NIST AI 600-1 Generative AI ProfileSupported in OneClickComply

Manage generative AI risk with NIST AI 600-1, step by step

NIST AI 600-1 is the Generative AI Profile, a voluntary companion to the NIST AI Risk Management Framework (AI RMF 1.0) that applies the framework specifically to generative AI. Published by NIST in July 2024, it describes 12 risks that generative AI creates or makes worse, such as confabulation, data privacy and information security, and lists 212 suggested actions mapped to AI RMF subcategories. It is guidance, not a certifiable standard.

See the NIST AI 600-1 requirements

NIST AI 600-1 Aligned

Automated Evidence

OneClickFix Enabled

Continuous Monitoring

In-House Audit Team

Who needs NIST AI 600-1

Is NIST AI 600-1 right for your organisation?

NIST AI 600-1 is for any organisation that develops, fine-tunes, deploys or procures generative AI, from foundation model developers to companies adding a chatbot or copilot to their product. It is most useful when you already use, or plan to adopt, the NIST AI RMF and need concrete actions for generative AI. Enterprise customers and US public sector buyers increasingly ask suppliers how they manage generative AI risk, and this profile gives a recognised answer.

Adopting it is voluntary, though customers and auditors often expect it.

Issued by: National Institute of Standards and Technology (NIST), US Department of Commerce
Published: July 2024
Full title: Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile
Builds on: NIST AI RMF 1.0 (January 2023)
Structure: 12 GAI risks and 212 suggested actions across 49 AI RMF subcategories
Status: Voluntary guidance
Certification route: None: there is no NIST certification; organisations self-assess or use independent assurance
Type: Guidance (voluntary)
Region: United States, US
In OneClickComply: Supported today

How we help

OneClickComply makes it simple

NIST AI 600-1 is mapped in OneClickComply's control library and is available on request. We link its suggested actions to controls you may already run for ISO 42001, ISO 27001 or the NIST AI RMF, so evidence such as AI system inventories, third-party model reviews, incident response records and access controls is collected once and reused. Our risk register, vendor risk management and Ask an Auditor service help you record generative AI risks against the 12 risk areas and decide which actions apply to you.

Requirements covered

12 generative AI risk areas in Section 2 and 212 suggested actions in Section 3, organised under 49 AI RMF subcategories across the Govern, Map, Measure and Manage functions.

Already working towards another framework?

ISO 270018% of NIST AI 600-1 overlaps
SOC 232% of NIST AI 600-1 overlaps
NIST CSF18% of NIST AI 600-1 overlaps
GDPR4% of NIST AI 600-1 overlaps

Evidence you collect once counts towards every framework it applies to.

Manual NIST AI 600-1 vs. OneClickComply

Manual NIST AI 600-1

Reading 212 suggested actions and working out which apply to you
Tracking generative AI risks in scattered spreadsheets
Chasing evidence for AI governance, testing and incident handling
Duplicating work already done for ISO 27001 or ISO 42001
Answering customer questions on AI risk with no single source of truth

With OneClickComply

Suggested actions linked to controls so you can see what applies
One risk register structured around the 12 generative AI risks
Evidence collected automatically from connected tools
Control mapping reuses evidence across ISO 27001, ISO 42001 and NIST AI RMF
Trust centre and questionnaire automation to answer AI risk questions

Capabilities

Everything you need for NIST AI 600-1

NIST AI 600-1 suggested actions mapped to your existing controls

AI system and third-party model inventory kept as audit evidence

Risk register entries organised by the 12 generative AI risk areas

Vendor risk reviews for model providers and AI suppliers

AutoComplete policies for AI use, governance and incident response

Continuous monitoring of the security controls around your AI stack

How it works

Three steps to NIST AI 600-1 compliance

Connect & scan

Connect your cloud, identity and SaaS tools. OneClickComply checks them against NIST AI 600-1 and shows you exactly where you stand.

