Not sure where to start? Answer 3 questions and get a tailored compliance action plan.

NIST AI 600-1 Generative AI Profile

Issued by

National Institute of Standards and Technology (NIST), U.S. Department of Commerce

liveEffective 2024-07-26NIST AI 600-1Updated September 2026

This companion to NIST AI RMF 1.0 addresses generative AI risks. It covers large language models and multimodal foundation models (general-purpose models that handle text, images, and audio).

Applies To

U.S. federal agencies following OMB AI guidanceFederal contractors and vendors providing generative AI solutions to U.S. government agenciesEnterprises developing or fine-tuning large language models or multimodal foundation modelsOrganisations deploying generative AI in customer-facing, employee-facing, or decision-support rolesAI risk, compliance, and legal functions responsible for model governance and documentationCybersecurity teams managing prompt injection, adversarial attack, and model integrity risksProcurement and third-party risk teams evaluating generative AI vendor risk

Overview

NIST AI 600-1, formally titled 'Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile,' was published in final form on July 26, 2024, in response to Executive Order 14110 on Safe, Secure, and Trustworthy Development and Use of Artificial Intelligence (October 2023). The profile extends the National Institute of Standards and Technology (NIST) AI Risk Management Framework (AI RMF 1.0, January 2023) by mapping its four core functions (GOVERN, MAP, MEASURE, and MANAGE) to twelve generative-AI-specific risk categories. These categories cover risks the base AI RMF does not fully address. Examples include confabulation (AI stating false information confidently), intellectual property, and information integrity. Others are homogenization of outputs (many systems giving similar answers) and dangerous capabilities with dual uses. NIST AI 600-1 is structured as a profile, a prioritised set of outcomes drawn from the AI RMF Core, rather than a standalone standard or regulation. It is intended for use by AI developers, deployers, and operators and does not favour any particular technology or vendor. The document was developed through an open public comment process and reflects input from industry, academia, civil society, and international partners. EO 14110 was revoked in January 2025, but the profile remains published and in use, including in federal AI guidance. While voluntary for private-sector organisations, the profile is increasingly referenced in federal procurement solicitations, sector-specific regulatory guidance, and enterprise AI governance programmes. Enterprises building, fine-tuning (further training on their own data), or deploying generative AI systems, including retrieval-augmented generation (RAG) architectures (AI that answers from company documents), copilot tools (built-in AI assistants), and AI-assisted decision systems, should map internal controls to the twelve risk categories and associated suggested actions.

Key Requirements

•CBRN Information or Capabilities: easier access to information that helps create chemical, biological, radiological, or nuclear weapons.
•Confabulation: confidently presenting false or made-up content as fact.
•Dangerous, Violent, or Hateful Content: easier production of violent, radicalizing, or threatening content, including encouragement of self-harm.
•Data Privacy: leaking, inferring, or misusing personal data, including sensitive data memorized during training.
•Environmental Impacts: the energy and resources used to train and run large models.
•Harmful Bias and Homogenization: amplifying bias, and many systems producing the same narrow outputs.
•Human-AI Configuration: over-reliance on AI, misplaced trust, and poorly designed human oversight.
•Information Integrity: generating or spreading misleading content and synthetic media at scale.
•Information Security: attacks on AI systems, such as prompt injection and data poisoning, and AI-assisted cyberattacks.
•Intellectual Property: using or reproducing copyrighted or protected material without permission.
•Obscene, Degrading, and/or Abusive Content: producing obscene or abusive imagery, including non-consensual intimate images.
•Value Chain and Component Integration: risks from third-party models, data, and components that are not fully visible to the deployer.

