NIST AI RMF profiles: what exists and how to build yours

Which NIST AI RMF profiles exist, and which one your organization needs

When a customer, contract or regulator asks for NIST AI RMF alignment, the first thing to know is that the AI RMF has no certification. A profile is a tailoring of the framework's functions, categories and subcategories, either built by an organization for its own setting or published by NIST for a broader one. As of October 2026, the published cross-sectoral profile is NIST AI 600-1, the Generative AI Profile, while the critical infrastructure profile remains a concept note released on April 7, 2026 and still listed as an ongoing project.

The right profile depends on the use case, the sector, the organization's risk tolerance and the resources it can commit. A business running a generative AI assistant across several functions will likely start with NIST AI 600-1 and add its own use-case profile for the specific application. An operator of AI-enabled industrial systems will need to watch the critical infrastructure work, since no final profile exists yet for that setting. Confirm with the requesting customer or regulator which profile they expect, and whether they accept an organization-built profile that cites NIST's published one. Ask them to state this in writing before any work starts.

The organization owns its profile, its risk decisions and its sign-off. An implementation partner can help prepare the Current and Target Profiles, the systems, the documentation and the evidence that show how each subcategory is handled. If the customer or regulator requires independent review, an independent assessor reviews that work and issues any report. Deciding who holds each of those roles before scoping avoids the common gap where a profile is written but nobody outside the team has checked it.

What kinds of profiles exist and what each one is for

NIST AI RMF profiles tailor the framework to a setting, a comparison of current and desired practice, a shared risk pattern, or a sector. The cards below cover the profile types NIST describes, the status of each one as of October 2026, and the points to check before relying on any of them.

Use-case profiles

AI 100-1 Section 6 defines a use-case profile as an implementation of the framework's functions, categories and subcategories for a specific setting or application, shaped by the user's requirements, risk tolerance and resources. The framework's examples are a hiring profile and a fair housing profile. NIST also lists a University of Michigan-Dearborn profile for traffic sign recognition on its use cases page. Check whether a profile names the AI system and its decisions, and whether it states the risk tolerance it was built for.

Temporal profiles: Current and Target

A temporal profile pairs a Current Profile, which shows how AI is managed today, with a Target Profile, which shows the outcomes needed to reach a goal. Comparing the two reveals gaps and helps estimate the staffing and funding needed to close them. Neither profile is published by NIST for a sector. Organizations build their own, so the useful check is whether each subcategory has a documented current state and a dated target.

Cross-sectoral profiles

Cross-sectoral profiles cover risks of models or applications used across many sectors, or activities common to many sectors, such as large language models, cloud-based services or acquisition. NIST AI 600-1, the Generative AI Profile, published July 26, 2024, is the published example. AI 100-1 does not prescribe a profile template, so a cross-sectoral profile should show which suggested actions apply to the organization and which it has set aside.

Critical infrastructure profile in development

On April 7, 2026, NIST released a concept note for an AI RMF Profile on Trustworthy AI in Critical Infrastructure. It is meant to guide operators on AI-enabled capabilities across IT, operational technology and industrial control systems. As of October 2026, NIST lists the project as ongoing and has not published a profile. Treat the concept note as a statement of direction, and confirm the current status and comment process on NIST's project page before citing it in a contract.

Cyber AI Profile is not an AI RMF profile

NIST IR 8596, the Cybersecurity Framework Profile for Artificial Intelligence, is a community profile of the Cybersecurity Framework 2.0, not of the AI RMF. Its initial preliminary draft was released December 16, 2025, and comments closed January 30, 2026. NIST says the comments will inform an initial public draft. Do not describe a Cyber AI Profile as an AI RMF profile. Use it alongside the AI RMF when a customer asks for CSF-based cybersecurity evidence for AI systems.

How to build a Current Profile and a Target Profile

This sequence turns the AI RMF's 72 subcategories into a gap assessment: a written Current Profile of how AI is managed today, a Target Profile of the outcomes the organization needs, and a gap list that shows the staffing and funding needed to close the difference. Each step ends in a written artifact that a reviewer can check.

