NIST Just Released an AI RMF Profile for Critical Infrastructure. Here's What's in It.
NIST published the AI RMF Profile for Trustworthy AI in Critical Infrastructure on April 7, 2026. Here's what the document actually says, how it maps to existing CIP compliance requirements, and what operators need to understand now.
NIST published a concept note on April 7, 2026: the AI RMF Profile for Trustworthy AI in Critical Infrastructure. If you're operating in a NERC/FERC-regulated environment and you've been watching the AI risk management conversation, this is the document you've been waiting for. It's not a final standard. It's not mandatory yet. But in NIST's timeline, concept notes become profiles, profiles become referenced in guidance, and guidance becomes what your assessors are asking about. Here's what it actually says.
Looking for the source document? Read the official concept note: Development of the NIST AI RMF Trustworthy Use of AI in Critical Infrastructure Profile (PDF), or the NIST project page with the Community of Interest sign-up. What follows is the read-through for operators.
What NIST Actually Released
The document NIST published on April 7, 2026 is a concept note, not a finalized profile, not a compliance requirement. That distinction matters, and it's worth being precise about what it means in NIST's process.
A concept note signals direction. It's a pre-profile document that lays out the framework NIST intends to develop, invites comment from practitioners and stakeholders, and establishes the vocabulary and structure the final profile will use. In NIST's typical timeline: concept note → workshop feedback → draft profile → public comment → final publication. That process takes 12–24 months.
This places the April 7 release in the context of the broader AI RMF ecosystem:
NIST AI RMF 1.0: The foundational framework. Four core functions: Govern, Map, Measure, Manage. Voluntary, technology-neutral guidance for organizations developing or deploying AI.
NIST AI 600-1 (Generative AI Profile): The first sector-specific profile under AI RMF 1.0. Addresses risks specific to generative AI systems: confabulation (hallucination), data poisoning, prompt injection, and bias amplification, across 12 named risk categories.
AI RMF Profile for Critical Infrastructure (Concept Note): Sector-specific guidance for critical infrastructure operators. Maps AI RMF functions to the operational realities of regulated environments.
NIST's Information Technology Laboratory (ITL) AI Program owns the development. The document invites feedback from operators, assessors, and sector-specific stakeholders before the full profile draft.
The organizations reading this now are the ones positioned to shape the final standard through comment and to have their programs ready when the profile moves from guidance to assessor expectation.
How the Framework Functions Map to Operational Technology (OT)
The AI RMF's four functions map directly onto how a critical infrastructure operator manages risk, though the vocabulary isn't always the same. Here's what each function actually means in an operational environment:
Who in your organization is accountable for AI systems, and what policies govern them
Governance asks: does your organization have a defined owner for each AI system in production? Is there a policy for when AI systems can be deployed in operational environments, and what approval is required? For NERC/FERC-regulated entities, this maps directly to existing accountability structures, but most haven't formally extended those structures to AI systems.
Identifying which AI systems exist, what they do, and what goes wrong if they fail
Map is the inventory and risk identification function. In a critical infrastructure context, this means cataloguing every AI system that interacts with your operational technology environment, and understanding the failure modes. An ML model that flags voltage anomalies on the SCADA network is a safety-relevant AI system. That changes how it's mapped and what controls are required.
Evaluating how well risk controls are working
The Measure function asks whether the controls you've implemented are actually performing as expected. For AI systems, this includes monitoring for model drift, output anomalies, and unexpected behavior, and having metrics that tell you when performance has degraded in ways that matter for safety or reliability.
Acting on what you find: mitigation, monitoring, incident response
Manage is operationalization. When the Measure function surfaces an anomaly, who acts? What's the escalation path? For critical infrastructure, a malfunctioning AI system may have safety implications that exceed normal IT incident response procedures. Manage asks whether the response process is defined and tested before an event occurs.
The profile specifically addresses AI systems that critical infrastructure operators actually encounter. These aren't abstract examples:
- The ML model flagging voltage anomalies on the SCADA network, producing recommendations that human operators act on in real time
- The LLM integrated into an operations center for incident triage, helping operators prioritize alerts and summarize event history
- Agentic monitoring pipelines that autonomously query operational data and generate reports
- Predictive maintenance systems using OT sensor data to schedule equipment servicing
Each of these systems sits at the intersection of AI risk management and critical infrastructure compliance, and that's precisely the gap the profile is designed to close.
Where It Intersects With CIP Compliance
This is where the profile creates immediate, practical implications. The mapping below is grounded in FEDLIN's work in NERC/FERC-CIP environments.
