An AI RMF profile for generative AI. It describes 12 risks unique to or worsened by this technology, such as fabricated answers (confabulation), privacy, intellectual property, information security and information integrity, and suggests actions for each framework function.
Who it applies to
Organizations that use, integrate or develop generative AI.
Penalties
The rule has no penalty regime of its own, or it does not apply.
Recommended if your employees use generative AI or you build it into products and services.
Verified in the official source on November 2, 2026
Manage the 12 generative AI risks
NIST AI 600-1, sec. 2 y 3Voluntary standard
Already applicable
When it relates
Recommended if your employees use generative AI or you build it into products and services.
What the rule provides
Add to the risk register: CBRN information, confabulation, dangerous or hateful content, data privacy, environmental impact, harmful bias and homogenization, human-AI configuration, information integrity, information security, intellectual property, obscene or abusive content, and value chain integrity.
Approve tools before use and define which data may be entered.
Run adversarial testing (red teaming) on public-facing systems.
Typical evidence
Tool adoption policy, risk register and adversarial tests
Verified in the official source on November 2, 2026Publication date checked on nist.gov on Nov 2, 2026; the list of 12 risks comes from the published document (not reopened today).