Scope the AI systems and use case
Start by naming the AI systems, the business unit or product that owns them, the intended purpose of each, and the people who use or are affected by their outputs. Record which systems are built in-house, bought from vendors or built on third-party models, because the Govern 6 and Manage 3 subcategories treat those differently. The owner of this step is usually the risk or governance lead, working with the system owners. The output is a scope statement and an inventory extract that lists each system in scope. The step is done when every system in the scope statement appears in the inventory and the excluded systems have a written reason for exclusion.
Document current practice against each subcategory
Walk the Govern, Map, Measure and Manage subcategories for the scoped systems and record what the organization does today. For each subcategory, note the existing policy, procedure, role, test or record that addresses it, and mark where nothing exists. Interview the teams that operate the systems, since documents often describe intent rather than practice. The Playbook offers documentation prompts and references for each subcategory, but it was last updated in August 2023 according to its audit log, so check each suggested action against the current AI 100-1 text before relying on it. The output is the Current Profile, a dated table with one row per subcategory and a status and evidence reference for each.
Confirm the Current Profile with evidence
Have a second reviewer, ideally someone outside the team that runs the systems, test a sample of the Current Profile entries against the evidence they cite. Confirm that each cited policy is approved, that each cited record exists and covers the scoped systems, and that each marked gap is accurate. Corrections from this review change the profile, not just the notes. The output is a reviewed Current Profile with a version number, a reviewer name and a list of changes made during review. An assessor or customer reviewing the profile later will look for exactly this trail, so keep the review record with the profile.
Set Target outcomes from risk tolerance and resources
Define the outcome the organization needs for each subcategory in scope. AI 100-1 ties the target to the user's requirements, risk tolerance and resources, so the target should reflect the risk tolerance set under Govern 1 and the impact of each system identified in Map 5. Record a target statement for each subcategory, including subcategories the organization decides not to pursue and the reason. Leadership should approve the Target Profile because it commits the organization to a level of practice. The output is an approved Target Profile with the approver, the approval date and the risk tolerance it relies on.
Compare the two profiles to identify gaps
Line up the Current and Target Profiles subcategory by subcategory and classify each difference: no practice, partial practice, or practice that meets the target but lacks evidence. Group the gaps by theme, such as inventory, testing or third-party oversight, so that the remediation work has clear owners. The gap register is the main output of this step. It should list each gap, the target it misses, the system it affects and its priority, using the risk prioritization the organization set under Manage 1. Gaps that come from missing evidence are often quicker to close than gaps that come from missing practice, so label them separately.
Estimate staffing and funding to close each gap
For each gap in the register, estimate the roles, skills and budget needed to close it, such as a model evaluation engineer, a privacy reviewer, tooling or an external assessor. AI 100-1 describes this use of profiles to gauge the staffing and funding required, so the output should show resource needs, not only task lists. Separate one-time costs, such as writing policies or building a test harness, from recurring costs, such as monitoring, staff time and reassessment. If an implementation partner or auditor is involved, ask each for a written scope with deliverables and fees before estimating their share. The output is a resource plan tied to the gap register, which leadership can approve or reduce by reprioritizing gaps.
Review and refresh the profiles on a schedule
Profiles lose value when systems change, so set a review trigger for each profile. Triggers usually include a new or materially changed AI system, a new third-party model, an incident, or a revision of the AI RMF itself. NIST says AI 100-1 is being revised as part of the White House AI Action Plan and that a formal review is expected no later than 2028, so check the profiles against any revised text when it is published. The output is a versioned profile history that shows what changed and why. Ask the framework owner to confirm the review cadence in the governance policy before the first profile is approved.

What NIST AI 600-1 adds to a profile and when to use it

NIST AI 600-1 adds generative AI risk detail to the AI RMF, and it does so as a cross-sectoral profile rather than a new framework. Published July 26, 2024, it defines 12 risks specific to generative AI and lists suggested actions for managing them. Each suggested action is tied to an AI RMF subcategory, so an organization that adopts the profile does not replace its existing AI RMF work. It layers generative AI considerations onto the subcategories it already maps. Read the profile alongside the Core, and treat its suggested actions as prompts for evidence rather than a list that must be completed item by item.

Adopt the profile as a starting point when your organization builds, fine-tunes, hosts or deploys large language models or other generative systems, or when it buys generative AI from a vendor and needs to test that vendor's controls. It is a practical overlay for a Target Profile in those settings, because it names risks such as confabulation, data privacy exposure and information integrity that a general AI inventory may not surface. An organization with little generative AI exposure may only need to borrow the risk descriptions. Decide which of the 12 risks apply to each system in the AI inventory before writing a gap assessment against them.

Confirm the revision status with NIST before relying on AI RMF numbering in a contract. NIST says AI RMF 1.0 is being revised under the White House AI Action Plan and has not published a revised version as of October 17, 2026, and profiles published so far, including AI 600-1, map to the 1.0 subcategory numbering. Ask your counterparty which edition it expects, and write the reference to the profile and its date into the contract so a later revision does not silently change your obligations. Check the NIST AI RMF page for any update before signing.

