NIST AI 600-1, explained

NIST AI 600-1 is the Generative Artificial Intelligence Profile of the National Institute of Standards and Technology (NIST) Artificial Intelligence Risk Management Framework (AI RMF). NIST published it on July 26, 2024 under the full title Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile. The document defines 12 risks that generative AI (GAI) creates or makes worse and lists suggested actions, each tied to a subcategory of the framework, that an organization can take against them. The profile is voluntary.

What NIST AI 600-1 is, and how it relates to AI 100-1

The AI RMF itself is NIST AI 100-1, version 1.0, which NIST's framework page dates to January 26, 2023. The framework organizes risk work into four functions, Govern, Map, Measure, and Manage, and breaks each into categories and subcategories. The framework also defines profiles. NIST AI 600-1 explains the idea in its introduction: a profile is an implementation of the AI RMF functions, categories, and subcategories for a specific setting, application, or technology, based on the requirements, risk tolerance, and resources of the framework user. Because GAI risks apply across use cases and sectors, the document calls itself a cross-sectoral profile, the kind that can be used to govern, map, measure, and manage risks common to activities such as the use of large language models (LLMs), cloud-based services, or acquisition.

The profile does not stand alone. Section 3 states that the risk management activities in AI RMF 1.0 and its Playbook already apply to GAI, and encourages organizations to apply them; the profile adds what is specific to GAI. The two documents are meant to be read together, and every action in 600-1 is filed under a 100-1 subcategory.

The profile also records where it came from. The introduction says it was developed pursuant to Section 4.1(a)(i)(A) of Executive Order (EO) 14110 on Safe, Secure, and Trustworthy Artificial Intelligence, which directed the Secretary of Commerce, acting through the Director of NIST, to develop a companion resource to the AI RMF, NIST AI 100-1, for generative AI. The order's text, in the Federal Register, puts that direction beside two others: a companion to the Secure Software Development Framework for generative AI and dual-use foundation models, and an initiative on guidance and benchmarks for evaluating and auditing AI capabilities, with a focus on cybersecurity and biosecurity. The profile's authors, per NIST's publication record, are Chloe Autio, Reva Schwartz, Jesse Dunietz, Shomik Jain, Martin Stanley, Elham Tabassi, Patrick Hall, and Kamie Roberts.

How the profile was written

NIST built the profile through a public working group. The NIST AI Resource Center's public working groups page says the Generative AI Public Working Group formed in July 2023, drew over 2,500 public volunteers, and worked in four program areas: governance, content provenance, pre-deployment testing, and incident disclosure. The profile's introduction names the same four as the primary considerations that the suggested actions address, and says the group ran as an open, collaborative process in a virtual workspace. The group is no longer active.

A draft came first. NIST announced the initial public draft on April 29, 2024 as a document to solicit public feedback before a final version later that year. The working groups page describes that draft as covering 13 risks and more than 400 actions. The final document is shorter. NIST's July 26, 2024 release, issued 270 days after the executive order, describes the final profile as a list of 12 risks and just over 200 actions, with the actions mapped to the AI RMF. The same release announced a finalized Secure Software Development Framework companion (SP 800-218A), a plan for global engagement on AI standards (NIST AI 100-5), the Dioptra testing software, and the first public draft of NIST AI 800-1 on managing misuse risk for dual-use foundation models.

The 12 risks, in the document's words

Section 2 of the profile defines risks unique to or exacerbated by GAI. Each is labeled according to the outcome, object, or source of the risk, and the document says it focuses on risks for which an empirical evidence base existed when the profile was written, leaving out speculative risks that might arise in more advanced future systems. The 12 risks, with the document's names and condensed definitions:

A footnote offers one way to group them, drawn in part from the United Kingdom's International Scientific Report on the Safety of Advanced AI: technical or model risks, such as confabulation; misuse by humans, such as CBRN information; and ecosystem or societal risks, such as environmental impacts, with some risks cross-cutting. The confabulation footnote records that some commenters consider the terms hallucination and fabrication to anthropomorphize GAI, which the document treats as itself a risk. The post on LLM hallucination covers the research behind that risk.

Section 2 also says GAI risks vary along four dimensions: the stage of the AI lifecycle at which they arise, their scope (model, application, or ecosystem), their source (the model, its inputs, its outputs, or human behavior), and their time scale. Each risk is mapped in Section 3 and in the appendix tables to the trustworthiness characteristics of the AI RMF.

