NIST AI 600-1: Generative AI Profile

As enterprises race to adopt generative AI, boards, regulators, and auditors are asking a harder question about how to prove the technology is being used safely. NIST AI 600-1, the Generative AI Profile, has become the reference point many enterprises reach for first, offering a shared vocabulary and a structured set of actions for managing generative AI risk at scale.

Even though the profile is voluntary, in practice it rarely feels that way. The same boards, auditors, and counterparties that ask how AI is being used safely now expect operational evidence to back up the answer, including live inventories, testing records, runtime controls, and audit trails. 

Enterprises that can only point to written policy struggle in those conversations. The real work of NIST AI 600-1 happens in the controls that enforce it day to day. 

This article explains what NIST AI 600-1 covers, walks through its twelve risks and four functions, and shows how to operationalize each across human employees, AI applications, and autonomous agents.

Key takeaways

• NIST AI 600-1 adapts the voluntary AI Risk Management Framework for generative AI, organizing more than 200 suggested actions around twelve documented risks and the MAP, GOVERN, MEASURE, and MANAGE functions.
• A practical rollout typically starts with discovery and progresses through governance, testing, and runtime enforcement, moving from a live AI inventory to intent-based policies, continuous testing, runtime controls, and retained audit trails.
• Autonomous agents require controls beyond the profile’s partial coverage, including MCP visibility, policy checks, tool-call protection, and attribution of agent actions to human identities.
• Audit-ready alignment depends on connecting every selected action to accountable owners and reviewable artifacts, supported by operational tooling that can discover AI use, enforce policy, apply guardrails, and record decisions.

What is NIST AI 600-1?

NIST AI 600-1 is NIST’s generative AI profile for the AI Risk Management Framework. It documents twelve risks specific to generative AI and pairs them with more than 200 suggested actions, organized by the framework’s four functions. 

Its full title is Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile, and NIST published the final version on July 26, 2024 under Executive Order 14110. NIST positions it as a cross-sectoral companion to the AI Risk Management Framework (AI RMF 1.0) tailored to generative AI, intended for voluntary use.

A NIST profile adapts the framework to a technology or sector rather than to an individual company, and this one applies the four functions to generative AI: 

• GOVERN. Assigns accountability and defines how the organization oversees the AI lifecycle.
• MAP. Establishes context and identifies risks for a specific system.
• MEASURE. Uses testing to analyze and benchmark those risks.
• MANAGE. Directs resources toward treating them and responding to incidents.

Each suggested action carries an ID tied to an RMF subcategory, so GV-1.1-001 is the first action under Govern 1.1. Those IDs let you attach a named owner and an evidence artifact to each action, which is what an auditor asks to see. The first version leans heaviest on Governance and Content Provenance.

The profile doesn’t replace the underlying AI RMF 1.0, released in January 2023. Organizations still implement the full framework, and NIST AI 600-1 adds a generative AI layer on top.

The twelve generative AI risks in NIST AI 600-1

NIST AI 600-1 catalogs twelve documented risks “novel to or exacerbated by” generative AI. NIST limits the list to risks with an existing empirical evidence base and excludes speculative future harms.

The twelve sort into three groups depending on whether the risk originates in the model itself, in how people use it, or in the wider ecosystem around it. One risk, data privacy, belongs to all three.

Technical and model risks

These four risks surface even when every employee follows policy, which puts the burden on testing and runtime controls rather than on user training. They come from model behavior, generated content, and component dependencies, not from anyone’s intent.

1. Confabulation. Output that sounds confident but is factually wrong. NIST prefers this term over “hallucination.”
2. Dangerous, Violent, or Hateful Content. Lowered effort required to generate violent, inciting, or radicalizing material at volume.
3. Harmful Bias and Homogenization. Discriminatory outputs, plus a narrowing of results toward a single dominant style or viewpoint as models train on model-generated text.
4. Value Chain and Component Integration. Risk inherited from third-party training data, pre-trained models, and embedded components you cannot inspect.

The first of these has already produced legal liability. A British Columbia tribunal held Air Canada liable after its chatbot invented a bereavement fare policy, ordering CAN$812.02 in damages and tribunal fees. The award was small, but the decision offered a documented example of potential liability for chatbot output.

Misuse by humans

This group is where day-to-day enterprise exposure tends to concentrate, because nothing in the system malfunctions and only the user’s intent turns an output into a problem. These five depend on what someone chooses to do with a model working as designed.

1. CBRN Information or Capabilities. Easier access to chemical, biological, radiological, or nuclear weapons information.
2. Information Integrity. Cheap production of convincing misinformation, disinformation, and synthetic media.
3. Information Security. An expanded attack surface that includes patterns such as prompt injection attacks.
4. Obscene, Degrading, and/or Abusive Content. Synthetic sexual imagery of real people, including non-consensual intimate imagery.
5. Human-AI Configuration. Overreliance, automation bias, and misuse that follow from how people are set up to interact with a system.

These five are what an acceptable-use policy exists to address, which makes them the group most dependent on enforcement at the moment of use.

Ecosystem and societal risks

These two are the easiest to deprioritize and the hardest to unwind later, because vendor and model selection settles most of the exposure before anything ships. They sit outside any single deployment and accumulate across the market.

1. Environmental Impacts. Energy and water consumed by training runs and by inference at scale.
2. Intellectual Property. Training on or reproducing copyrighted and licensed material.

Neither is controlled at runtime, so ownership for both tends to land with procurement and legal rather than with the security team.