Which profile fits your situation

When one AI system carries most of the risk, a use-case profile is usually the right starting point. AI 100-1 defines a use-case profile as an implementation of the framework's functions, categories and subcategories for a specific setting or application, shaped by the user's requirements, risk tolerance and resources. The document gives a hiring profile and a fair housing profile as examples, so the form is not fixed and the scope is set by the system itself.

Scope the system narrowly: Name the decision the system supports, the people it affects and the data it uses before selecting subcategories.
Pick the subcategories that bite: Keep the Map and Measure subcategories tied to the system's most significant mapped risks, and document why others are out of scope.
Record risk tolerance explicitly: Write down the go or no-go threshold so the profile shows how decisions were made.
Use the Playbook as a prompt list: Its suggested actions and documentation prompts help fill gaps, but NIST says it is neither a checklist nor a set of steps.
Name the owner: Assign accountable roles for each subcategory the profile covers.

Before you start, ask the customer or regulator which subcategories they expect to see addressed and whether they want a profile document or evidence mapped to the profile.

What makes a profile larger or slower to build

A profile's size is set by a few choices made before any gap analysis starts: how many AI systems it covers, how many subcategories it selects, and who must sign off. Each driver below is a lever you can narrow, sequence or assign, and most of the schedule risk sits in the first two.

Number of AI systems in scope

Every system added to a Current or Target Profile multiplies the evidence each subcategory needs. A profile for one hiring tool and a profile for a whole enterprise AI portfolio differ in size by orders of magnitude. Start with a single use case, or sequence systems by risk so the highest-impact ones are profiled first. Ask whether the profile is written per system or once for a shared AI program, because that choice decides how much is repeated.

Number of subcategories selected

AI 100-1 lets users choose some or all of the 72 subcategories, and a Target Profile that selects all of them asks for far more work than one scoped to the risks you have mapped. Select subcategories from the MAP and MEASURE results, document why the rest are out of scope, and revisit the selection when the use case changes. Treat the Playbook suggested actions as options to weigh, not as a mandatory list.

Data and documentation maturity

Profiles that rely on existing records move quickly, while those that must reconstruct training data lineage, model cards, evaluation results or decision logs take longer. Before scoping, check whether each system has an inventory entry, a documented purpose, and retained test results. Gaps found here often become the first items in the Target Profile, so the effort appears early and is easier to plan.

Third-party models and vendors

Systems built on vendor models, hosted APIs or pre-trained components depend on information the organization does not control. Requests for vendor testing results, data handling terms and change notices take time to answer, and some vendors will not share them. Identify which subcategories under GOVERN 6, MAP 4 and MANAGE 3 depend on vendor input, request that input early, and record what is unavailable as a documented gap.

Sector-specific requirements

A profile for a lender, a health provider or a critical infrastructure operator often needs to map additional legal duties, sector guidance or supervisory expectations onto the AI RMF subcategories. Each added source adds a mapping exercise and a review by someone who knows that sector. Confirm which sector rules apply to the use case before scoping, and check whether the sector guidance already points to subcategories you can reuse.

Teams that must agree on targets

Target Profile outcomes are decisions about risk tolerance, staffing and funding, so legal, risk, product, engineering and affected business owners often all have a say. Each approver who joins late can reopen a target that was already set. Name a single accountable owner for the profile, agree on the decision rights in advance, and schedule sign-off for the Target Profile as a formal milestone.

Who is paid for each part of building a profile

This table compares the five cost components of building a NIST AI RMF profile, showing who is paid for each, whether the cost is one-time or recurring, and what drives it up. No fee figures are published for this work, so the table is a structure for requesting a written scope and quote. Read it to separate internal effort from outside services before you compare proposals.

Cost component	Who is paid	One-time or recurring	What drives it
Internal staff time for scoping and evidence	Your own staff, paid through existing payroll or internal budget	Both: initial scoping is one-time, evidence refresh recurs	Number of AI systems in scope, how many subcategories you select, and how many teams hold evidence
Implementation partner for systems, documentation and evidence	An outside implementation partner, under a fixed-scope written agreement	Mostly one-time for the first profile, with optional retainers afterward	Size of the AI estate, the number of Current and Target Profile gaps, and whether logging and documentation already exist
Tooling line for logging and monitoring	Software or infrastructure vendors, or your own cloud account	Recurring, typically tied to licensing, storage and compute	Volume of model inputs and outputs logged, retention periods, and whether tooling is self-hosted or licensed
Independent assessor, only if required	An independent assessor selected by you or the requiring party	One-time per review, repeated if the customer or regulator asks again	Whether a customer contract or regulator requires an external review, and the review's scope and depth
Playbook and profile maintenance	Your internal teams, and any partner under a retainer	Recurring, since the Playbook is not yet revised and profiles need updates	Pending revision of AI RMF 1.0, changes to AI systems, and how often your Target Profile moves