What Your Organization Must Do

→Map all generative AI systems currently in development or deployment to the twelve NIST AI 600-1 risk categories by assigning a responsible owner (e.g., AI risk lead or product owner) for each category and documenting gaps against the suggested actions in the profile.
→Update the enterprise AI governance policy to explicitly address generative AI risks, including hallucination thresholds, chemical, biological, radiological, and nuclear (CBRN) misuse safeguards, and content moderation standards, and present the revised policy to the board or risk committee for approval within 90 days of system deployment or profile adoption.
→Establish a confabulation and output quality monitoring programme with defined measurement cadences (at minimum quarterly), documented acceptable error rate thresholds, and a disclosure protocol for material confabulation incidents affecting end users or regulated decisions.
→Require all third-party generative AI vendors and foundation model providers to supply model cards and system cards (documents describing how a model was built, tested, and should be used) and documentation of where training data came from as a contractual condition of procurement; assign third-party risk management to review these against profile requirements before contract execution.
→Conduct a training data and output intellectual property review for any model being fine-tuned or deployed, engaging legal counsel to assess copyright exposure, and implement output filtering or attribution controls (blocking or crediting output that may copy protected work) where infringement risk is identified.
→Align internal generative AI security controls with the profile's information security requirements by tasking the cybersecurity team to test for prompt injection (hidden instructions that trick the AI), data poisoning (tampering with training data), and model extraction (copying a model through repeated queries) vulnerabilities on a defined schedule (at minimum annually or after significant model updates), and report findings to the AI risk governance function.

Playbook Guidance

Step-by-step implementation guidance for compliance teams.

07How do we handle AI-generated content and hallucinations?05How do we detect and mitigate algorithmic bias?06What does meaningful human oversight look like for high-risk AI decisions?12Is our training data compliant with global privacy laws?19How do we handle intellectual property and copyright in AI?

Governance Controls

Operational controls that implement requirements from this regulation.

AGT-001Agent Permission Boundaries AGT-002Agent Prompt Injection Defense AGT-004Multi-Agent Trust Hierarchy AGT-007Agent Scope and Task Boundaries AGT-009Agent and Non-Human Identity Management AGT-010Agent Knowledge Source Integrity AGT-011Agent Behavior Monitoring and Anomaly Detection AGT-012Agent Kill Switch and Emergency Stop AGT-016Agentic AI Deployment Readiness Assessment AGT-017Agentic Autonomy Expansion Criteria AGT-018Agent Data Modification Blast-Radius Containment AGT-019AI Tool and Plugin Supply Chain Risk Assessment AGT-020RAG Retrieval Boundary Controls for Regulated Data AGT-021Human Oversight Classification Rationale Log AGT-022Agentic AI Governance Tooling Attestation AGT-023Agentic AI Security Assessment, CBRN and Cyber Espionage AGT-024AI Permission Escalation Tabletop Exercise Program AGT-028Agent External System Access Boundaries BRD-001Director AI Literacy and Competency Assessment BRD-002AI Governance Committee Charter and Decision Rights BRD-005AI Governance Maturity Assessment BRD-006AI Risk Tolerance and Appetite Documentation BRD-008Voluntary AI Governance Adequacy Standard BRD-009Unified Multi-Framework AI Risk Register CMP-001Multi-Jurisdiction AI Regulatory Compliance Mapping CMP-002International AI Standards Monitoring Workflow CMP-008Federal AI Regulatory Monitoring and Pre-Deployment Vetting HOC-001AI System Risk Classification HOC-002Human Approval Gate for Consequential AI Decisions HOC-004Automation Bias Prevention MGV-001AI Model Preview and Staged Release Policy MGV-002AI System Intake and Approval Workflow MGV-003AI Governance Program Milestone Framework MGV-004Continuous AI Assurance Function Design MGV-005Generative AI Input Data Classification MGV-006RAI Benchmark-Aligned Evaluation Framework MGV-007Emerging AI Modality Classification and Governance Extension MGV-008AI-Generated Deliverable Disclosure and Citation Standards MGV-009AI Capability Claim Substantiation Standard MGV-010AI Output Pre-Publication Verification for High-Stakes Claims MON-003AI Bias and Fairness Monitoring PRC-003Third-Party AI Model Evaluation PRC-008Vendor Model Update Disclosure and Re-Assessment Protocol PRC-009AI Vendor Concentration Risk Assessment PRC-010AI Vendor Financial Stability Assessment PRC-011Federal AI Procurement Submission and Review Process PRC-012AI Safety Index and Benchmark Monitoring PRC-013AI Platform Conflict-of-Interest Assessment PRC-014Shadow AI and Third-Party Widget Inventory and Classification PRC-015Procurement-Stage AI Governance Conditions PRC-016AI Developer Tool Data Boundary Controls SAF-001Hallucination Detection and Mitigation SCT-001Anthropomorphic and Companion AI Safeguards SCT-002Clinical AI Governance Committee Charter SCT-004Insurance Sector AI Documentation Standards SCT-006Self-Hosted Open-Weight AI Model Governance SCT-007Consumer and External AI Tool Acceptable Use Policy SCT-009AI System Algorithm Register SEC-001Prompt Injection Prevention SEC-005Adversarial Robustness Testing SEC-006Deepfake Impersonation Defense for Approvals and Payments