How the suggested actions map to Govern, Map, Measure, and Manage

Section 3 holds the actions. The document explains the structure before the tables begin. The suggested actions are organized by AI RMF subcategory, so that an organization already working through the framework can slot them in. Not every subcategory of the AI RMF is included; actions are listed for only some, a footnote says, because the document focused on the working group's four considerations, and subcategories not addressed may be added later. By a count of the subcategory headings in the published document, the tables cover 49 subcategories: 15 under Govern, 9 under Map, 16 under Measure, and 9 under Manage.

Each table carries the same four elements:

• Action ID. The identifier encodes the function and subcategory. GV-1.1-001 is the first suggested action for Govern 1.1, GV-1.1-002 the second. The prefixes are GV for Govern, MP for Map, MS for Measure, and MG for Manage.
• Suggested Action. The step an organization or AI actor can take.
• GAI Risks. Tags linking the action to the risks in Section 2.
• AI Actor Tasks. The roles the subcategory concerns, such as Governance and Oversight or AI Deployment, listed once per table. The document notes that not every action applies to every actor, and that an action relevant to a GAI developer may not be relevant to a deployer.

A few rows show the pattern. Under Govern 1.1, GV-1.1-001 says to align GAI development and use with applicable laws and regulations, including data privacy and intellectual property law, tagged Data Privacy, Harmful Bias and Homogenization, and Intellectual Property. Under Govern 1.2, GV-1.2-002 says to establish policies to evaluate risk-relevant capabilities of GAI and the robustness of safety measures, both before deployment and on an ongoing basis, through internal and external evaluations, tagged CBRN Information or Capabilities and Information Security. Under Manage 3.1, which concerns third-party resources, MG-3.1-003 says to re-assess model risks after fine-tuning or retrieval-augmented generation and for any third-party GAI model deployed for use cases not evaluated in initial testing, and MG-3.1-005 says to review transparency artifacts such as system cards and model cards for third-party models. Under Measure 2.5, MS-2.5-003 concerns reviewing and verifying sources and citations in outputs, tagged Confabulation. Under Manage 4.1, MG-4.1-002 concerns post-deployment monitoring, particularly for confabulation, CBRN, or cyber risks. What those artifacts contain is the subject of the posts on system cards and model cards and datasheets.

Appendix A expands the four primary considerations. The pre-deployment testing section states that currently available test, evaluation, validation, and verification processes for GAI may be inadequate or mismatched to deployment contexts, that anecdotal testing through video games or standardized tests designed for humans does not guarantee validity or reliability, and that jailbreaking or prompt engineering tests may not systematically assess those risks either. The incident disclosure section observes that formal channels do not currently exist to report and document AI incidents, and that the public databases that do exist decide what to track on an ad hoc basis. The post on red teaming language models covers the testing methods that appendix discusses.

Who uses it

The profile is written for anyone who designs, develops, or uses GAI, and the suggested actions are addressed to AI actors by role. Three public signs of adoption are easy to find. The NIST AI Resource Center's crosswalks page lists a May 28, 2025 crosswalk between NIST AI 600-1 and Singapore's AI Verify framework, submitted by Singapore's Infocomm Media Development Authority; NIST states that listing a crosswalk does not mean it endorses the mapped resource. The Chief Digital and Artificial Intelligence Office's AI Assurance Toolkit, which the office describes as identifying, tracking, and improving the alignment of the Department of War's AI projects with AI assurance best practices, cites the NIST AI Risk Management Framework, the document the profile supplements, as one of its sources; the page does not mention the profile itself. And the profile's own actions on third-party models give buyers a vocabulary for what to request from a vendor.

The profile's standing is set out in its first section: the AI RMF is intended for voluntary use. The suggested actions are described as steps an organization can take, and their applicability is for the organization to determine. A contract can make a given action a requirement; the document does not.

What has changed since July 2024

Three things have moved around the profile, and one has not.

The executive order behind it was revoked. Executive Order 14148 of January 20, 2025 revoked EO 14110. NIST's publication record for the profile, last updated April 8, 2026, still describes the document as prepared under EO 14110 and lists no revision or errata, so the profile remains in force as published while the order that commissioned it does not.

