On 26 July 2024 the US National Institute of Standards and Technology published the final version of AI 600-1, the cross-sector guide for managing generative AI risks. It identifies twelve risks specific to generative AI: CBRN information, hallucination, harmful content, data privacy, environmental impacts, bias, human-AI configuration, information integrity, information security, intellectual property, obscene content and value-chain risks. It sits alongside AI RMF 1.0 and offers organisations suggested actions.
Grouping the twelve risks
The twelve are not a flat checklist. By origin they fall into three groups. Model-behaviour risks cover hallucination, harmful content, bias and obscene content. Data-and-rights risks cover privacy and intellectual property. System-and-ecosystem risks cover information integrity, information security, CBRN information, environmental impact, human-AI configuration and the value chain.
The grouping matters because it locates the control point. Model behaviour is largely controlled by the developer. Data and rights span development and deployment. System and ecosystem risks involve platforms, users and upstream suppliers. Copying the twelve headings into a register usually produces a document nobody can act on; grouping by control point shows who owns each item.
Turning suggested actions into organisational work
The guidance points to three kinds of action: governance, measurement and documentation. Governance requires a named owner, a stated risk tolerance and a record of decisions. Measurement requires test sets, red-team exercises and metrics that show controls work. Documentation requires model cards, data statements and change logs that can be traced.
Measurement is the easiest of the three to hollow out. An “assessment” without a test set is, in a dispute, no assessment at all. The test set need not be large, but it should cover actual product scenarios and retain versions and results. Red-team findings belong in a remediation workflow, not an appendix.
The interface with AI RMF 1.0
AI RMF 1.0 provides the general framework of govern, map, measure and manage. AI 600-1 adds generative-specific risks and actions on top. Both are voluntary tools. Neither creates legal obligations nor displaces mandatory rules in any jurisdiction.
Voluntary does not mean irrelevant. Customer diligence, insurance underwriting and public procurement increasingly use this vocabulary. A risk register aligned to the framework lowers the cost of those conversations. A statement of principles without measurement records, by contrast, rarely survives professional review.
How Chinese companies can use it
The more realistic approach is a crosswalk, not a second system. Map the twelve risks onto the corpus, model, output and evaluation requirements of China’s generative AI security baseline, then onto the transparency and high-risk duties of the EU AI Act. One set of controls can then support several sets of materials.
The crosswalk should record differences. Jurisdictions define high risk differently, require disclosure to different audiences and set different retention periods. Listing the differences is more reliable than forcing uniformity. For cross-border deployment, also check whether the location of data and logs triggers localisation or outbound-transfer requirements.
For security controls and adversarial testing, see our cybersecurity compliance service; for training data and privacy risk, see data compliance; for provenance and rights review, see IP protection.
This article is based on the final AI 600-1, the cross-sector guide for managing generative AI risks, published by the US National Institute of Standards and Technology on 26 July 2024, and on public information. It is for reference only and does not constitute legal advice.