Generative AI Risk Profile Template (NIST AI 600-1)

GAI risk profile: context, 12 NIST AI 600-1 risks rated, GV/MP/MS/MG actions by ID, residual risk, AI Act and 42001 crosswalk, monitoring

AI & DataFullNIST AI 600-1 (July 2024); NIST AI RMF 1.0genai risk profileUpdated Oct 21, 2026

Open in editorDownload .md

How to use: Use it for every system that builds on or deploys a generative model, one profile per context of use. Fill the system context first, then screen all 12 risk categories and pick suggested actions by ID. The main pitfall is marking a category not applicable without testing, especially for a general-purpose model behind a narrow product.

Preview

Generative AI Risk Profile: [System name]

Risk profile for a system that develops, fine-tunes, deploys or uses generative AI (GAI), organised on NIST AI 600-1, Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile (July 2024), a companion to the NIST AI RMF 1.0 (NIST AI 100-1). It records the system context, screens the 12 GAI risk categories, rates each applicable risk, selects suggested actions by AI RMF function (GOVERN, MAP, MEASURE, MANAGE) using the profile's action IDs, and records residual risk, a crosswalk to the EU AI Act and ISO/IEC 42001, and the monitoring plan. Replace every [bracketed] value and every row marked Example.

Document control

Field	Value
Document ID	[GAI-RP-001]
Version	[0.1]
Status	[Draft / In review / Approved / Superseded]
Owner	[@ai-risk-lead]
Approvers / reviewers	[@product-owner], [@security-lead], [@dpo], [@legal], [@ai-governance-board]
Last updated	YYYY-MM-DD
Classification	[Internal / Confidential]
System and version	[Name, version, model IDs]
Organisation role	[GAI developer / Deployer / Both]
Linked AI risk assessment	[AIRA-001]
Linked impact assessment	[AIIA-001]
NIST publications used	NIST AI 600-1 (July 2024); NIST AI 100-1 (AI RMF 1.0)

Approvals

Role	Name	Decision	Date
Product owner	[@name]	[Approve / Approve with conditions / Reject]	YYYY-MM-DD
Security lead	[@name]	[Decision]	YYYY-MM-DD
AI governance board	[@name]	[Decision and residual risk acceptance]	YYYY-MM-DD

Revision history

Version	Date	Author	Change summary
0.1	YYYY-MM-DD	[@name]	First draft
1.0	YYYY-MM-DD	[@name]	Example: Approved before public beta
1.1	YYYY-MM-DD	[@name]	Example: Re-rated after switching base model and adding web browsing tool

Profile summary
Framework basis and status
System context
Rating method
GAI risk screening
Risk analysis and suggested actions
Primary considerations
Residual risk and decision
Crosswalk to EU AI Act and ISO/IEC 42001
Monitoring plan
Traceability
Glossary and references

1. Profile summary

Item	Value
System purpose	Example: Public customer support assistant answering billing and account questions from a retrieval index
Risk categories applicable	Example: All 12 screened as applicable; GR-05, GR-08 and GR-10 rated low
Highest inherent risks	Example: Confabulation (16), Information Security (15), Data Privacy (12)
Overall residual rating	Example: Medium
Conditions for use	Example: Refusal policy for account changes; human handover; weekly groundedness sampling
Next review	YYYY-MM-DD

2. Framework basis and status

NIST AI 600-1 was published on 26 July 2024 as a cross-sectoral profile of the AI RMF 1.0 for generative AI. It describes 12 risks that are unique to or made worse by GAI, and more than 200 suggested actions organised under the AI RMF subcategories, each tagged with the GAI risks it addresses. It also describes four primary considerations from its public working group: governance, pre-deployment testing, content provenance and incident disclosure (section 7 of this template).

The AI RMF 1.0 (January 2023) remains the published framework. As of the last update of this template, NIST states that the AI RMF 1.0 is being revised as part of the White House AI Action Plan, and no revised draft had been published; check https://www.nist.gov/itl/ai-risk-management-framework for the current status before each review.

