NIST AI 600-1: Generative AI Profile
1. About the document
| Attribute | Value |
|---|---|
| Identifier | NIST AI 600-1 |
| Title | Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile |
| Published | July 2024 |
| Institution | US National Institute of Standards and Technology |
| Nature | A voluntary, cross-sector profile for managing generative AI risk |
| Relationship | A companion to NIST AI RMF 1.0, using GOVERN, MAP, MEASURE and MANAGE |
The profile was developed in the US policy context of 2024, including Executive Order 14110. That historical context does not make the profile binding EU law or establish a current legal duty for every organisation. Use the published NIST document as the source for its definitions and suggested actions.
2. Generative AI and foundation models
Generative AI produces synthetic content such as text, images, video or audio using patterns learned from data. A foundation model can be adapted to different downstream tasks; the relevant definition depends on the technical or legal context.
Do not use a general parameter-count rule to decide whether a model falls under the EU AI Act’s GPAI provisions. “Foundation model”, “dual-use foundation model”, “frontier AI” and “GPAI with systemic risk” belong to different contexts and are not interchangeable legal categories.
3. The 12 generative AI risk areas
The areas can overlap. Their relevance and severity depend on the use case, affected people, data, access and deployment scale. The profile does not assign a universal critical/high/medium rating to every area.
3.1 CBRN information or capabilities
AI can lower barriers to information or capabilities that could enable chemical, biological, radiological or nuclear harm. Assess the intended use, available tools, access controls and potential misuse.
3.2 Confabulation
Models can present false or misleading content with confidence. Assess factual accuracy, source verification and the consequences of errors. Fluent wording is not evidence of correctness.
3.3 Dangerous, violent or hateful content
Generative systems can facilitate harmful content and may be manipulated to bypass safeguards. Evaluate relevant misuse scenarios, content controls and response procedures.
3.4 Data privacy
Risks include exposure of personal data from training or use and inference of sensitive information. Consider the data lifecycle, processing conditions, access and applicable rights.
3.5 Environmental impacts
Training and inference consume resources. Impacts depend on the model, infrastructure, workload, location and measurement boundary; broad comparisons require supporting data.
3.6 Harmful bias and homogenisation
Outputs can reproduce stereotypes, perform unequally across groups or become excessively uniform. Evaluate representative populations, languages and contexts, and consider the consequences of widespread dependence on similar models.
3.7 Human–AI configuration
Interactions can encourage overreliance, unwarranted distrust, anthropomorphism or unsuitable dependence. Design the interface, oversight and user education around the system’s role and limitations.
3.8 Information integrity
Synthetic content can support misinformation, disinformation and fabricated evidence. Consider verification, provenance, appropriate disclosure and the limits of detection tools.
3.9 Information security
Generative AI can assist attackers and itself be attacked. Relevant issues include prompt injection, data poisoning, extraction and the permissions of connected tools. Security controls must extend beyond prompt wording.
3.10 Intellectual property
Inputs or outputs may raise copyright and other rights issues, including reproduction of protected material. Review permissions, licences, supplier terms and intended publication or commercial use.
3.11 Obscene, degrading or abusive content
This area includes child sexual abuse material and non-consensual intimate imagery. Define strict use restrictions, safeguards and lawful reporting and response processes appropriate to the organisation’s role and jurisdiction.
3.12 Value chain and component integration
Models, datasets, libraries and external services introduce dependencies. Assess provenance, documentation, vulnerabilities, change management and the ability to replace components.
The risk areas connect with several characteristics of trustworthy AI. Avoid treating any one-to-one mapping as complete: for example, a privacy failure can also affect safety, accountability and security.
4. Turning suggested actions into work
Use the profile’s actions selectively, with a documented reason and owner. Consult the original document before citing an action identifier; this guide does not invent identifiers for its examples.
| Function | Example work |
|---|---|
| GOVERN | Define responsibilities, acceptable use, supplier oversight and criteria for stopping unsafe development or operation |
| MAP | Describe the purpose, stakeholders, dependencies and relevant generative AI risk scenarios |
| MEASURE | Evaluate task performance, harmful bias, robustness and safeguards using justified methods and evidence |
| MANAGE | Prioritise findings, implement controls, manage incidents and reassess after changes |
For every chosen action, record the system and version, purpose, evidence, responsible person, decision and review trigger. The implementation guide provides detailed scenarios and example controls for all 12 areas.
5. Connections with the EU AI Act
These are thematic relationships. NIST risk areas are not the AI Act’s legal classification. Assess role, scope and application date separately.
| Profile topic | Possible AI Act connection | Boundary |
|---|---|---|
| Risk identification | Article 6 and Annexes I and III | Determine high-risk status from the specific product or use case; the 12 NIST areas do not classify it |
| Governance and risk management | Articles 9, 16 and 17 | Primarily obligations concerning high-risk systems and their providers |
| Pre-deployment testing | Articles 9 and 15; Article 55(1)(a) for GPAI models with systemic risk | Articles 9 and 15 concern high-risk AI systems. Providers of GPAI models with systemic risk have separate model evaluation duties, including documented adversarial testing, under Article 55(1)(a) |
| Content provenance | Article 50 | Obligations depend on the interaction, content and relevant actor |
| Human oversight | Article 14 | For high-risk AI systems: effective oversight requires suitable design, authority and operation; deployer obligations are also addressed in Article 26(2) |
| Serious incidents | Article 73; Article 55(1)(c) | Article 73 concerns providers of high-risk AI systems. Providers of GPAI models with systemic risk separately report under Article 55(1)(c) to the AI Office and, as appropriate, national competent authorities without undue delay. Assess the respective incident conditions and application dates |
A completed NIST checklist is neither AI Act certification nor a substitute for technical documentation, contracts, legal analysis or any required conformity assessment.