# NIST Starts an AI RMF Profile for Critical Infrastructure — Concept Note, Not a Mandate

Times of AI Desk · 2026-04-07 · Policy

[https://timesof.ai/2026/04/nist-ai-rmf-profile-trustworthy-ai-critical-infrastructure](https://timesof.ai/2026/04/nist-ai-rmf-profile-trustworthy-ai-critical-infrastructure)

> NIST’s April 7 concept note launches work on an AI RMF Profile for Trustworthy AI in Critical Infrastructure — sector-specific practices for CI operators across IT/OT/ICS and supply-chain trustworthiness communication. Voluntary framework extension; Community of Interest for feedback — not a binding rule.

General AI RMF guidance is deliberately abstract. This concept note’s frame: **translate trustworthiness into operator- and vendor-speak for the 16 CI sectors** — energy, water, transport, healthcare, and the rest — where AI failure modes hit safety, not just brand risk.

**NIST** (April 7) released a **concept note** to develop an **AI Risk Management Framework Profile** on **Trustworthy AI in Critical Infrastructure**. Aims: actionable practices for CI operators adopting AI across IT, OT, and ICS; help operators state trustworthiness requirements to developers/vendors across AI and CI lifecycles/supply chains; support innovative risk-managed solutions. Ties to NIST’s Strategy for American Technology Leadership. **Community of Interest** for seminars, working sessions, RFIs — open to the CI ecosystem.

## What it is / isn’t

| Is | Isn’t |
|----|-------|
| Profile development kickoff under AI RMF | Finished mandatory standard |
| Sector-aware risk practices + supply-chain communication | Prescriptive model whitelist |
| Voluntary engagement path | Enforcement action |

## Claims vs checks

Scope and process are **NIST primary**. Whether the eventual profile is “practical and widely adopted” is **aspirational** — success depends on later drafts and operator uptake, not the concept note.

## Limits

- Concept stage — requirements not frozen.
- Voluntary NIST profiles lack statutory teeth unless agencies later incorporate them.
- CI heterogeneity (16 sectors) makes one profile’s depth a standing design tension.

## Sources

- [NIST: “Concept Note: AI RMF Profile on Trustworthy AI in Critical Infrastructure”](https://www.nist.gov/programs-projects/concept-note-ai-rmf-profile-trustworthy-ai-critical-infrastructure) (April 7, 2026).
- NIST AI RMF page updates referencing the April 7 release.