NIST AI 600-1 (July 2024): The Generative AI Risk Profile Every Builder Now Inherits

Incident summary

On July 26, 2024, NIST published AI 600-1: Artificial Intelligence Risk Management Framework, Generative Artificial Intelligence Profile. The publication was directed by Executive Order 14110 (October 30, 2023) and extends the parent NIST AI 100-1 Risk Management Framework with generative-AI-specific content. The profile is the first federal document to enumerate, name, and structure risk categories that previously circulated under varied vocabulary across the industry.

The publication identifies twelve risk categories. The named taxonomy is CBRN information (chemical, biological, radiological, nuclear); confabulation; dangerous, violent, or hateful content; data privacy; environmental impacts; harmful bias and homogenization; human-AI configuration; information integrity; information security; intellectual property; obscene, degrading, or abusive content; and value chain and component integration. Each category is defined, illustrated with examples, and mapped to suggested actions under the four AI RMF functions.

AI 600-1 is voluntary at the federal level but functions as a working baseline for regulated industries, federal contractors, and any enterprise operating under state AI laws that reference NIST. Colorado AI Act, California's generative-AI laws, and the EU AI Act all reference NIST framing in some form, which makes AI 600-1 the practical reference for compliance teams even where it is not directly mandated.

Failure technique

NIST AI 600-1 is not an incident in the failure-mode sense. It is the publication that names the failure modes practitioners had been describing in inconsistent vocabulary. Before AI 600-1, terms such as hallucination, jailbreak, prompt injection, and bias were used loosely. The profile fixes vocabulary and ties each named risk to actions a team can take during GOVERN, MAP, MEASURE, and MANAGE phases.

The risk taxonomy reflects what frontier labs and AI safety practitioners had been reporting in the public record. CBRN information risks emerged from the testing literature on whether large language models reduce the difficulty of producing weapons of mass destruction. Confabulation, a term NIST chose deliberately over the colloquial 'hallucination,' was tied to the cognitive-science term and clarified that the model is constructing plausible content rather than reporting facts. The vocabulary stabilization is the operational contribution.

The profile does not prescribe specific control implementations. It enumerates suggested actions and leaves implementation choice to the team. This design choice is intentional: NIST is producing a framework that fits regulated and unregulated industries alike, not a control catalog like NIST SP 800-53.

Impact and consequences

Direct compliance impact is concentrated in federal contractors and regulated industries. Several federal agencies have begun citing AI 600-1 in procurement language. State AI laws and enforcement guidance increasingly reference NIST framing, and AI governance teams at large enterprises now produce risk registers indexed against the twelve named categories.

Industry impact is the vocabulary stabilization itself. Risk registers, model cards, and incident-response playbooks now use the AI 600-1 names. Cross-team conversations between AI engineering, AI safety, AI governance, and AI compliance are faster because everyone refers to the same taxonomy.

Engineering impact is in the MEASURE function. The profile lists specific evaluation activities under MEASURE-2 that AI engineering teams now build into eval harnesses: red-team testing for the named categories, monitoring for drift in named risk categories, and documented evidence retention. Teams that wrote eval suites before AI 600-1 are retrofitting them to align.

Lessons for builders

Adopt the AI 600-1 risk vocabulary in internal documentation. Even if your industry is not federally regulated, the taxonomy is now the dominant working vocabulary across AI governance roles. Internal documents that use the same names are easier to audit and easier to hand off across teams.

Map your existing risk register to the AI 600-1 categories. The map exposes gaps and overlaps. Many teams discover that they have strong measurement against three or four categories and almost no documented activity against the rest.

Build evals against each named risk where applicable to your product. The MEASURE function lists evaluation actions for each category. An eval suite tied to AI 600-1 categories produces audit-ready evidence with minimal additional work.

Treat the GenAI Profile as living. NIST updates the underlying AI RMF and produces additional profiles over time. The team needs a documented process for tracking framework updates and applying them rather than freezing on the first version they implemented.

Mitigations

What builders should put in place to address the failure pattern. Each mitigation maps to operational practice the relevant Applied AI roles own.

Related Applied AI roles

The Applied AI roles whose day-to-day work would have prevented, detected, or contained this incident.

Related AI Decipher Files

• EU AI Act Implementation: First Horizontal AI Regulation Goes Operational
• Air Canada Chatbot Ruling: When a Tribunal Decided AI Output Is Still Your Output
• Microsoft Tay (2016): The 16-Hour Lesson That Defined Responsible AI Deployment

Frequently asked questions