NIST AI 600-1 groups risks into three overlapping sources: risks from the technology design and content (for example confabulation), risks from misuse by people, and ecosystem or societal risks. The screening table uses the same grouping to help reviewers think about who causes harm.

Item	Version used	Date checked
NIST AI 600-1	July 2024	YYYY-MM-DD
NIST AI RMF	1.0 (revision under way)	YYYY-MM-DD
EU AI Act	Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744	YYYY-MM-DD
ISO/IEC 42001	2023	YYYY-MM-DD

3. System context

Item	Value
Intended purpose	Example: Answer customer questions about invoices, tariffs and account settings
Out of scope uses	Example: Legal, medical or financial advice; account changes without login
Users	Example: Consumers, including elderly and non-native speakers
People affected	Example: Users, support agents who take handovers, people named in support tickets
Modalities	[Text / Image / Audio / Video / Code]
Model sourcing	Example: Third-party foundation model via API, version pinned; embedding model self-hosted
Adaptation	[Prompting / Retrieval-augmented generation / Fine-tuning / Agents with tools]
Tools and actions	Example: Read-only billing API; create support ticket
Data sources	Example: Help centre articles, tariff tables, user's own invoices after login
Deployment	Example: Web and mobile app, EU region only
Scale	Example: About [x] conversations per day
Human oversight	Example: Handover to human agent on request or low confidence
Applicable laws	Example: AI Act Article 50 transparency; GDPR; consumer protection law

4. Rating method

Likelihood and impact are rated from 1 to 5 and multiplied. The scale below is an Example; use the organisation's risk methodology.

Score	Likelihood	Impact
1	Rare: not expected in the life of the system	Negligible: no lasting effect on people or the organisation
2	Unlikely: could occur in unusual conditions	Minor: limited, quickly reversible harm
3	Possible: expected occasionally	Moderate: harm to some people, reversible with effort
4	Likely: expected regularly	Major: serious harm to individuals or significant legal exposure
5	Almost certain: expected often	Severe: irreversible harm, harm at scale or prohibited outcome

Ratings: 1 to 4 low, 5 to 9 medium, 10 to 15 high, 16 to 25 very high. Risks rated high or very high after treatment need AI governance board acceptance.

5. GAI risk screening

ID	GAI risk (NIST AI 600-1 name)	What it covers (paraphrase)	Applicable	Rationale	Inherent L x I
GR-01	CBRN Information or Capabilities	Easier access to or synthesis of dangerous chemical, biological, radiological or nuclear knowledge	Example: Yes (low)	General model can be asked off-topic questions	1 x 5 = 5
GR-02	Confabulation	Confident but false or fabricated output that misleads users	Example: Yes	Wrong tariff or billing answers	4 x 4 = 16
GR-03	Dangerous, Violent, or Hateful Content	Output that incites, threatens, encourages self-harm or illegal acts, or demeans groups	Example: Yes	Public users can attempt jailbreaks	2 x 4 = 8
GR-04	Data Privacy	Leakage, misuse or re-identification of personal or sensitive data	Example: Yes	Access to user invoices; logs hold personal data	3 x 4 = 12
GR-05	Environmental Impacts	Energy, water and other resource use from training and operating models	Example: Yes (low)	Inference only, third-party hosting	3 x 1 = 3
GR-06	Harmful Bias or Homogenization	Amplified bias, unequal performance across groups or languages, loss of diversity in outputs	Example: Yes	Non-native speakers may receive worse answers	3 x 3 = 9
GR-07	Human-AI Configuration	Over-reliance, automation bias, anthropomorphising or emotional dependence	Example: Yes	Users may treat answers as binding	3 x 3 = 9
GR-08	Information Integrity	Content that blurs fact and opinion or supports mis- and disinformation at scale	Example: Yes (low)	Narrow domain; no public publishing	2 x 2 = 4
GR-09	Information Security	Easier offensive cyber activity and a larger attack surface, including prompt injection and model or data compromise	Example: Yes	Tools and retrieval expose injection paths	3 x 5 = 15
GR-10	Intellectual Property	Reproduction of protected content without rights, trade secret exposure, plagiarism	Example: Yes (low)	Answers drawn from own content	2 x 2 = 4
GR-11	Obscene, Degrading, and/or Abusive Content	Obscene or abusive imagery or text, including synthetic CSAM and non-consensual intimate imagery	Example: No for images; Yes (low) for text	Text-only model with provider filters	1 x 5 = 5
GR-12	Value Chain and Component Integration	Opaque third-party components, data or models, and weak supplier vetting that reduce accountability downstream	Example: Yes	Foundation model and embedding model from suppliers	3 x 4 = 12

