S9.04 - NIST_GenAI_Profile

S9.04 ? NIST GenAI Profile

flowchart LR
    A[Generic AI governance is often too broad for variable GenAI runs] --> B[RAIDT - run-level evidence framework]
    B --> C[[NIST GenAI Profile - GenAI-specific governance translation layer]]
    C --> D[Run-level evidence pack]
    C --> E[RAIDT score profile]
    C --> F[Reviewability and contestability]
    D --> G[Reviewer reconstruction]
    E --> H[Governance readiness]
    F --> H
    I[Public services]
    J[Healthcare]
    K[Finance]
    L[Education]
    M[Enterprise productivity]
    N[Logging and monitoring]
    O[Prompt templates and review checkpoints]
    I --> C
    J --> C
    K --> C
    L --> C
    M --> C
    N --> C
    O --> C

? Star S9 - Policy, Standards and Assurance

Star context: Connects RAIDT to policy instruments, standards, assurance, procurement, audit and organisational accountability, with particular emphasis on how generative AI requires more specific controls than general AI governance frameworks usually provide.

Academic picture

Definition / background

The NIST GenAI Profile is a generative-AI-specific profile that interprets and extends general AI risk management expectations for the distinctive characteristics of generative systems. Conceptually, it sits close to the NIST AI RMF but adds sharper attention to issues that become more prominent in GenAI deployments, including variability of outputs, prompt and context sensitivity, content harms, misuse pathways, downstream reliance, model and data provenance questions, and the need for more continuous monitoring after deployment.

In governance terms, a profile is useful because it translates broad principles into a more targeted set of risk questions, control expectations, and assurance activities for a particular technology domain. For GenAI, that matters because a system can appear acceptable at policy level yet still behave unpredictably in particular operational runs. The NIST GenAI Profile therefore helps move organisations from generic claims such as ?we manage AI responsibly? towards more specific questions such as what was configured, what was prompted, what was produced, what checks were applied, what evidence was captured, and whether the use remained acceptable in its actual context.

This is why the concept belongs inside RAIDT. RAIDT treats the run as the unit of governance, and the NIST GenAI Profile strengthens the case that GenAI governance must be more context-sensitive, evidence-led, and operational than ordinary policy statements suggest. In RAIDT terms, the Profile informs what should appear in a run-level evidence pack and what kinds of weaknesses should affect the five-pillar score profile. It is therefore not just background policy material; it is a governance translation device between standards language and real, reviewable use.

The concept also differs from similar terms. It is not identical to the NIST AI RMF, which is broader and more technology-agnostic. It is not the same as a sector regulation, because it does not itself create legal obligations in the way legislation may. It is not merely an internal checklist, because it carries external standardisation value and helps align organisational practice with recognised governance expectations. Within RAIDT, its distinctive role is to make GenAI-specific governance expectations operational at the level where evidence can actually be inspected.

Why this concept matters

The NIST GenAI Profile matters because organisations often have governance language that is too general for the actual behaviour of generative AI systems. A principle such as transparency or accountability is important, but by itself it does not tell a reviewer whether a specific prompt configuration, retrieval setup, model version, human oversight step, or post-generation filter was adequate for a particular run. The Profile helps avoid that gap by making GenAI-specific governance expectations more concrete.

It also reduces confusion between policy compliance and operational assurance. An organisation may believe it is compliant because it has approved tools, written policies, and high-level review structures, yet still lack the evidence needed to examine whether a particular generative output was dependable, traceable, interpretable, or contestable. Without the Profile, governance can remain at the level of aspiration. With it, governance is pushed towards monitoring, evidence capture, use-context controls, and post-deployment learning.

If this concept is missing, a recurring risk appears: organisations govern the system class but not the actual run. That means they may approve a chatbot, drafting assistant, or summarisation tool in general, while failing to record enough evidence to explain one problematic output, one unsafe prompt chain, or one weak human review decision. The NIST GenAI Profile matters because it clarifies why generative AI governance must attend to operational variability rather than rely solely on static approval.

Key idea: The NIST GenAI Profile matters because it turns broad AI governance expectations into GenAI-specific operational questions that RAIDT can evidence at run level.