Three CIP standards map directly to AI RMF functions in ways that most operators haven't fully worked through:
CIP-010 and AI RMF Map: Configuration Change Management
CIP-010 governs configuration change management for BES (bulk electric system) Cyber Systems. An ML model update is a configuration change to a system. It changes how the system behaves, what outputs it produces, and what recommendations it makes to operators. Does your current change management process capture model version updates? Training data changes? Prompt modifications to an LLM used in operations?
Most CIP-010 implementations were designed before AI systems were in operational environments. The AI RMF Map function surfaces exactly this gap: the inventory of AI systems and their dependencies hasn't been formally extended to the change management process. That's the work the profile creates.
AI that informs real-time operator decisions on high- or medium-impact BES Cyber Systems: SCADA anomaly detection, situational-awareness tools, automated alert triage.
Planning, forecasting, and internal analytics tools, generally not classified as BES Cyber Assets.
CIP-013 and AI RMF Govern: Supply Chain Risk Management
CIP-013 covers supply chain risk management for industrial control systems. The vendor providing your AI system (the foundation model provider, the data pipeline company, the API dependency your agentic system calls at runtime) is a supply chain vendor. The AI RMF Govern function requires that AI supply chain dependencies be assessed and managed, with accountability for those systems defined.
Most critical infrastructure operators haven't assessed AI vendors through the CIP-013 lens. The concept note makes that gap explicit. When the final profile arrives, assessors will be asking whether AI system vendors have been included in supply chain risk assessments.
A vendor whose AI system has operational connections to medium- or high-impact BES infrastructure, likely triggers CIP-013.
A foundation-model provider used only for internal analytics doesn't trigger CIP-013.
That determination hasn't been formally tested yet, which is exactly why it's worth working through before an assessor does.
CIP-007 and AI RMF Measure: Security Event Monitoring
CIP-007 requires security event logging and monitoring for BES Cyber Systems. An AI system producing anomalous outputs (unexpected recommendations, unusual tool calls, behavior inconsistent with its training profile or operational baseline) is generating security-relevant events. The question the AI RMF Measure function asks is whether those events are being captured.
For most environments, AI system output anomalies aren't in the security event log. They may be logged somewhere (model inference logs, application logs), but not as security events, not correlated against other security data, and not reviewed by the same team responsible for CIP-007 compliance. The Measure function brings this into scope.
These three intersections aren't the full scope of the profile, but they're where the compliance work begins. Organizations with existing CIP programs can use them as a starting point for gap assessment before the profile is finalized.
Gaps the Full Profile Will Address
The concept note signals direction, not implementation specifics. Several things are explicitly absent and worth flagging:
- No specific control requirements mapped to CIP standards; that comes in the full profile
- No implementation timeline or compliance deadline; this is guidance, not enforcement
- No guidance on how CIP assessors should evaluate AI systems; that's a NERC enforcement question, not a NIST one
- Final profile guidance is pending; the concept note invites comment, and the document will evolve through the publication process
The point that matters
In NIST's process, concept notes become standards. The organizations that understand the concept note now are the ones positioned to shape how the final profile is written, and to have their programs ready when assessors start asking about AI risk management in critical infrastructure environments. The first-mover window on the concept note is open. That window closes when the draft profile publishes.
The April 7 release is the beginning of a process, not a deadline. But the process has started, and the organizations paying attention now will be significantly ahead of those who wait for a requirement.
Sources
- Concept Note: Development of the NIST AI RMF Trustworthy Use of AI in Critical Infrastructure Profile (April 7, 2026, PDF)
- NIST project page: AI RMF Profile on Trustworthy AI in Critical Infrastructure
- NIST AI Resource Center: AI RMF and associated profiles
- NIST AI RMF 1.0 (NIST AI 100-1, January 2023)
- NIST AI 600-1: Generative AI Profile
- NERC CIP Standards: CIP-007, CIP-010, CIP-013
Running AI in a NERC/FERC-regulated environment?
The three intersections above (CIP-010 for model updates, CIP-013 for your AI vendors, CIP-007 for AI output monitoring) are where I'd start a gap assessment. FEDLIN works inside NERC/FERC-CIP environments and implements NIST AI RMF controls at the infrastructure layer, including for the agentic and LLM systems this profile brings into scope. Book a scoping call and we'll map these intersections to your specific program while the first-mover window is still open, before the draft profile turns them into an assessor question. You can also see how we harden agentic & MCP systems.
Book a scoping callSecuring AI-native infrastructure?
FEDLIN extends the NIST 800-53 baseline with NIST AI RMF: verifiable controls for LLM integrations, MCP servers, and agentic pipelines, mapped to your target framework.
Subscribe to Security Insights
Get enterprise security tips, compliance guides, and best practices delivered to your inbox.