NIST AI 600-1: the Generative AI Profile, explained

NIST published the AI Risk Management Framework (AI RMF 1.0, NIST AI 100-1) on 26 January 2023 as a voluntary, four-function structure — Govern, Map, Measure, Manage — for managing AI risk generally. Executive Order 14110 on Safe, Secure, and Trustworthy Artificial Intelligence, issued 30 October 2023, directed the Secretary of Commerce, acting through NIST, to produce a companion resource addressing generative AI specifically; NIST AI 600-1 is that resource, published 26 July 2024. A Profile, in NIST's own terminology, is an implementation of the AI RMF's functions, categories and subcategories tailored to a specific setting, application or technology — because generative AI isn't confined to one sector, NIST built this one as a cross-sectoral profile rather than a narrower use-case profile. NIST's own description of its purpose: "the profile can help organizations identify unique risks posed by generative AI and proposes actions for generative AI risk management that best aligns with their goals and priorities." Critically, the Profile is additive, not a replacement — an organization using it is still expected to address the base AI RMF's general risks alongside the generative-AI-specific ones it adds.

The Profile organizes generative-AI-specific risk into 12 named categories. This guide's tooling could not render the primary PDF's extractable text, so the summaries below are drawn from widely corroborated secondary sources that quote the published NIST text directly; treat exact wording as to be confirmed against the primary document for a compliance use.

Twelve is the final, published count. An earlier initial public draft used a 13-category structure that NIST consolidated before the final July 2024 release — a detail worth knowing if an older summary or draft-based tool references 13 risks instead of 12.

The Profile's actual operative content is a large catalogue of suggested actions, not prose. Corroborated secondary sources consistently describe 212 suggested actions in the final text, each tied to one of the AI RMF's four core functions (Govern, Map, Measure, Manage) via an action ID in the same GV/MP/MS/MG-subcategory format the base AI RMF uses, and each tagged by the type of AI actor it applies to — developer, deployer, or end user. In practice this makes the Profile a menu rather than a single checklist: an organization is meant to select the actions that match its actual role in the generative AI value chain (training a model, deploying a third-party model inside a product, or simply using a generative AI tool) and its own risk tolerance, the same non-mandatory framing NIST applies to the base AI RMF's own actions.

NIST AI 600-1 was never mandatory for anyone outside the U.S. federal government, and that hasn't changed. What has changed is the federal policy scaffolding originally built around it:

• Executive Order 14110 (the order that directed NIST to write the Profile) was revoked in January 2025. NIST has not withdrawn NIST AI 600-1 in response — the publication remains published and voluntary, independent of the order that originally commissioned it.
• OMB Memorandum M-24-10 (finalized 28 March 2024) had directed federal agencies to apply AI RMF-aligned minimum risk-management practices to AI systems presumed safety- or rights-impacting, naming the Generative AI Profile as the specific reference for agencies' generative AI risk assessments. M-24-10 has since been rescinded and replaced by newer OMB guidance (M-25-21 and a companion M-25-22).

Outside federal agencies, the Profile's influence has always worked the same way the base AI RMF's does — voluntary adoption, procurement requirements that reference NIST AI RMF alignment, and a small but growing number of state AI laws that cite it as a benchmark — rather than through direct legal force tied to the Profile document itself. One substantive, independently documented gap: the Profile has no risk category that squarely addresses autonomous-agent action — the risk of an AI agent taking an irreversible action based on flawed reasoning, or one agent's action cascading through a connected system. That gap is part of why separate "agentic AI" risk profiles have begun appearing from other organizations, rather than from a NIST revision to AI 600-1 itself; treat those as a distinct, newer body of guidance, not an official NIST update.

A product that calls out to a cloud generative model, embeds a smaller on-device model, or exposes a chat-style feature through firmware inherits generative-AI-specific risk on top of its conventional firmware risk — and the Information Security category above (new attack surfaces, including prompt injection, plus the model's own attack surface) is the one that most directly overlaps with the kind of analysis SoftWSP already runs. Teams already scoping an MCP integration (see our MCP server security guide) or mapping conventional application risk against the OWASP Top 10 for LLM Applications can use the Profile's Information Security actions as a more detailed, GAI-specific supplement to those existing checklists, selected for their own role (most device makers are deployers of a third-party model rather than its trainer, which narrows which actions actually apply). SoftWSP's device and firmware security work can help scope where an embedded or connected generative AI feature introduces its own risk surface alongside the rest of a product's firmware: see device & firmware security services.

This guide summarizes a public NIST publication via its own stated purpose and corroborated secondary sources quoting its published text, since this guide's fetch tooling could not render the primary PDF's text layer; treat granular wording of the 12 risk categories and the 212 actions as to be confirmed against the primary NIST AI 600-1 document (DOI: 10.6028/NIST.AI.600-1) before a compliance use. It does not constitute legal or compliance advice.