NIST AI 600-1: A Generative AI Risk Catalog Built on a Revoked Executive Order

NIST published the Generative AI Profile, AI 600-1, on July 26, 2024: twelve risk categories unique to or worsened by generative AI, and 212 suggested actions across the AI Risk Management Framework’s Govern, Map, Measure and Manage functions. It is the most detailed federal catalog of generative AI risk that exists. It is also, as of this writing, a document whose legal foundation has been revoked, whose own home agency has been told to rewrite three of its twelve categories, whose 212 actions carry no minimum tier, and whose threat model was scoped before agentic AI became the deployment pattern federal health programs are actually buying. Anyone in VA, DHA, or IHS citing AI 600-1 in acquisition or governance language today is citing guidance in visible transition, not a settled standard.

What the profile covers

AI 600-1 is a “cross-sectoral profile” applying the base AI RMF’s four functions specifically to generative AI, developed under Section 4.1(a)(i)(A) of Executive Order 14110. Its twelve risks: CBRN Information or Capabilities, Confabulation, Dangerous/Violent/Hateful Content, Data Privacy, Environmental Impacts, Harmful Bias and Homogenization, Human-AI Configuration, Information Integrity, Information Security, Intellectual Property, Obscene/Degrading/Abusive Content, and Value Chain and Component Integration. Each gets a technical description and a Trustworthy AI Characteristic tag. Section 3 lists the 212 actions (58 Govern, 39 Map, 72 Measure, 43 Manage); Appendix A covers four areas the drafting group actually focused on: governance, content provenance, pre-deployment testing, and incident disclosure.

The order that authorized it no longer exists

President Trump’s EO 14179, signed January 23, 2025, revoked EO 14110 and, under Section 5(a), “all policies, directives, regulations, orders, and other actions taken pursuant to” it. AI 600-1 was one of those actions. NIST has not withdrawn or superseded it. Its AI RMF landing page still lists the profile as active, and NIST published a crosswalk between AI 600-1 and Singapore’s IMDA AI Verify framework in May 2025, four months into the new administration, treating the document as current reference material. The document is neither dead nor confirmed. That ambiguity is the finding: guidance can outlive the order that created it, by inertia, without anyone formally deciding it should.

A rewrite was ordered, and hasn’t shipped

America’s AI Action Plan, released July 23, 2025, directs NIST to “revise the NIST AI Risk Management Framework to eliminate references to misinformation, Diversity, Equity, and Inclusion, and climate change.” That lands squarely on AI 600-1. Three of its twelve categories are named or adjacent targets: Information Integrity discusses mis- and disinformation directly, Harmful Bias and Homogenization is DEI-adjacent by subject, and Environmental Impacts is the climate category by name. NIST’s AI RMF page describes the revision as being done, present tense, not shipped. Over a year after the directive, no revised framework or profile has been published. A solicitation clause citing AI 600-1’s information integrity category today is citing language its own publishing agency has been told to remove, on a timeline nobody has committed to.

212 actions, no floor

The profile offers no minimum viable subset, no tiering by agency size or risk exposure, and no companion Playbook of the kind the base AI RMF has. A small agency component gets the same undifferentiated 212-item list as a hyperscale model developer. The UC Berkeley Center for Long-Term Cybersecurity’s public comment on the June 2024 draft recommended NIST designate a prioritized minimum tier; the final document did not adopt it. The same comment flagged that a proposed socioeconomic and labor-displacement risk category was dropped from the final twelve, a point independent analysis confirmed publicly. For a document positioned as implementation guidance, 212 actions with no floor reads as a taxonomy dressed as a checklist.

It was never a mandate, and still isn’t

Neither OMB memo governing federal AI use, before or after the transition, made the AI RMF or AI 600-1 mandatory. M-24-10 only “encouraged” agencies to incorporate it as one of several best-practice resources. M-25-21, which rescinded and replaced M-24-10, moved away from prescriptive minimum practices toward a single high-impact AI category and more agency discretion. GAO’s September 2025 catalog of 94 government-wide AI-related requirements does not list AI 600-1 or the AI RMF among them at all, which is itself confirmation that GAO does not treat the profile as binding. AI 600-1 has always been optional. What changed is that the memo structure that once pointed toward it has been rebuilt around agency discretion instead.

