NIST AI 600-1Final2024

Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile

At a glanceApplies the AI Risk Management Framework to generative AI such as chatbots and image generators. It names risks that generative AI creates or makes worse, from confabulated answers to data privacy and information security, and lists suggested actions. A practical companion for district generative AI guidance.

Reading level: Practitioner
Length: 64 pages · about 40 min for the key parts
Best for: Superintendents and cabinet, Technology directors, Business officials
CSF 2.0: Govern, Identify, Protect

Read it on NIST DOI 10.6028/NIST.AI.600-1 ↗

Browse the full library. 70 NIST publications summarized for school districts.

Key concepts

The profile describes risks unique to or heightened by generative AI and maps suggested actions to the Govern, Map, Measure and Manage functions. Organizations choose actions that fit their goals and risk tolerance. Because the parent framework is being revised, the profile may also change.

How it is organized

Overview of risks unique to or heightened by generative AI
Suggested actions by AI RMF function
Appendix A: primary generative AI considerations
Appendix B: references

What a school district should take from it

Set rules for what data staff may enter into generative AI tools, especially student records.
Plan for wrong but confident answers: human review before AI output affects students or decisions.
AI-generated phishing and impersonation raise the stakes for verification procedures.

How to use it in your district

Draft or update the district's generative AI guidance using the risk list as a checklist.
Approve specific tools for staff use and record their data terms in the Vendor Registry.
Add AI-enabled fraud (voice or video impersonation) to business office training.
Review the guidance each year as tools and NIST guidance change.

Common misconceptions

Generative AI risk is mainly about cheating.: The profile covers privacy, security, accuracy, intellectual property and other risks that affect staff use as well.

Rubric categories and K12 Cyber Forward tools

Cybersecurity Rubric 2.0 categories

GV.POPolicy
GV.SCCybersecurity Supply Chain Risk Management
ID.RARisk Assessment
PR.DSData Security

Tools in the program portal

Policy BuilderDraft policy language tied to rubric categories
Student data privacy agreementsTrack a signed agreement for every vendor that receives student data
Training TrackerRecord awareness training and phishing exercises

Related publications

AI RMF 1.0 (NIST AI 100-1)AI Risk Management Framework
Privacy Framework 1.0 (CSWP 10)NIST Privacy Framework

Citation and source

NIST AI 600-1, Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile. National Institute of Standards and Technology. 2024. https://doi.org/10.6028/NIST.AI.600-1.

Topics: Artificial intelligence, Privacy and student data. This summary was written by the K12 Cyber Forward program team in its own words. NIST is not affiliated with the program and has not reviewed it. The official publication on csrc.nist.gov controls.