaches to measuring misuse risk, intended to make the guidelines more actionable for developers. It also added two extensive appendices on chemical and biological misuse risk and on cybersecurity misuse risk to help operationalize the guidance in high-priority domains. The draft further clarified the importance of a marginal risk framework for assessing and managing risk when analyzing the potential impact of a given foundation model. It was updated to support proportional application to open model developers and included additional content supporting risk management practices across the AI supply chain.

What security leaders should do

Security leaders overseeing foundation model development or deployment can use the appendices on cyber and chemical/biological misuse risk as a starting checklist for lifecycle-stage evaluations. Because the guidance is voluntary and still in draft form, teams should track the final published version rather than treat this draft as a compliance baseline. Given the added emphasis on supply-chain risk management, organizations that integrate third-party foundation models should map which lifecycle stages and appendices apply to their own role as deployers rather than developers.