NIST AI 600-1 notes that some risks sit across more than one source. Use the rationale column to say where the harm comes from: model behaviour, misuse, or the wider ecosystem.

6. Risk analysis and suggested actions

Each table lists actions by AI RMF function: GOVERN (GV), MAP (MP), MEASURE (MS) and MANAGE (MG). Status values are Planned, In progress, Implemented or Not selected (with reason). All status and owner cells are Example values.

6.1 GR-01 CBRN Information or Capabilities

Scenario: Example: A user attempts to extract synthesis routes for a toxic agent through role play. The domain is unrelated, but the base model is general purpose.

Function	Action ID	Action (paraphrase)	Status	Owner
GOVERN	GV-1.2-002	Evaluate risky capabilities and the robustness of safety measures before and after deployment	Implemented (provider evaluation reviewed)	[@ai-risk-lead]
MAP	MP-1.1-004	Identify foreseeable illegal uses that exceed risk tolerance	Implemented	[@product-owner]
MANAGE	MG-2.2-005	Check outputs with due diligence for harmful content, including CBRN-related content	Implemented (output classifier)	[@ml-lead]

6.2 GR-02 Confabulation

Scenario: Example: The assistant states a tariff or refund rule that does not exist, and the user acts on it.

Function	Action ID	Action (paraphrase)	Status	Owner
GOVERN	GV-1.3-002	Set minimum performance thresholds as part of go or no-go deployment decisions	Implemented	[@product-owner]
MAP	MP-2.3-003	Use and document fact-checking techniques for generated information	In progress	[@ml-lead]
MEASURE	MS-2.5-003	Review and verify sources and citations in outputs before deployment	Implemented	[@qa-lead]
MANAGE	MG-4.1-004	Use active learning to find cases where the model fails or behaves unexpectedly	Planned	[@ml-lead]
Internal	CTL-GR02-01	Answer only from retrieved passages; refuse when no passage supports the answer	Implemented	[@ml-lead]

6.3 GR-03 Dangerous, Violent, or Hateful Content

Scenario: Example: A user jailbreaks the assistant to produce abusive messages about a group, then posts screenshots publicly.

Function	Action ID	Action (paraphrase)	Status	Owner
GOVERN	GV-4.2-001	Publish terms of use and terms of service for the GAI system	Implemented	[@legal]
MAP	MP-1.1-003	Consider known incidents, failure modes and foreseeable misuse when mapping context	Implemented	[@ai-risk-lead]
MANAGE	MG-3.2-005	Use content filters against harmful, false, illegal or violent output	Implemented	[@ml-lead]

6.4 GR-04 Data Privacy

Scenario: Example: A prompt injection in a support ticket causes the assistant to reveal another customer's invoice details.

Function	Action ID	Action (paraphrase)	Status	Owner
GOVERN	GV-1.1-001	Align development and use with applicable law, including privacy and intellectual property law	Implemented	[@dpo]
MAP	MP-4.1-001	Monitor generated content periodically for privacy risks	In progress	[@dpo]
MANAGE	MG-2.2-009	Consider synthetic data and other privacy-enhancing techniques where appropriate	Not selected (no training on user data)	[@ml-lead]
Internal	CTL-GR04-01	Retrieval and tools scoped to the authenticated user's own records	Implemented	[@security-lead]

6.5 GR-05 Environmental Impacts

Scenario: Example: Use of a very large model for simple intents raises energy use and cost without benefit.

