The twelve GAI risk categories
Lesson 2 of 5 in Generative AI Risks and Bias: NIST-AI-600-1 and SP 1270.
Here is the taxonomy itself. Learn it well enough to classify incidents on sight — that is how it gets used in practice: an event lands, someone asks “which 600-1 category is this?”, and the answer routes it to the right owners, controls, and (increasingly) contract clauses. Each entry below gives the definition and a real incident to anchor it.
1. CBRN information or capabilities
The risk that GenAI eases access to chemical, biological, radiological, or nuclear weapons knowledge — lowering the expertise barrier for design, synthesis, or acquisition, including for dual-use science. This is the category frontier-lab safety frameworks obsess over: pre-release uplift studies test whether a model helps a novice meaningfully more than a search engine does. It is also the anchor of “catastrophic risk” definitions in frontier statutes like California SB 53 — where a safety-incident report may be due precisely because a model crossed a CBRN capability line.
2. Confabulation
Confidently produced, factually false content — NIST deliberately chose “confabulation” over the anthropomorphizing “hallucination”. It is intrinsic to next-token prediction: the model produces plausible language, not verified fact. Mata v. Avianca (2023) — six invented precedents in a federal brief — is the canonical case; Moffatt v. Air Canada (2024) added the liability lesson when a tribunal held the airline to the bereavement-refund policy its chatbot made up. Controls: retrieval grounding, verification layers, use-case limits, and disclosure — never a promised “fix”.
3. Dangerous, violent, or hateful content
Eased production of incitement, glorification of violence, self-harm encouragement, and hate speech — below the CBRN threshold but far broader in reach. The gravest incidents involve companion chatbots and minors: the 2024 lawsuits over Character.AI’s role in a Florida teenager’s suicide put this category (entangled with human-AI configuration) in front of courts and the FTC, whose 2025 6(b) inquiry into companion chatbots and child safety followed. Controls: output filtering, red-teaming for jailbreaks, crisis-response behaviors, age gating.
4. Data privacy
GenAI’s twist on a classic risk: models can memorize training data and leak it — researchers extracted verbatim personal data from ChatGPT in 2023 with an absurd repeated-word prompt — plus input leakage (Samsung engineers pasting proprietary source code into a public chatbot, 2023) and inference of sensitive facts never collected. Italy’s Garante briefly banned ChatGPT over training-data legality in 2023. Controls: data minimization and deduplication, memorization testing, enterprise input policies, and honoring deletion rights that are genuinely hard to honor once data is in weights.
5. Environmental impacts
Training and serving frontier models consumes energy, water, and embodied carbon at industrial scale — data-center buildouts now shape regional grids and water tables. The category earns its place because environmental cost is a system property invisible at the prompt: the marginal query feels free. Note the political marker: this is one of the topics America’s AI Action Plan reportedly directed NIST to strip from the RMF revision — an instructive example of risk taxonomies being politically contested artifacts.
6. Harmful bias and homogenization
The classic bias risk plus a genuinely new one. Image generators amplify stereotypes beyond base rates — Bloomberg’s 2023 Stable Diffusion analysis found “CEO” prompts overwhelmingly produced light-skinned men, at rates exceeding reality — while Google’s 2024 Gemini episode showed overcorrection failing in the opposite direction. Homogenization is the novel part: when thousands of products sit on the same foundation model, its skews, blind spots, and style become a monoculture — and a single upstream flaw propagates everywhere at once. SP 1270, later this module, supplies the full analytical toolkit.
7. Human-AI configuration
Risks arising from how humans and the system are arranged together: automation bias (over-trusting fluent output — the Avianca lawyer’s real failure), and emotional entanglement — anthropomorphizing systems designed to be warm, forming dependencies the vendor never intended to be load-bearing. A Belgian man’s 2023 suicide after weeks of conversations with a companion chatbot, and the Character.AI litigation, made this the profile’s most human category. Genuinely novel, and the hardest to control with technology: the mitigations are disclosure, interaction design, usage boundaries, and monitoring for dependency patterns.
8. Information integrity
Cheap, scaled, personalized mis- and disinformation and synthetic media. The January 2024 New Hampshire robocall — a voice-cloned President Biden telling Democrats not to vote in the primary — cost about $500 and triggered an FCC ruling that AI voices in robocalls violate the TCPA. Slovakia’s 2023 election-eve audio deepfake showed the timing weapon. Controls: provenance and watermarking (NIST AI 100-4 catalogues the techniques), platform labeling, and the disclosure laws — California SB 942, the EU’s Art 50 — that this category summoned into being.
9. Information security
GenAI both arms attackers (spear-phishing at scale, malware assistance, voice-clone fraud — the 2024 Arup case lost $25 million to a deepfaked video call) and presents a new attack surface: prompt injection — direct jailbreaks or instructions hidden in content the model reads — plus data poisoning of training corpora and model extraction. Prompt injection matters most for agentic deployments: a system empowered to act on what it reads can be hijacked by what it reads. OWASP ranks it the top LLM application risk; treat it as unresolved, managed by privilege separation and output constraints, not solved.
10. Intellectual property
Two exposure directions. Inbound: training on scraped copyrighted works — NYT v. OpenAI (filed December 2023), Getty v. Stability, the authors’ class actions — with fair use fought case by case and 2025’s Bartz v. Anthropic settlement signaling the price of pirated training corpora. Outbound: models reproducing protected content or styles, and the unsettled copyrightability of AI-assisted output. Controls: training-data provenance records (California AB 2013 now mandates public disclosure), licensing deals, output filters, and indemnities that have become standard enterprise contract terms.
11. Obscene, degrading, or abusive content
Synthetic NCII (non-consensual intimate imagery) and CSAM at generative scale. The Taylor Swift deepfakes of January 2024 pushed platform policy and legislative action; the federal TAKE IT DOWN Act (May 2025) now criminalizes NCII — synthetic included — and mandates 48-hour platform takedowns. Stanford researchers’ December 2023 discovery of CSAM inside the LAION-5B training set showed the risk starts in the data pipeline, not just the output filter. Controls: dataset hygiene, generation-time filters, hash-matching, and rapid takedown processes.
12. Value chain and component integration
The meta-risk: GenAI products are assemblages of third-party components — base models, fine-tunes, embeddings, vector stores, plugins, scraped datasets — often with opaque provenance and silent upstream updates. A deployer inheriting a flaw cannot fix what it cannot see; a model deprecation can break a product overnight. This category is why 600-1 leans so hard on GOVERN 6 / MAP 4 / MANAGE 3, and why developer-to-deployer documentation duties are the load-bearing wall of state laws like Colorado’s SB 26-189. If you remember one category in a procurement meeting, remember this one.
Interactive checkpoint quiz (3 questions) — open this page in a browser to take it.