United States (federal) · voluntary framework
NIST AI 600-1 GenAI Profile: what it asks, and the records to keep
A cross-sector profile of the AI RMF for generative AI that defines 12 risks unique to or worsened by generative AI and lists about 200 suggested actions mapped to AI RMF subcategories. It gives teams a concrete checklist vocabulary for issues like confabulation, information integrity, and value-chain risk from third-party models.
01 / What it asks
What NIST AI 600-1 GenAI Profile asks
Organizations that design, develop, deploy or use generative AI systems and choose to apply the AI RMF to them.
- 01Identify which of the 12 generative AI risks apply, e.g. confabulation, data privacy, information security, value chain integration.
- 02Apply suggested GOVERN actions, such as policies for generative AI use, incident disclosure and third-party model oversight.
- 03Map generative AI use context, data provenance and component dependencies (MAP actions).
- 04Run pre-deployment testing, red-teaming and ongoing evaluation of generative AI outputs (MEASURE actions).
- 05Track content provenance, monitor deployed systems and respond to incidents (MANAGE actions).
02 / AI work
Where it touches AI work
AI-specific. It addresses generative models such as large language models and image generators, and their supply chains.
03 / Dates
The dates that matter
EO 14110 directs NIST to produce generative AI guidance
NIST publishes AI 600-1 final
EO 14110 rescinded; profile remains published
AI Action Plan directs revision of the parent AI RMF
04 / Enforcement
Who enforces it
None; voluntary.
05 / Records
Records an organisation keeps
What an auditor or an inquiry usually asks to see. Your obligations depend on your role and your facts.
- 01Generative AI risk assessment against the 12 profile risks
- 02Red-team and pre-deployment test results
- 03Content provenance and output monitoring records
- 04Generative AI incident log and disclosure records
Optional evidence · where Planisphere fits
Keep a record anyone can check
When your team meets a duty, Planisphere can seal the event it reports as a receipt.
A disclosure shown, a review signed, a model change approved: the event your system reports.
The event becomes a sealed receipt, dated and attributed to whoever is signed in.
Paste the receipt into Verify. No account or key.
A record supports your compliance evidence process. It is not a legal finding or a certification. Systems that call Planisphere's gate API can also hold or refuse an action before it runs.
SOURCES
Go back to the source
National Institute of Standards and Technology
National Institute of Standards and Technology
The White House
CHANGE LOG
What changed, and when
Rebuilt from primary sources; facts checked on this date.
Related: NIST AI 600-1 GenAI Profile for defense AI workflows · NIST AI RMF · OMB M-25-21/22 · DoW RAI S&IP · EO 14179 · FIPS 140-3 · SHA-256 / FIPS 180-4