The framework it supplements is under revision. America's AI Action Plan, dated July 2025, includes among its recommended policy actions, under the heading on ensuring that frontier AI protects free speech and American values, that the Department of Commerce through NIST revise the NIST AI Risk Management Framework to eliminate references to misinformation, Diversity, Equity, and Inclusion, and climate change. NIST's framework page now states that AI RMF 1.0 is being revised as part of that plan. The profile's own risk list includes Environmental Impacts, Harmful Bias or Homogenization, and Information Integrity, whose definition refers to dis- and mis-information campaigns. Whether and how the profile changes when the framework does is not stated on any NIST page as of this writing; the profile itself says future revisions will include additional subcategories, risks, and actions.

A related document advanced. NIST AI 800-1, Managing Misuse Risk for Dual-Use Foundation Models, appeared as a first public draft alongside the final profile on July 26, 2024. The U.S. AI Safety Institute at NIST released a second public draft on January 15, 2025, with comments due March 15, 2025, describing it as voluntary best practices for identifying, measuring, and mitigating risks to public safety and national security across the AI lifecycle, with new appendices on model evaluations, chemical and biological misuse, and cybersecurity misuse.

What has not changed is the text of NIST AI 600-1. Anyone citing it in a solicitation or a compliance matrix can cite the July 2024 document by its designation and date and be confident that the reader will find the same 12 risks and the same action identifiers.

What to check

• Does a document that claims alignment with NIST AI 600-1 name which of the 12 risks apply to the system and which it has set aside, with reasons?
• Are the suggested actions cited by Action ID, such as GV-1.2-002 or MG-3.1-003, so that a reviewer can find the row and its risk tags?
• For a third-party or fine-tuned model, has the risk assessment been redone after fine-tuning or retrieval-augmented generation, as MG-3.1-003 suggests, or does it rest on the developer's release-time testing?
• Does the pre-deployment testing go beyond video games and standardized tests designed for humans, which Appendix A says do not guarantee validity or reliability, to the deployment context?
• Is there a channel for logging and disclosing incidents, given that the profile says no formal reporting channel exists?
• Does the citation give the designation and date, NIST AI 600-1 of July 2024, so that a future revision of the AI RMF does not leave the reference ambiguous?

Azcuna's ELLMENT, the E-2D Large Language Model Entity, was proposed to NAVAIR PMA-231 under Navy SBIR Phase I topic DON26BZ01-NV010. The prototype, built at private expense on publicly available doctrine, answers with a page-level citation and refuses when the documents do not support an answer. The proposal has been submitted.

Questions people ask

What is NIST AI 600-1?

NIST AI 600-1 is the Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile, published by the National Institute of Standards and Technology on July 26, 2024. The document calls itself a cross-sectoral profile of and companion resource for AI RMF 1.0. It defines 12 risks that are novel to or exacerbated by generative AI and lists suggested actions, organized by AI RMF subcategory, that organizations can take to govern, map, measure, and manage them.

What are the 12 generative AI risks in NIST AI 600-1?

In the document's wording: CBRN Information or Capabilities; Confabulation; Dangerous, Violent, or Hateful Content; Data Privacy; Environmental Impacts; Harmful Bias or Homogenization; Human-AI Configuration; Information Integrity; Information Security; Intellectual Property; Obscene, Degrading, and/or Abusive Content; and Value Chain and Component Integration. NIST AI 600-1 says each risk is labeled by its outcome, object, or source, and that the list covers risks with an existing empirical evidence base, not speculative ones.

What is the generative AI profile of the AI RMF?

A profile, as NIST AI 600-1 defines it, is an implementation of the AI RMF functions, categories, and subcategories for a specific setting, application, or technology. Because generative AI cuts across sectors, NIST calls this one a cross-sectoral profile. The profile does not replace AI RMF 1.0. The document says the activities in the framework and its Playbook already apply to generative AI, and the profile adds risk definitions and actions specific to it.

How does NIST AI 600-1 relate to NIST AI 100-1?

NIST AI 100-1 is the AI Risk Management Framework version 1.0, released January 26, 2023. NIST AI 600-1 is a companion to it. Executive Order 14110 directed NIST to develop a companion resource to the AI RMF, NIST AI 100-1, for generative AI, and the profile's footnote cites that section. Every suggested action in 600-1 is filed under a 100-1 subcategory, such as Govern 1.2 or Measure 2.5, and uses the framework's four functions.