What must exist before a profile can be compared against targets

A Current Profile only shows gaps if the organization can say what AI it runs, why it runs it, who answers for it and what evidence exists. The six items below are the inputs that make a Current and Target Profile comparison meaningful, and each names the AI RMF category it supports.

Current AI system inventory

Every AI system in scope needs a dated record covering its owner, purpose, the models and third-party components it uses, and where it runs. Without this list, a Current Profile describes only the systems someone remembered. Check that the inventory includes vendor-embedded AI and pilots, and that teams reconcile it against procurement and cloud accounts. This supports GOVERN 1, which covers the AI inventory and decommissioning.

Intended purpose and risk tolerance

For each system, record the intended purpose, the settings where it is not meant to be used, and the risk tolerance the organization accepts. Target outcomes cannot be set without these, because a Target Profile is judged against them. Confirm that someone with authority signed off on the tolerance and that it names the harms the organization will not accept. This supports MAP 1 (context) and GOVERN 1 (risk tolerance).

Owners and accountability lines

Each system needs a named accountable owner, a technical owner and a documented escalation path to someone who can stop or change it. Profile gaps often trace back to decisions no one owned. Check that role descriptions match the people actually making go or no-go calls and that training covers the roles. This supports GOVERN 2, which covers documented roles, communication lines and executive responsibility.

Baseline measurement evidence

Record the metrics, test results and monitoring outputs that exist today for each system, along with their dates and limits. A Current Profile needs this baseline to show what is measured now and what is not. Confirm that metrics were selected for the most significant mapped risks and that someone has reviewed whether those metrics still work. This supports MEASURE 1, which covers methods, metrics and the involvement of independent assessors.

Documented review cadence

Set a schedule for revisiting each system's inventory entry, risk tolerance and measurements, plus triggers for an unscheduled review, such as a model change or a new incident. A profile is a snapshot, so an out-of-date profile misstates current gaps. Check that the cadence appears in policy and that past reviews left dated records. This supports GOVERN 1, which covers periodic review of policies and processes.

Third-party AI plan

Document which AI systems, pre-trained models and data come from vendors, what contract terms and information the organization receives, and what happens if a vendor system fails. Many gaps in a profile sit in the supply chain, where the organization cannot test internals. Check that the plan covers monitoring of vendor controls and a contingency for high-risk vendor AI. This supports GOVERN 6 and MANAGE 3, which cover third-party AI governance and operational monitoring.

Who owns the profile, who prepares evidence and who reviews it

Your organization owns the AI RMF profile, the risk tolerance behind it and every decision the profile records. NIST describes the framework as voluntary and says it does not validate or endorse any organization's approach, so the choice of which categories and subcategories apply, what the Current Profile says and what the Target Profile requires is yours to make and defend. Outside help can draft material, but the accountable owner must review and adopt it.

Profile decisions: Set the scope of the Current and Target Profiles, the risk tolerance and the go or no-go criteria for each AI system.
Accountability: Name the executive who accepts residual AI risk and the roles that answer for each Govern subcategory.
Controls and operations: Run the controls, monitoring and incident response the profile describes.
Documentation: Keep the inventory, decisions and records that show the profile is in use.
Outsourcing: System preparation, documentation drafting, evidence collection and testing can be outsourced, but the decisions cannot.

Before you sign any engagement, confirm in writing which artifacts you will own after handover.

Questions buyers ask about NIST AI RMF profiles

Is there an official NIST AI RMF profile template?

No. AI 100-1 states that the framework does not prescribe profile templates, so an organization shapes its profile around its own use case, risk tolerance and resources. The framework describes use-case, temporal and cross-sectoral profiles as implementations of the functions, categories and subcategories for a specific setting. Several organizations have published their own templates, and NIST's use cases page lists examples, but NIST does not validate or endorse any of them. Ask any template provider which subcategories it covers and how it maps to the AI RMF 1.0 numbering, since that mapping determines whether your evidence will read clearly to a customer or regulator.

Does a customer have to see a NIST-published profile?