What this item controls

It controls how general AI risk management expectations are translated into generative-AI-specific governance checks.
It controls the focus on use context, recognising that risk changes across tasks, users, settings, and levels of reliance.
It controls the expectation that monitoring, testing, and review continue after initial deployment rather than ending at approval.
It controls how organisations think about prompt-driven variability, content harms, misuse, and downstream decision impact.
It controls the governance relevance of provenance, logging, human oversight, escalation, and incident response.
It controls how evidence should support claims of safe, responsible, and auditable GenAI use.
It controls the bridge between standards language and operational assurance artefacts such as RAIDT evidence packs and score profiles.

Practical example / likely audience question

Audience question

Why mention the NIST GenAI Profile at all if RAIDT already has its own framework for run-level governance?

Answer

The concern behind the question is that RAIDT might seem redundant if a recognised standard or profile already exists. The direct answer is that RAIDT does not duplicate the NIST GenAI Profile; it operationalises it. The Profile says, in effect, that generative AI requires more specific risk management attention than generic AI governance typically provides. RAIDT takes that insight and turns it into a method for capturing evidence about an actual run, scoring that run across governance pillars, and making the result reviewable by supervisors, auditors, or operational owners.

A practical example helps. Suppose an organisation uses a generative AI drafting assistant for policy summaries. A generic governance approach may confirm that the tool is approved, staff are trained, and there is a policy for human review. The NIST GenAI Profile sharpens the governance expectation by highlighting context-specific risks such as misleading synthesis, omitted caveats, dependency on prompts, or use beyond intended scope. RAIDT then handles the issue better than a generic approach by asking what happened in this run: which model was used, what instructions were given, what source material was provided, what output was produced, what human checks were performed, and how the run scored for responsibility, auditability, interpretability, dependability, and traceability.

So the value of mentioning the NIST GenAI Profile is not symbolic. It shows that RAIDT is aligned with recognised GenAI governance thinking while also addressing the practical weakness that standards documents often leave unresolved: how to make governance inspectable at the level of actual use.

Practical example in RAIDT terms

Consider a public-sector use case in which a caseworker uses a GenAI assistant to draft a response to a citizen complaint about housing allocation. The run-level issue is not simply whether the organisation has approved generative AI; it is whether this particular run used appropriate source material, whether the prompt constrained the model adequately, whether the output contained unsupported claims or tone problems, and whether a human reviewer checked the draft before it was sent.

The evidence needed would include the task purpose, user role, model and version, prompt template, any retrieved policy documents, the generated draft, revision history, human review notes, escalation criteria, and final approval status. The RAIDT pillars most affected would be Responsibility, because the organisation must define who may use the tool and under what conditions; Dependability, because the output must be accurate enough for the service context; and Traceability, because the reviewer should be able to reconstruct how the response was produced.

The NIST GenAI Profile improves governance readiness in this example by making it clear that generative-AI-specific concerns such as prompt dependence, harmful or misleading outputs, and the need for ongoing monitoring should be treated as operational governance matters. RAIDT then makes those concerns inspectable through the evidence pack and score profile for the individual run.

Detailed link to RAIDT

NIST GenAI Profile links to RAIDT in four ways.

First, it supports RAIDT's core idea that governance should be grounded in observable evidence rather than high-level assertions.
Second, it reinforces the importance of the run, because many GenAI risks only become visible in a specific configuration, prompt context, task setting, and output event.
Third, it informs the structure of the evidence pack and the scoring profile by indicating which GenAI-specific controls, checks, and monitoring signals should be documented.
Fourth, it strengthens reviewability, contestability, audit readiness, and organisational learning by showing why each run should be reconstructable and open to scrutiny.

NIST GenAI Profile ? Run-level evidence ? Evidence pack ? RAIDT score profile ? Governance readiness

In other words, the Profile supplies the governance logic, while RAIDT supplies the operational mechanism for making that logic visible, testable, and reusable in practice.

Link to the five RAIDT pillars

Responsibility

The NIST GenAI Profile strongly affects Responsibility because it requires organisations to define acceptable use, oversight expectations, role boundaries, and escalation arrangements for generative AI tasks.