The threat model predates the thing agencies are deploying now

AI 600-1’s risks were scoped to generative content: a model producing text, images, audio, or video in response to a prompt. That is not the deployment pattern federal health IT is moving toward. Multi-step, tool-using, autonomously acting agents introduce failure modes the profile does not name: delegation-chain accountability, cross-session memory persistence, tool-output prompt injection, autonomy-tier classification. NIST’s own subsequent action is the clearest admission of the gap: its Center for AI Standards and Innovation announced a dedicated AI Agent Standards Initiative in February 2026, roughly a year and a half after AI 600-1 shipped, rather than revising 600-1 itself. Independent research reaches the same conclusion: the Cloud Security Alliance describes the AI RMF and AI 600-1 as built for a “generate content” threat model, with no coverage of agentic delegation or tool-chain compromise. A federal health program evaluating clinical documentation agents, prior-authorization agents, or RPA-plus-LLM hybrids against AI 600-1 alone is measuring against a document that does not model the risk surface it is being asked to cover.

A different institute inherited the document

The institute that wrote AI 600-1 no longer has the same mission. AISI became CAISI on June 3, 2025, and Commerce’s statement announcing the change was explicit about the reframing: “For far too long, censorship and regulations have been used under the guise of national security. Innovators will no longer be limited by these standards.” CAISI’s current mission language centers competitiveness, national-security evaluation of adversary models, and resisting foreign regulation of American technology; “safety” as an organizing word is gone from its mission bullets. AI 600-1 was written by and for an institute organized around trustworthy-AI risk management. It is now maintained, insofar as it is maintained at all, by an institute organized around a different set of priorities, without the document itself being rewritten to match.

What the profile gets right

None of this makes AI 600-1 a bad document. The twelve-risk taxonomy is a genuinely useful shared vocabulary, several categories (confabulation, data memorization, prompt injection) are described with real technical precision, and the Govern/Map/Measure/Manage structure gives an organization that has never thought systematically about generative AI risk a place to start. The gap is not the content of the 212 actions. It is the absence of sequencing, the absence of a maintained connection to current threat models, and the absence of clarity about the document’s own standing.

The doctrine reading

Two of these findings are exactly the gaps the Governed Autonomy Framework was built to close, arrived at independently. AI 600-1’s missing threat model, delegation-chain accountability, cross-session memory persistence, tool-output injection, is the territory Law 4, Trust Does Not Travel, and the Multi-Agent Trust and Delegation plane exist to cover. And the 212-actions-with-no-floor problem is precisely what the Maturity Model answers with a tiered alternative: never deploy agents beyond your current governance maturity, rather than handing every organization the same flat, undifferentiated list regardless of size or exposure. A federal standard reaching the edge of its own coverage from a completely different starting point is corroborating evidence, not just an analogy.

What to do about it

For federal health programs citing AI 600-1 in governance, acquisition, or solicitation language, three concrete moves hold up:

• Don’t cite it as a floor by itself. Pair it with an agency-specific minimum tier drawn from the risks that actually matter for the deployment. For clinical or PII-adjacent generative AI, that means Data Privacy, Confabulation, Information Security, and Human-AI Configuration, not all 212 actions treated as equally load-bearing.
• Treat the citation as provisional, in writing. Any solicitation clause, RFP evaluation criterion, or internal policy referencing AI 600-1 should note the pending White House-directed revision and pin the citation to the July 2024 text as published, so a future rewrite doesn’t silently change the meaning of an already-issued document.
• Supplement, don’t substitute, for agentic deployments. Where the system involves multi-step or tool-using agents, treat AI 600-1’s twelve categories as necessary but not sufficient, and track NIST’s AI Agent Standards Initiative directly rather than stretching a generative-content profile to cover a risk surface it was never scoped for.

AI 600-1 is worth reading in the original: it remains the clearest public vocabulary for generative AI risk the federal government has produced. The gap is not the taxonomy. It is citing it as though it were a settled, prioritized, currently-maintained standard, when as of this writing it is none of those three.