NIST Wrote a Playbook Just for Generative AI

The NIST AI Risk Management Framework was written to cover all AI, which means it doesn't say much about your specific chatbot. That's where profiles come in: NIST publishes companion guides that apply the framework to particular technologies. The generative AI profile is the one most teams should read.

It names the risks that are special to generative tools. Confabulation: the model inventing facts with total confidence. Data leakage: your team's prompts becoming somebody else's training data. Intellectual property tangles. And the environmental and labor questions behind the models themselves.

The profile also stresses something teams forget: generative AI inherits the risks of the general framework too. You still need governance, testing, and an incident plan. The profile doesn't replace the RMF; it focuses it. Read the risk list once, check which ones apply to you, and start there.

I explain frameworks; I don't give legal counsel.