Is NIST AI 600-1 mandatory?

No. NIST AI 600-1 states that the AI RMF is intended for voluntary use, and the profile's suggested actions are described as steps an organization or AI actor can take, not requirements. The document also says not every action applies to every AI actor, and that applicability should be determined by the organization. A contract or policy can make the profile binding for a given program, but the document itself does not.

How are the suggested actions in NIST AI 600-1 organized?

Section 3 of NIST AI 600-1 is a set of tables, one per AI RMF subcategory. Each row has an Action ID, a Suggested Action, and GAI Risks tags, and each table ends with the AI Actor Tasks it concerns. The Action ID encodes the function and subcategory: GV-1.1-001 is the first action under Govern 1.1, and the prefixes GV, MP, MS, and MG stand for Govern, Map, Measure, and Manage. NIST's release announcement counted just over 200 actions.

What is confabulation in NIST AI 600-1?

NIST AI 600-1 defines confabulation as the production of confidently stated but erroneous or false content, known colloquially as hallucinations or fabrications, by which users may be misled or deceived. A footnote records that some commenters consider the terms hallucination and fabrication to anthropomorphize generative AI. Several suggested actions carry the Confabulation tag, including MS-2.5-003 on verifying sources and citations in outputs and MG-4.1-002 on post-deployment monitoring.

Who uses NIST AI 600-1?

NIST lists the profile as the output of a public working group with over 2,500 volunteers. The NIST AI Resource Center's crosswalks page carries a May 28, 2025 crosswalk between NIST AI 600-1 and Singapore's AI Verify framework. The Department of War's AI Assurance Toolkit cites the NIST AI Risk Management Framework as a source, though not the profile itself. Within the profile, suggested actions address developers, deployers, and third parties, and the document says applicability depends on the actor's role.

Has NIST updated AI 600-1?

Not as of this writing. NIST's publication record for the profile, last updated April 8, 2026, lists no revision or errata and still describes the document as written under Executive Order 14110. The AI RMF page says version 1.0 of the framework is being revised as part of the White House AI Action Plan, which in July 2025 recommended removing references to misinformation, Diversity, Equity, and Inclusion, and climate change. NIST AI 600-1 itself says future revisions will add subcategories, risks, and actions.

What is NIST AI 800-1 and how is it different from 600-1?

NIST AI 800-1, Managing Misuse Risk for Dual-Use Foundation Models, is a separate document from the U.S. AI Safety Institute at NIST. The first public draft appeared on July 26, 2024, the same day as the final 600-1, and a second public draft followed on January 15, 2025 with comments due March 15, 2025. NIST describes it as voluntary best practices for identifying, measuring, and mitigating risks to public safety and national security. The 600-1 profile covers 12 risk areas; 800-1 focuses on misuse of dual-use foundation models.

Sources

1. 1Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile (NIST AI 600-1) · National Institute of Standards and Technology
2. 2Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile (publication record) · National Institute of Standards and Technology
3. 3AI Risk Management Framework · National Institute of Standards and Technology
4. 4Department of Commerce Announces New Guidance, Tools 270 Days Following President Biden's Executive Order on AI · National Institute of Standards and Technology
5. 5Department of Commerce Announces New Actions to Implement President Biden's Executive Order on AI · National Institute of Standards and Technology
6. 6NIST AI Public Working Groups · NIST Trustworthy and Responsible AI Resource Center
7. 7Crosswalks · NIST Trustworthy and Responsible AI Resource Center
8. 8Executive Order 14110, Safe, Secure, and Trustworthy Development and Use of Artificial Intelligence · Federal Register via GovInfo
9. 9Executive Order 14148, Initial Rescissions of Harmful Executive Orders and Actions · Federal Register via GovInfo
10. 10America's AI Action Plan · The White House
11. 11Updated Guidelines for Managing Misuse Risk for Dual-Use Foundation Models · National Institute of Standards and Technology
12. 12AI Assurance Toolkit: Executive Summary · Chief Digital and Artificial Intelligence Office

Where this shows up in our work

• CALIBER, the market testbed for AI agents measures from an AI agent's trades whether it is gullible, herds, overpays, or can be steered.
• ELLMENT, the offline LLM for E-2D crews answers a crew's question from the aircraft's own manuals and cites the page, with no network.