Function	Action ID	Action (paraphrase)	Status	Owner
MEASURE	MS-2.12-002	Document expected environmental impacts in product design decisions	Implemented	[@product-owner]
MEASURE	MS-2.12-003	Measure or estimate energy and water use for training, fine-tuning and deployment	Planned (ask provider)	[@sustainability-lead]

6.6 GR-06 Harmful Bias or Homogenization

Scenario: Example: Users writing in a second language receive shorter, less accurate answers and more refusals.

Function	Action ID	Action (paraphrase)	Status	Owner
MAP	MP-1.2-002	Make sure benchmarks and feedback participants represent the relevant user groups	In progress	[@research-lead]
MEASURE	MS-2.11-005	Check the share of synthetic training data so data is not overly homogeneous	Not selected (no training)	[@ml-lead]
MANAGE	MG-2.2-004	Evaluate content for representational bias and apply mitigation techniques	Planned	[@ml-lead]

6.7 GR-07 Human-AI Configuration

Scenario: Example: Support agents accept the assistant's draft without checking, so errors reach customers with a human signature.

Function	Action ID	Action (paraphrase)	Status	Owner
GOVERN	GV-5.1-002	Tell users about their interactions with the GAI system before they begin, especially where risk is higher	Implemented	[@product-owner]
MAP	MP-3.4-004	Separate tests of human proficiency from tests of GAI capability	Planned	[@research-lead]
MANAGE	MG-3.2-008	Use human moderation where appropriate, in line with oversight policies	Implemented	[@support-lead]

6.8 GR-08 Information Integrity

Scenario: Example: The assistant summarises a news story about a service outage incorrectly and the summary is shared on social media.

Function	Action ID	Action (paraphrase)	Status	Owner
GOVERN	GV-1.5-001	Assign responsibility for periodic review of content provenance and incident monitoring	Implemented	[@ai-risk-lead]
MAP	MP-2.3-001	Assess accuracy and authenticity of output against ground truth with several methods	Implemented	[@qa-lead]
MEASURE	MS-2.7-005	Measure the reliability of content authentication methods such as watermarks or signatures	Not selected (text-only, no publishing)	[@ml-lead]

6.9 GR-09 Information Security

Scenario: Example: Indirect prompt injection in a retrieved help article makes the assistant call the ticket API with attacker content.

Function	Action ID	Action (paraphrase)	Status	Owner
GOVERN	GV-1.3-007	Prepare a plan to halt development or deployment if risk becomes unacceptable	Implemented (kill switch)	[@sre-lead]
MAP	MP-2.3-005	Plan regular adversarial testing to find vulnerabilities and misuse	Implemented	[@security-lead]
MEASURE	MS-2.7-007	Red team for resilience against attacks, including abuse against other systems	Implemented	[@security-lead]
MEASURE	MS-2.7-008	Verify that fine-tuning does not weaken safety and security controls	Not selected (no fine-tuning)	[@ml-lead]
MANAGE	MG-2.4-004	Set and review criteria that require deactivating the system	Implemented	[@ai-governance-board]

6.10 GR-10 Intellectual Property

Scenario: Example: The assistant reproduces long passages from a competitor's licensed documentation found in the base model's training data.

Function	Action ID	Action (paraphrase)	Status	Owner
GOVERN	GV-1.2-001	Document the origin and history of training and generated data for transparency	In progress (provider documentation requested)	[@legal]
MAP	MP-4.1-002	Have a process to respond to potential IP infringement claims	Implemented	[@legal]

6.11 GR-11 Obscene, Degrading, and/or Abusive Content

Scenario: Example: A user tries to obtain sexually explicit text about a named real person.

Function	Action ID	Action (paraphrase)	Status	Owner
GOVERN	GV-1.4-001	Put policies and mechanisms in place to prevent generation of CSAM, NCII or other unlawful content	Implemented	[@trust-safety-lead]
MANAGE	MG-3.2-005	Use content filters, including for CSAM	Implemented	[@ml-lead]

6.12 GR-12 Value Chain and Component Integration

Scenario: Example: The foundation model provider updates the model behind the same API name and refusal behaviour changes overnight.