Fix & generate

OneClickFix remediates technical gaps in one click, and AutoComplete generates NIST AI 600-1-aligned policies from your real environment.

Monitor & evidence

Continuous monitoring keeps you compliant, and our in-house audit team is on hand when you need expert guidance.

Requirements

NIST AI 600-1 Generative AI Profile requirements

The 12 generative AI risk areas from Section 2, followed by the 49 AI RMF subcategories that carry the profile's 212 suggested actions (titles are short summaries of each subcategory).

Reference	Requirement
Risk 2.1	GAI risk: CBRN Information or Capabilities
Risk 2.2	GAI risk: Confabulation
Risk 2.3	GAI risk: Dangerous, Violent, or Hateful Content
Risk 2.4	GAI risk: Data Privacy
Risk 2.5	GAI risk: Environmental Impacts
Risk 2.6	GAI risk: Harmful Bias and Homogenization
Risk 2.7	GAI risk: Human-AI Configuration
Risk 2.8	GAI risk: Information Integrity
Risk 2.9	GAI risk: Information Security
Risk 2.10	GAI risk: Intellectual Property
Risk 2.11	GAI risk: Obscene, Degrading, and/or Abusive Content
Risk 2.12	GAI risk: Value Chain and Component Integration
GOVERN 1.1	Legal and regulatory requirements for AI are understood and documented
GOVERN 1.2	Trustworthy AI characteristics integrated into policies and practices
GOVERN 1.3	Level of risk management matched to organisational risk tolerance
GOVERN 1.4	Transparent risk management policies, procedures and controls
GOVERN 1.5	Ongoing monitoring and periodic review of risk management
GOVERN 1.6	Inventory of AI systems
GOVERN 1.7	Safe decommissioning and phasing out of AI systems
GOVERN 2.1	Documented roles, responsibilities and lines of communication for AI risk
GOVERN 3.2	Roles for human-AI configurations and oversight of AI systems
GOVERN 4.1	Critical thinking and safety-first culture in AI design and use
GOVERN 4.2	Teams document and communicate AI risks and impacts
GOVERN 4.3	Practices enabling AI testing, incident identification and information sharing
GOVERN 5.1	Collecting and integrating external feedback on AI impacts
GOVERN 6.1	Policies for third-party AI risks, including intellectual property infringement
GOVERN 6.2	Contingency processes for failures in high-risk third-party data or AI systems
MAP 1.1	Intended purposes, context, laws and deployment settings documented
MAP 1.2	Interdisciplinary and diverse AI actors involved in establishing context
MAP 2.1	Tasks and methods the AI system supports are defined
MAP 2.2	Knowledge limits and human oversight of outputs documented
MAP 2.3	Scientific integrity and TEVV considerations identified
MAP 3.4	Operator and practitioner proficiency defined and assessed
MAP 4.1	Mapping technology and legal risks of components, including third-party data and software
MAP 5.1	Likelihood and magnitude of each identified impact documented
MAP 5.2	Regular engagement with AI actors and integration of impact feedback
MEASURE 1.1	Approaches and metrics selected for the most significant AI risks
MEASURE 1.3	Independent assessors and domain experts involved in assessments
MEASURE 2.2	Evaluations involving human subjects meet protection requirements
MEASURE 2.3	Performance and assurance criteria measured for deployment-like conditions
MEASURE 2.5	System demonstrated to be valid and reliable
MEASURE 2.6	Regular evaluation of safety risks and ability to fail safely
MEASURE 2.7	Security and resilience evaluated and documented
MEASURE 2.8	Transparency and accountability risks examined
MEASURE 2.9	Model explained, validated and outputs interpreted in context
MEASURE 2.10	Privacy risk examined and documented
MEASURE 2.11	Fairness and bias evaluated
MEASURE 2.12	Environmental impact and sustainability assessed
MEASURE 2.13	Effectiveness of TEVV metrics and processes evaluated
MEASURE 3.2	Risk tracking where measurement techniques are not yet available
MEASURE 3.3	End user feedback, problem reporting and appeals integrated into evaluation
MEASURE 4.2	Trustworthiness results in deployment validated with domain experts
MANAGE 1.3	Responses to high-priority AI risks planned and documented
MANAGE 2.2	Mechanisms to sustain the value of deployed AI systems
MANAGE 2.3	Responding to and recovering from previously unknown risks
MANAGE 2.4	Ability to supersede, disengage or deactivate AI systems
MANAGE 3.1	Monitoring risks and benefits of third-party resources
MANAGE 3.2	Monitoring pre-trained models used in development
MANAGE 4.1	Post-deployment monitoring plans, including incident response and change management
MANAGE 4.2	Continual improvement integrated into AI system updates
MANAGE 4.3	Incidents and errors communicated, tracked and recovered from