Frequently Asked Questions

Is NIST AI 600-1 mandatory for private companies?: No. NIST AI 600-1 is voluntary for private-sector organizations. However, it is increasingly referenced in federal procurement solicitations, so companies selling generative AI solutions to U.S. government agencies may face contractual pressure to align with its requirements.
How does NIST AI 600-1 differ from the NIST AI RMF 1.0?: The AI RMF 1.0 is a general-purpose AI risk management framework. NIST AI 600-1 is a companion profile that applies its four functions to twelve risks specific to generative AI. Examples include confabulation, information integrity, and information security.
Which twelve risk categories does NIST AI 600-1 address?: The twelve risks are CBRN information or capabilities, confabulation, and dangerous, violent, or hateful content. They also include data privacy, environmental impacts, harmful bias and homogenization, and human-AI configuration. The rest are information integrity, information security, intellectual property, obscene, degrading, and/or abusive content, and value chain and component integration.
Do federal agencies have to comply with NIST AI 600-1?: The profile was written in response to Executive Order 14110, which was revoked in January 2025. It remains a voluntary NIST publication. Federal agencies follow current OMB guidance on AI, which may point to NIST resources such as this profile.
What does NIST AI 600-1 require for third-party generative AI vendors?: The profile calls for organizations to assess third-party model and component risks across the generative AI supply chain. In practice, this means requiring vendors to provide model cards, system cards, and training data provenance documentation, and reviewing those materials against profile requirements before contract execution.
How should a compliance team handle hallucination risk under NIST AI 600-1?: The profile suggests measuring and monitoring confabulation, validating outputs, and deciding in advance how to disclose material errors. It does not set a required measurement cadence. Quarterly measurement is a reasonable starting point for most deployments.
What does NIST AI 600-1 require for retrieval-augmented generation (RAG) systems?: The profile does not treat RAG as a separate risk category, but several categories apply directly. Confabulation controls should check that answers are grounded in the retrieved documents. Information Security covers prompt injection hidden in retrieved content. Value Chain and Component Integration covers third-party data sources and models behind the system.
What human oversight mechanisms does NIST AI 600-1 require for generative AI?: The Human-AI Configuration category calls for oversight matched to the risk of each application, not one fixed standard. Higher-risk uses, such as regulated decisions or vulnerable users, warrant more direct human review. In practice, document which outputs need human sign-off before use, and base that list on the cost of getting it wrong.
What does NIST AI 600-1 require for data provenance and training data lineage?: Data provenance is not one of the twelve risk categories, but it runs through the profile's suggested actions. They cover tracking where training data and generated content came from, especially for intellectual property, data privacy, and third-party components. For vendor models, ask for model cards and documentation of training data sources before signing.
How should compliance teams address prompt injection risk under NIST AI 600-1?: Prompt injection falls under the profile's Information Security category, alongside data poisoning and model extraction. The suggested actions call for testing against these attacks regularly and after significant model updates. Cover both direct injection by users and indirect injection through retrieved or ingested content.