Data privacy spans all three groups

Data privacy is the twelfth risk and the only one that belongs in all three groups, because privacy exposure can arise from model behavior, from how employees use a tool, and from the wider ecosystem at the same time. A single prompt containing customer records can trigger all three at once.

Naming the risks is the easy part. The harder question is what happens when written policy has to become operational control.

How to put NIST AI 600-1 into practice

NIST AI 600-1’s suggested actions map onto the four RMF functions. The sequence below follows MAP, GOVERN, MEASURE, and MANAGE, anchoring one operational move to each.

1. Build a live AI inventory (MAP)

Start with a network-derived live AI inventory. The profile recommends adjusting risk controls based on the type of model in use, whether foundation, fine-tuned, or embedded within another tool. Applying those controls is difficult without knowing which types exist.

For many enterprises, effective discovery extends beyond browsers to include native applications, integrated development environments (IDEs), agents, and Model Context Protocol (MCP) servers. 

2. Govern usage with intent-based policies (GOVERN)

Acceptable-use policies carry weight mainly when they can be enforced at the moment of use. Binary allow/block approaches are often too coarse for enterprise AI governance, particularly when organizations need more granular policy enforcement.

An intent-based approach evaluates what a prompt is trying to do. It can help organizations enforce governance policies closer to the point of AI use, which is one of the profile’s core governance themes.

Half of U.S. workers say they use AI at work without knowing whether it is allowed, and 44% knowingly use it improperly. Graduated enforcement can allow legitimate work, warn on risky behavior, and block clear violations. It can also route sensitive queries to approved internal models. This keeps approved work moving while applying the required controls.

3. Test continuously, before and after deployment (MEASURE)

Pre-deployment testing shouldn’t end at launch. Action MS-4.2-001 recommends running AI adversarial testing on a regular cadence, and MS-4.2-002 asks organizations to evaluate system behavior in real operating conditions to surface issues that controlled testing misses. A one-time pre-deployment exercise wouldn’t address either recommendation.

4. Enforce at runtime and keep the evidence (MANAGE)

Runtime controls appear explicitly in NIST AI 600-1. Action MG-3.1-001 names “filtering GAI [generative AI] input and outputs” as a control for third-party AI resources. GV-1.5-003 asks for a document retention policy that keeps testing, evaluation, validation, and verification history for generative AI. 

Many organizations operationalize these controls by inspecting prompts and responses inline through AI enforcement technologies, alongside audit trails that attribute activity to users or agents.

Collecting evidence for these controls requires visibility into the AI activity they govern.

Common NIST AI 600-1 implementation challenges

Anticipating these problems costs less than meeting them during an audit, since each one decides whether you can produce evidence on demand. AI adoption often outpaces governance, and four recur:

• Limited usage visibility. In a Gartner survey of 302 cybersecurity leaders, 69% of organizations suspect or have evidence that employees use prohibited public generative AI, and Gartner projects more than 40% of enterprises will experience a Shadow AI-related security or compliance incident by 2030. That makes the live inventory in step 1 the precondition for everything after it.
• Low confidence in existing controls. Only 23% of IT leaders are very confident in their organization’s ability to manage security and governance when deploying generative AI, so reviewers asking for operating evidence often find little to review.
• Unclear response readiness. 56% of digital trust professionals don’t know how fast their organization could shut down an AI system after a security incident, which leaves step 4 without a documented procedure to point to.
• Agent activity outside the profile’s scope. Agentic AI security adds another layer, because agents act through tools and connected systems rather than only generating content. The Cloud Security Alliance notes that control-plane attacks, including prompt injection delivered through tool outputs and malicious tools registered in agent tool registries, have “no representation” in NIST AI 600-1.

The profile supplies the vocabulary and the actions. You build the enforcement layer that produces the evidence a board or auditor can review, and that starts with visibility into the AI activity it governs.

From visibility to enforcement across AI activity

Turning NIST AI 600-1 into operational controls starts with closing the visibility gap. Many organizations face an AI visibility gap, which often makes the MEASURE function significantly harder to operationalize.. 

WitnessAI is the confidence layer for enterprise AI, providing a unified AI security and governance platform. It translates the profile’s written actions into operational controls that work across human employees and AI agents. 

• Network-level discovery and monitoring. The WitnessAI Observe module provides network-level visibility into AI usage, including thousands of AI applications, while extending visibility beyond browsers into native applications and emerging agent ecosystems.. This catalog produces the live inventory MAP assumes and gives you an operational evidence base for MEASURE.
• Intent-based policy enforcement. The WitnessAI Control module applies context-aware rules to activity routed through the platform, allowing legitimate work, warning users on risky behavior, blocking clear violations, or routing sensitive queries to approved models.
• Runtime guardrails. AI runtime guardrails inspect prompts and responses routed through the platform and provide runtime protection against threats such as prompt injection and jailbreak attacks as a complement to existing network security controls.

Used together, these capabilities connect NIST AI 600-1’s governance vocabulary to observable and enforceable controls.

Turning NIST AI 600-1 alignment into audit-ready evidence

NIST AI 600-1 gives an AI steering committee a shared vocabulary for generative AI risk, and this vocabulary can align security, legal, compliance, and risk owners.

To turn it into audit-ready AI evidence, tie each selected action to an owner and evidence source. Define its review cadence and retained artifact. The resulting evidence package can combine the live AI inventory with pre- and post-deployment test results. It can also include policy decisions and identity-attributed runtime events that show what was allowed or blocked.

Boards and auditors then have a reviewable record of how your organization governs generative AI under NIST AI 600-1. Schedule a demo today to see what evidence of AI control your organization can produce when a board or auditor asks.