NIST AI RMF and the Generative AI Profile

0:00 NIST AI RMF

If the EU AI Act tells you what you must do, the NIST AI Risk Management Framework tells you how to think about doing it well. It's free, voluntary, recognized by enterprise buyers worldwide, and it has a companion profile just for generative AI. In this lesson, you'll learn the seven characteristics of trustworthy AI, the four functions, Govern, Map, Measure and Manage, the twelve generative AI risks, and how to write a one-page risk profile for any AI use case.

0:35 Why NIST, wherever you are

Why learn a voluntary US framework if you're in Pakistan, the Gulf or the UK? Because it's become a common language. Enterprise buyers, auditors and partners around the world recognize its four functions. It maps neatly to the EU AI Act and to ISO forty-two thousand and one. And its Generative AI Profile is one of the clearest catalogs of generative AI risks available anywhere, free. Using its vocabulary makes your governance documents easier for others to understand and trust.

1:10 What it is

Some background. NIST, the US National Institute of Standards and Technology, published AI RMF one point zero in January twenty twenty-three. It's not a law, and there's no certificate. Its value is a shared vocabulary and a structured checklist. NIST backs it with a playbook of suggested actions, and in July twenty twenty-four released NIST AI six hundred dash one, the Generative AI Profile. Companies in the US use it directly. EU companies map it to the AI Act. And organizations in the Gulf and Pakistan use it because it's practical and buyers recognize it.

1:51 Analogy: a pre-flight checklist

An analogy: the NIST framework is like a pilot's pre-flight checklist. It doesn't fly the plane and it isn't a law. But it makes sure experienced people don't skip steps under pressure. Govern is the airline's rules and crew roles. Map is checking the route, weather and passengers. Measure is reading the instruments. Manage is deciding what to do when something looks wrong, including whether to turn back. Pilots with checklists aren't slower. They're more reliable.

2:24 Trustworthy AI characteristics

NIST describes seven characteristics of trustworthy AI. Valid and reliable, which is the foundation. Safe. Secure and resilient. Accountable and transparent, which runs across everything. Explainable and interpretable. Privacy-enhanced. And fair, with harmful bias managed. Here's the important nuance: these trade off against each other. Making a model more interpretable can cost accuracy. Stronger privacy can make fairness testing harder. Governance is about making those trade-offs consciously and writing down why.

2:55 Four functions

Now the four functions. Govern sets the culture, policies, roles and risk tolerance, and it applies across everything. Map understands the context of each system: its purpose, users, affected people, benefits and risks. Measure analyzes and tracks those risks with tests, metrics, bias checks and red-teaming. And Manage prioritizes and acts: treatment plans, monitoring, incident response, even criteria for switching a system off. Each function breaks into categories and subcategories you can use as a checklist.

3:28 12 GenAI risks (examples)

The Generative AI Profile names twelve risks. Some are mainly for model developers, like chemical, biological, radiological and nuclear information. But many hit ordinary businesses. Confabulation, where a chatbot invents a refund policy. Data privacy, when staff paste customer lists into a public tool. Harmful bias and homogenization, when ad creative stereotypes people or every brand starts to sound the same. Human-AI configuration, when people stop checking outputs. Information integrity, like deepfakes. Information security, like prompt injection. Intellectual property. Abusive content. And value chain risks from hidden third-party models and plugins.

4:08 Worked example: booking chatbot

Here's how it looks in practice. A US home-services company runs an AI booking chatbot. Govern: the policy says it may answer FAQs and book appointments but never quote prices outside the published list, and the customer experience manager owns it. Map: homeowners in three states, with risks of invented prices, address privacy and accessibility for older users. Measure: two hundred test conversations including pricing traps and prompt injection, with a target of zero invented prices. Manage: human handoff after two failed intents, an incident log, a weekly metrics review, and a documented kill switch.

4:49 NIST meets the AI Act

NIST maps neatly onto the EU AI Act. AI literacy, policies and roles live in Govern. Classification, intended purpose and impact assessment live in Map. Accuracy, robustness and bias testing live in Measure. Human oversight, monitoring and incident reporting live in Manage. So many teams organize their AI Act evidence using NIST's structure. One warning: the Generative AI Profile lists more than two hundred suggested actions. Don't copy them all into a spreadsheet nobody reads. Pick the ones that fit your use cases and risk tolerance, justify the choice, and act on them.

5:29 Example 2: freelance writer profile

A simpler example. A freelance writer in Karachi offers an AI-assisted blog writing service. Her one-page NIST-style profile: Govern, her own policy says AI drafts, she edits, and she never invents statistics. Map: clients in fintech and health, so confabulation and intellectual property are her key risks. Measure: she fact-checks every claim and runs a plagiarism check on each article. Manage: any error found after publishing gets corrected within a day and logged. It takes twenty minutes to write, and she can show it to clients who ask how she uses AI.

6:09 Common mistakes

Common mistakes. Treating NIST as a certificate you can hang on the wall. It's voluntary guidance, and saying you're NIST certified will raise eyebrows with informed buyers. Copying all two hundred plus Generative AI Profile actions into a spreadsheet nobody reads, instead of selecting the ones that fit. And skipping Measure: without tests and metrics, Manage is just guesswork, and you can't show that your controls work.

6:38 Watch me do it: one-page RMF profile

Watch me do it. I pick the highest-impact row in the register, our website support chatbot, and open a text file called chatbot-rmf-profile. Govern: I write the owner, patient experience manager, the policies it follows, and our risk tolerance: zero tolerance for clinical advice, low tolerance for booking errors. Map: purpose, answering non-clinical questions and booking. Affected people: patients and front-desk staff. From the twelve generative AI risks I pick four that genuinely apply: confabulation, data privacy, human-AI configuration and information security. Legal: UAE and UK data protection, and chatbot disclosure for EU users. Measure: a hundred and fifty scripted conversations, thirty of them clinical-advice traps, a prompt injection suite, and an Arabic and English parity check. Targets: zero clinical advice, at least ninety-five percent booking success. Manage: refusals in the prompt, retrieval limited to the approved FAQ, a human handoff button, and personal data redacted from logs. Monitoring: fifty conversations reviewed weekly. And an incident rule: disable the bot by feature flag and notify the privacy lead within twenty-four hours if data is exposed.

7:54 Recap and next step

Recap. The NIST AI RMF is voluntary guidance with a powerful structure: seven trustworthy characteristics, four functions, and a generative AI profile with twelve risks. Use it to organize your thinking and your evidence, including for the EU AI Act. Your next step: pick your highest-impact AI use case and write a one-page profile using the YAML template in the lesson text, with an owner, risks, tests, metrics, controls and a review date.