Function	Action ID	Action (paraphrase)	Status	Owner
GOVERN	GV-6.1-009	Update procurement due diligence for GAI vendors to cover IP, privacy, security and other risks	Implemented (AI vendor questionnaire)	[@procurement-lead]
GOVERN	GV-6.2-007	Review vendor contracts for liability, change over time and notice of serious incidents	In progress	[@legal]
MAP	MP-4.1-007	Re-evaluate models fine-tuned or built on top of third-party models	Implemented	[@ml-lead]
MANAGE	MG-3.1-005	Review transparency artefacts such as model cards and system cards for third-party models	Implemented	[@ml-lead]
Internal	CTL-GR12-01	Pin model versions; run the regression evaluation before accepting any provider update	Implemented	[@ml-lead]

7. Primary considerations

Consideration	What we do	Evidence	Gaps
Governance	Example: GAI systems registered in the AI inventory; board approval for public-facing systems; acceptable use policy updated	Inventory, board minutes	Third-party embedded GAI not yet inventoried
Pre-deployment testing	Example: Evaluation set of [x] cases, red team exercise, accessibility and language tests	Evaluation report, red team report	No structured public feedback exercise
Content provenance	Example: Responses labelled as AI-generated; retrieval citations shown; logs keep source passage IDs	UI screenshots, log schema	No watermarking (text only)
Incident disclosure	Example: AI incidents logged with model version and prompt hash; customer notice template; regulator notice assessment	Incident plan, incident log	Public incident database reporting not decided

8. Residual risk and decision

ID	Risk	Inherent	Key actions	Residual L x I	Residual rating	Accepted by
GR-02	Confabulation	16	CTL-GR02-01, MS-2.5-003	Example: 2 x 4 = 8	Medium	[@product-owner]
GR-04	Data Privacy	12	CTL-GR04-01, MP-4.1-001	Example: 2 x 4 = 8	Medium	[@dpo]
GR-09	Information Security	15	MS-2.7-007, MG-2.4-004	Example: 2 x 5 = 10	High	[@ai-governance-board] with conditions
GR-12	Value Chain and Component Integration	12	CTL-GR12-01, GV-6.2-007	Example: 2 x 4 = 8	Medium	[@ai-risk-lead]
GR-06	Harmful Bias or Homogenization	9	MP-1.2-002, MG-2.2-004	Example: 2 x 3 = 6	Medium	[@product-owner]

Decision: [Approve / Approve with conditions / Reject]. Conditions: Example: quarterly red team retest for GR-09; contract amendment for GR-12 signed before general availability.

9. Crosswalk to EU AI Act and ISO/IEC 42001

GAI risk	EU AI Act provisions to check	ISO/IEC 42001 controls
GR-01 CBRN	Art. 55 (GPAI models with systemic risk: evaluation and mitigation) for model providers	A.5.5, A.6.2.4
GR-02 Confabulation	Art. 15 (accuracy) and Art. 13 (instructions for use) for high-risk systems	A.6.2.4, A.8.2
GR-03 Dangerous content	Art. 5 (prohibited manipulation); Art. 55 for systemic-risk models	A.6.2.4, A.9.4
GR-04 Data Privacy	Art. 10 (data governance) for high-risk systems; GDPR alongside	A.7.2, A.7.6
GR-05 Environmental	Art. 53 and Annex XI (energy information in GPAI technical documentation) for model providers	A.4.5, A.5.5
GR-06 Harmful Bias	Art. 10 (bias examination) and Art. 15 for high-risk systems	A.5.4, A.7.4
GR-07 Human-AI Configuration	Art. 14 (human oversight), Art. 26 (deployer duties), Art. 50(1) (interaction disclosure)	A.9.2, A.9.4
GR-08 Information Integrity	Art. 50(2) and 50(4) (marking and deep fake disclosure)	A.8.2, A.8.5
GR-09 Information Security	Art. 15 (cybersecurity) for high-risk systems; Art. 55 for systemic-risk models	A.6.2.4, A.6.2.8
GR-10 Intellectual Property	Art. 53(1)(c) and (d) (copyright policy and training content summary) for model providers	A.7.3, A.7.5
GR-11 Obscene content	Art. 5 prohibitions added by Regulation (EU) 2026/1744 (non-consensual intimate content and CSAM, from 2 December 2026)	A.6.2.4, A.9.4
GR-12 Value Chain	Art. 25 (value chain responsibilities), Art. 53(1)(b) (information for downstream providers)	A.10.2, A.10.3

Check the consolidated text on EUR-Lex for article wording and application dates; the high-risk obligations apply from 2 December 2027 for Annex III systems and 2 August 2028 for Annex I systems under the amended Article 113.

