Tracker / guidance guidance United States comment period 4/10
Government · NIST Computer Security Resource Center
NIST's NIST IR 8596 initial preliminary draft proposes a voluntary Cyber AI Profile based on CSF 2.0. It covers securing AI components, using AI for cyber defense, and countering AI-enabled attacks, but remains under development and does not create binding legal duties.
Action required
Track subsequent NIST drafts and assess whether the proposed voluntary cybersecurity priorities should inform the organization's AI risk-management planning.
Binding status
advisory; preliminary draft; voluntary guidance context
Governing body
National Institute of Standards and Technology
Innovation impact
enabling
Compliance requirements
Transparency requirements
Communicate intended uses, capabilities, limitations, dependencies, and relevant AI cybersecurity risks to stakeholders. AI technologies
large language models generative ai predictive analytics recommendation systems reinforcement learning ai agents foundation models nlp
Affected roles
ciso cto chief ai officer compliance officer risk manager data scientist product manager
Frameworks
nist ai rmf nist ai rmf
Cross-references
Cites standards
NIST Cybersecurity Framework 2.0, NIST AI Risk Management Framework, NIST SP 800-53 Rev. 5, NIST SP 800-161 Rev. 1, NIST SP 800-218
Enriched 2026-04-22 · resolved via nist publication
Stay informed
Get daily intelligence briefs on this and related regulatory developments.
Start 14-day trial Important — about this brief
This brief is published by AIGI as a regulatory intelligence service. It
contains general information about AI laws, regulations, enforcement
actions, and policy signals across jurisdictions. It is not legal,
compliance, audit, or risk-management advice; it does not establish an
attorney-client, advisory, or fiduciary relationship; and it should not
be relied upon as a substitute for professional counsel applied to
specific facts and circumstances. Where the brief identifies “Issues
for Review,” those are observations of questions a reader in a
particular role might raise with their own legal, compliance, or risk
function — not recommendations to act. AIGI expressly disclaims
liability for actions taken or not taken in reliance on this brief.
Subscribers in regulated industries should consult licensed
professionals authorized to practice in their jurisdiction.
Terms and disclosures →