Usually not. Customers and contracts can ask for evidence against the AI RMF, but none of the published NIST profiles is a required format, and the framework is voluntary. The most useful answer is a Current Profile and a Target Profile that name the subcategories you address, explain the gaps and show owners and dates. If a customer names a specific profile, such as the Generative AI Profile, align your documentation to that profile's suggested actions. Confirm the exact expectation in the contract language before you choose a format.

What is the difference between the Current and Target Profile?

The Current Profile shows how AI is being managed today, and the Target Profile shows the outcomes you need to reach your goals. AI 100-1 explains that comparing the two reveals gaps and helps you estimate the staffing and funding needed to close them. In practice, the Current Profile records evidence for each subcategory you assess, such as an AI inventory entry or a documented risk decision. The Target Profile sets the level you commit to, based on your risk tolerance and the requirements that apply to each system. The gap list between them becomes your remediation plan.

Is the critical infrastructure profile final?

No. On April 7, 2026, NIST released a concept note for an AI RMF Profile on Trustworthy AI in Critical Infrastructure, and NIST lists it as an ongoing project as of October 2026. The concept note is meant to guide operators on managing risk for AI-enabled capabilities across IT, operational technology and industrial control systems. NIST gathers input through a community of interest. If you operate in critical infrastructure, treat the concept note as direction, not as a finished profile, and confirm the current status on the NIST project page before you cite it in a contract or filing.

Does the Cyber AI Profile apply to AI RMF work?

Not directly. NIST IR 8596, the Cybersecurity Framework Profile for Artificial Intelligence, is a community profile of the Cybersecurity Framework 2.0, not of the AI RMF. Its initial preliminary draft was released December 16, 2025, and comments closed January 30, 2026, with NIST saying the comments will inform an initial public draft. It is useful when your AI risk work overlaps with security operations, because its outcomes sit in the CSF structure. Your AI RMF Current and Target Profiles should still use AI RMF subcategories, and you can cross-reference the Cyber AI Profile where security evidence supports a subcategory.

How much effort does a profile take and what does the work need from our staff?

Effort depends mainly on the number of AI systems in scope, how many of the 72 subcategories you assess, and how much evidence already exists. The main roles are a sponsor who accepts the risk decisions, system owners who describe their use cases, and risk, security and legal staff who review the Map and Measure outputs. Staff need time to inventory systems, confirm intended purpose and document decisions, which is the work the Playbook prompts. Ask any partner for a written scope that lists the systems, the subcategories and the staff roles, because those three items set both the cost and the calendar.

Can we build our own profile without an outside partner?

Yes, if you have internal people who understand the AI RMF and your systems. NIST encourages organizations to produce profiles jointly or independently, and the framework does not require outside help. Internal teams often start with the GOVERN outcomes, then move to Map, Measure and Manage. An outside implementation partner can prepare systems, controls and evidence, and can help build the profile and its documentation, but only an independent assessor or certification body issues reports. Whichever route you take, make sure the profile is reviewed by people independent of the team that built the AI system.

How DeployOpen prepares systems and evidence for your NIST AI RMF profile

DeployOpen helps you prepare the systems and evidence behind your NIST AI RMF profile, but the profile itself is your decision. Before any work starts, the scope is agreed in writing: which AI systems are in scope, which Current Profile you are documenting, which Target Profile you are working toward, and which subcategories of the 72 the work will cover. Because the AI RMF is voluntary and has no certification, the written scope is the main control on what gets delivered. Confirm with your own legal or risk team which subcategories matter to your customers and regulators before you sign it.

Within that scope, DeployOpen prepares the platforms and documentation that show how your AI systems are governed, mapped, measured and managed. In practice this can include self-hosted tooling for the AI inventory, evaluation and monitoring records, and the documentation prompts that the Playbook points to, all kept inside your own infrastructure. The work is handed over as artifacts you own: configuration records, runbooks, test results and gap-tracking material. Ask for a list of each artifact, the subcategory it supports, and who maintains it after handover. Those answers tell you how much internal effort the profile will need once the engagement ends.

DeployOpen does not issue audit reports, attestations or certifications, and nothing it prepares should be presented as one. Any external review of your profile is performed by an independent party that you select and pay, and no outcome is guaranteed by DeployOpen. Ongoing support, upgrades and continuous testing are available as retainers, which suits organizations whose profile must be refreshed as NIST revises AI RMF 1.0 or as the planned critical infrastructure profile moves forward. Request a written quote that separates the one-time preparation from any recurring retainer.

NIST AI RMF profiles