10. Monitoring plan

Metric	Risk	Method	Frequency	Trigger	Owner
Groundedness failure rate	GR-02	Sample of [x] conversations graded against sources	Weekly	Example: Above baseline plus [x] points	[@qa-lead]
Guardrail block rate and bypasses	GR-03, GR-09, GR-11	Guardrail logs, red team findings	Daily dashboard, monthly review	Any confirmed bypass	[@security-lead]
Cross-user data exposure	GR-04	Canary records, log scanning	Continuous	Any occurrence	[@dpo]
Answer quality by language	GR-06	Evaluation set per language	Each release	Gap above [x] points	[@research-lead]
Handover and complaint rate	GR-07	Support analytics	Weekly	Sustained rise	[@support-lead]
Provider model change notices	GR-12	Vendor notices, version check job	Continuous	Any unannounced change	[@ml-lead]

Re-rate the profile when a trigger fires, when the model, tools or data sources change, after any AI incident, and at least [every six months].

11. Traceability

Risk	Action	Evidence	Test or record ID	Last verified
GR-02	CTL-GR02-01	Retrieval-only answer configuration and refusal test results	EVAL-2026-07 (Example)	YYYY-MM-DD
GR-04	CTL-GR04-01	Authorisation test for cross-user access	SEC-TC-112 (Example)	YYYY-MM-DD
GR-09	MS-2.7-007	Red team report with injection test cases	RT-2026-03 (Example)	YYYY-MM-DD
GR-09	MG-2.4-004	Deactivation criteria and runbook drill	DRILL-04 (Example)	YYYY-MM-DD
GR-12	GV-6.1-009	Completed AI vendor risk questionnaire	AIVRQ-007 (Example)	YYYY-MM-DD

12. Glossary and references

Term	Meaning
GAI	Generative AI: models that produce text, images, audio, video or code
Confabulation	NIST AI 600-1 term for confident but false output, often called hallucination
Suggested action	Voluntary action in NIST AI 600-1 linked to an AI RMF subcategory, with an ID such as GV-6.1-009
Content provenance	Information about the origin and history of content, used to judge authenticity
Red teaming	Structured adversarial testing to find failures and vulnerabilities
GPAI model	General-purpose AI model under the EU AI Act

References:

NIST AI 600-1, Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile, July 2024, https://doi.org/10.6028/NIST.AI.600-1
NIST AI 100-1, AI RMF 1.0, January 2023, and the AI RMF page https://www.nist.gov/itl/ai-risk-management-framework
Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744, consolidated text on EUR-Lex
ISO/IEC 42001:2023, Annex A
Related templates: AI risk assessment (ai-data/ai-risk-assessment), AI system impact assessment (ai-data/ai-impact-assessment-42005), AI red team plan and report (ai-data/ai-red-team), LLM evaluation plan (ai-data/llm-evaluation-plan), Guardrails specification (ai-data/guardrails-spec), AI vendor risk questionnaire (compliance/ai-vendor-risk-questionnaire), Statement of Applicability (ISO/IEC 42001) (compliance/iso-42001-statement-of-applicability)

Standard and licence note

Based on NIST AI 600-1, Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile (July 2024), and the NIST AI RMF 1.0 (NIST AI 100-1). NIST publications are works of the US Government and not subject to copyright in the United States; the 12 risk names and the action IDs are used for reference, and all descriptions are original paraphrases. EU AI Act provisions are summarised in original wording (EU legislative texts are free to reuse), and ISO/IEC 42001:2023 is cited by control number only (copyrighted standard, no text reproduced). Check the current versions on nist.gov, EUR-Lex and iso.org before use; the AI RMF is under revision. Template licence: MIT.

Related templates

AI & Data