Privacy & Information Security Law Blog

In April 2024, the National Institute of Standards and Technology (“NIST”) released an initial draft of its AI Risk Management Framework Generative AI Profile. As we previously reported, NIST released the AI Risk Management Framework (the “AI RMF”) in January 2023, providing a set of guidelines for organizations to ensure the trustworthy and responsible use and development of AI systems. Profiles are companion documents to the NIST AI RMF that provide context on how companies can put the RMF into practice in a specific sector or across sectors. NIST’s Generative AI Profile is an example of a cross-sector profile.

The Generative AI Profile defines a group of 12 risks that are novel to or exacerbated by the use of generative AI. NIST identified data privacy, information security and information integrity as three of the key risks relating to generative AI. NIST provides a set of actions to help organizations govern, map, measure and manage these risks consistent with the AI RMF.

Examples of actions companies can take to address the risks associated with generative AI as outlined in the Generative AI profile include:

• Aligning generative AI use with applicable laws and policies, including those related to data privacy;
• Defining and communicating organizational access to generative AI through management, legal and compliance functions;
• Disclosing use of generative AI to end users;
• Defining acceptable uses for generative AI systems, where some applications may be restricted;
• Conducting impact assessments or reviewing past known incidents and failure modes to prioritize and inform risk measurement;
• Curating and maintaining high-quality datasets that are accurate, relevant, consistent and representative;
• Conducting periodic audits and monitoring AI-generated content for privacy risks and addressing any possible instances of sensitive data exposure; and
• Considering using synthetic data, as applicable, to train AI models in place of real-world data, in order to match the statistical properties of real-world data without disclosing personally identifiable information.

To read more and view the full set of actions, please see the Generative AI profile. NIST accepted public comments on the profile until June 2, 2024.