Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile
This document is a cross-sectoral profile and companion resource to the AI Risk Management Framework (AI RMF 1.0) specifically for Generative Artificial Intelligence. It defines risks unique to or exacerbated by generative AI, such as confabulation, data privacy impacts, and CBRN information risks. Additionally, it provides a set of suggested actions and risk management strategies aligned with trustworthy AI characteristics.
Summary and content fields are drawn from the document text and are pending editorial review.
Who issued it
Who it governs
This document is for organizations, developers, deployers, and researchers seeking guidance on how to manage risks associated with generative AI systems.
What the document contains
This document covers risks unique to or exacerbated by generative AI systems, such as confabulation, data privacy, harmful bias, information security, and intellectual property. It provides corresponding risk management strategies and suggested actions mapped to the AI RMF core functions of govern, map, measure, and manage.
The document does not provide a definitive legally binding regulatory standard or mandatory compliance enforcement mechanism, as it is designed for voluntary use. Specific technical specifications for proprietary commercial models are also not detailed beyond general risk management principles.
- The document serves as a companion profile to the NIST AI Risk Management Framework specifically tailored for Generative AI.
- It details twelve categories of risks unique to or exacerbated by generative AI, ranging from CBRN information access to environmental impacts and intellectual property concerns.
- The profile outlines suggested actions for organizations to govern, map, measure, and manage GAI risks across the AI lifecycle.
- It was developed through a collaborative, multistakeholder process involving the NIST Generative AI Public Working Group.
- The guidance is intended for voluntary use to help organizations incorporate trustworthiness considerations into GAI systems.
1. Introduction 2. Overview of Risks Unique to or Exacerbated by GAI 3. Suggested Actions to Manage GAI Risks Appendix A. Primary GAI Considerations Appendix B. References
How it scores
Each score is backed by a quote verified against the document text. Editorial review has not yet confirmed them.
Accountability
2/5Clear responsibility for AI outcomes
other issues that diminish transparency or accountability for downstream users.
2. Overview of Risks Unique to or Exacerbated by GAI
screening score · 2026-10-23
Human Dignity
1/5Respect for the inherent worth of persons
without harm to people or the planet.
About AI at NIST
screening score · 2026-10-23
Human Oversight
2/5Humans remain in control of consequential decisions
others result from interactions between a human and an AI system.
2. Overview of Risks Unique to or Exacerbated by GAI
screening score · 2026-10-23
Privacy
2/5Protection of personal data and private life
Impacts due to leakage and unauthorized use, disclosure, or de-anonymization of biometric, health, location, or other personally identifiable information or sensitive data.
2. Overview of Risks Unique to or Exacerbated by GAI
screening score · 2026-10-23
Transparency
2/5Openness about how AI systems work and are used
Non-transparent or untraceable integration of upstream third-party components
2. Overview of Risks Unique to or Exacerbated by GAI
screening score · 2026-10-23
Enforcement
0/5Consequences and compliance mechanisms with real force
Introduction
screening score · 2026-10-23
Impact Assessment
4/5Required assessment of an AI system's risks/impacts before or during use
After introducing and describing these risks, the document provides a set of suggested actions to help organizations govern, map, measure, and manage these risks.
1. Introduction
screening score · 2026-10-23