Always check the official NIST AI 600-1 text for the exact wording.

NIST AI 600-1 FAQs

What is NIST AI 600-1?

NIST AI 600-1 is the Generative AI Profile of the NIST AI Risk Management Framework, published by the US National Institute of Standards and Technology in July 2024. It explains how to apply the AI RMF to generative AI by describing 12 risks that generative AI creates or makes worse and listing 212 suggested actions, each tied to an AI RMF subcategory under the Govern, Map, Measure and Manage functions.

Is NIST AI 600-1 mandatory?

No. NIST AI 600-1 is voluntary guidance, like the AI RMF it builds on, and there are no penalties for not following it. However, customers, investors and public sector buyers may ask suppliers to show how they manage generative AI risk, and some contracts or internal policies reference NIST AI guidance, which can make alignment a practical expectation rather than a legal one.

What are the 12 risks in the NIST Generative AI Profile?

The 12 risks are CBRN information or capabilities; confabulation; dangerous, violent or hateful content; data privacy; environmental impacts; harmful bias and homogenization; human-AI configuration; information integrity; information security; intellectual property; obscene, degrading or abusive content; and value chain and component integration. Each suggested action in the profile is tagged with the risks it helps address.

How does NIST AI 600-1 relate to the NIST AI RMF?

NIST AI 600-1 is a profile of the NIST AI RMF 1.0, not a separate framework. The AI RMF sets out general functions, categories and subcategories for managing any AI risk. The Generative AI Profile applies them to generative AI, adding suggested actions under 49 of the AI RMF subcategories. Most organisations use the two together, with the profile supplying the generative AI specifics.

Can you get certified against NIST AI 600-1?

No. NIST does not offer certification against NIST AI 600-1 or the AI RMF. Organisations self-assess, document how they follow the suggested actions, and may ask an independent party for assurance. If you need a certifiable AI management system, ISO/IEC 42001 is the usual route, and much of the governance work for NIST AI 600-1 can support it.

How does NIST AI 600-1 relate to ISO 27001 and ISO 42001?

NIST AI 600-1 overlaps with both. Its information security, third-party, incident response and data privacy actions align with ISO 27001 controls, while its governance, impact assessment and lifecycle actions align with ISO/IEC 42001. Mapping the profile to controls you already operate lets you reuse evidence rather than starting again for generative AI.

How do you implement the NIST Generative AI Profile?

Start by inventorying the generative AI systems you build or use and the third-party models behind them. Then assess which of the 12 risks apply, select the relevant suggested actions, assign owners and record decisions in a risk register. NIST notes that not every action applies to every organisation, so prioritise by your role, use cases and risk tolerance, and review regularly.

Does OneClickComply support NIST AI 600-1?

NIST AI 600-1 is mapped in OneClickComply's control library and is available on request. Its suggested actions are linked to controls shared with frameworks such as ISO 27001, ISO 42001 and the NIST AI RMF, so evidence collected once can count towards each. Contact us to enable it for your organisation and get guidance from our in-house audit team.

Related standards

All standards

Get NIST AI 600-1 ready, not stressed

Automate controls, gather evidence continuously and stay audit-ready, all on one platform.