Industry guidance / framework
NIST AI RMF and Generative AI Profile
Cross-sector AI governance and risk management, including generative AI.
Open official sourceDoes this apply to my work?
Does not establish GxP compliance or replace applicable laws. NIST reports that AI RMF 1.0 is being revised.
Voluntary framework; no legal application date.
What does it address?
Provides voluntary risk-management structure and a companion profile for generative AI.
What does this mean in practice?
The controls and evidence below are practitioner examples. They are not mandatory document names or a complete list of obligations.
| Source provision | Requirement or recommendation | Practical control or activity | Example evidence | Applicability note |
|---|---|---|---|---|
| AI RMF and GenAI Profile | Voluntary recommendations | Assign owners, evaluate failures and monitor the defined AI use. | Evaluation results, review records and monitoring actions. | Apply alongside the actual sector and jurisdiction requirements. |
Illustrative example
A decision in practice
- Intended use
- AI drafts a deviation summary for a qualified reviewer.
- Risk
- The draft could omit a critical event or invent a causal statement.
- Control
- Require source comparison and prohibit automatic approval.
- Testing
- Use representative records containing omissions, contradictions and missing data.
- Evidence
- Source-linked review findings and performance monitoring.
- Conclusion
- The draft remains an aid; an accountable reviewer determines the record and decision.
More practitioner context
Practical impact
Use the framework to structure ownership, risk identification, measurement, management, and monitoring for AI-enabled uses.
Actions to consider
Record which NIST concepts are applied and connect them to the system-specific intended use, risk controls, validation evidence, and monitoring.
Practitioner interpretation
NIST provides cross-sector risk structure. The regulated organization still needs a case-specific GxP assessment and validation conclusion.
Continuing context
The framework is voluntary and does not replace GxP regulations, predicate rules, product requirements, or accountable Quality decisions.
Source and review information
Source check: 21 September 2026. Publication identity, scope and status checked against the linked official source. This is not an independent audit of every retained guide statement.
Citation, dates and editorial history
- Stable source ID
- nist-ai-rmf-and-generative-ai-profile
- Official citation
- Artificial Intelligence Risk Management Framework (AI RMF 1.0) and NIST AI 600-1
- Issuing organization
- National Institute of Standards and Technology
- Edition
- AI RMF 1.0 (2023); GenAI Profile (2024)
- Publication
- 26 January 2023; 26 July 2024
- Application / transition
- Voluntary framework; no legal application date.
- Publication status
- Final / published
- Verification
- Verified — public source metadata and scope
- Editorial update
- 21 September 2026 · Version 2.0
- Source owner
- CSVtoCSA editorial
- Review needed
- Recheck when the source or intended use changes
- Independent review
- No independent regulatory review is claimed.
- Prior editorial date
- 12 September 2026 (existing record or detailed guide)
21 September 2026: Source metadata checked, scope clarified, practical mapping and illustrative example added, and layout reorganized. Existing detailed guide content and its dated history are retained below its disclosure. This is an editorial update, not a regulatory amendment.
Questions and corrections
Contributor opinions are moderated and remain distinct from the source and site explanation. Comments do not update source metadata.
Suggest a source correction
Sent privately to the editorial moderation queue. Your account email and correction are not published as a comment. Do not include confidential or personal information.
Source: nist-ai-rmf-and-generative-ai-profile
Loading sign-in status…
Ask a question or share a professional example
Questions and discussion
Ask a question or share a perspective. Contributions are reviewed before publication.
Loading contribution options…