Guides to the generative AI risks and primary considerations in NIST AI 600-1 that matter most to organizations running or buying generative AI: what each risk covers, which suggested actions address it and what evidence a program shows for it.
How the Generative AI Profile defines confabulation, why NIST says it is a natural result of how generative models work, where it causes harm in consequential decisions, and the profile's actions for grounding, provenance checks and post-deployment monitoring.
What the Generative AI Profile means by information security risk: generative AI lowering the barrier for attackers while expanding the attack surface through prompt injection, data poisoning and model weight exposure, and the Measure actions for assessing and red teaming it.
How the Generative AI Profile treats privacy: personal data in training sets, memorization and leakage, inference of sensitive data a model was never given, and the monitoring, red teaming and privacy measurement actions NIST suggests.
How the Generative AI Profile handles third-party models, datasets and libraries: why NIST says the risk is worse for generative AI, the procurement, contract and incident response actions it suggests, and what to document about pre-trained models.
What the Generative AI Profile means by harmful bias and homogenization, including performance gaps across languages and model collapse from synthetic data, how MEASURE 2.11 tests it, and how the planned AI RMF revision and Texas law frame the topic.
How the Generative AI Profile describes risks from how people and generative AI systems interact: automation bias, over-reliance, algorithmic aversion and emotional entanglement, plus the oversight levels and acceptable use policies it suggests.
How the Generative AI Profile treats copyright, trademark and trade secret risk from training data and outputs, why NIST says the law is unsettled, and the training data review, output filtering and contract actions it suggests.
What the Generative AI Profile says about information integrity and the content provenance tools it recommends: provenance metadata, watermarking and fingerprinting, the organizational steps for tracking provenance, and how detection accuracy is measured.
What the Generative AI Profile says about testing generative AI before release: the limits of benchmarks and jailbreak tests, structured public feedback, the four types of AI red teaming, and why Texas law and Colorado's former AI Act referred to red teaming.
How the Generative AI Profile defines an AI incident, why NIST says formal reporting channels do not exist, the logging and documentation practices it recommends, third-party incident plans, and the AI Action Plan's push to fold AI into incident response.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.