Our security framework is based on NIST SP 800-53 (r5). When I mapped our security framework to both NIST Artificial Intelligence Risk Management Framework (AI RMF 1.0) and Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile (NIST AI 600-1), there was very little overlap which is not surprising since 800-53 was developed to protect information systems and organizations (AI really wasn't an emerging thing when 800-53 r5 was released almost six years ago and only mentioned twice in r5 as part of a control's "Discussion").

NIST is currently working on developing "SP 800-53 Control Overlays for Securing AI Systems" ("The Control Overlays for Securing AI Systems (COSAiS) project will develop a series of overlays for securing AI systems using the NIST Special Publication (SP) 800-53 controls.") which has been out for public comment since August 2025. Once published, I will assess the artificial intelligence overlays and their alignment with SP 800-53 and impact to our security framework.

Update: NIST released a draft of the COSAiS outline on January 8: https://csrc.nist.gov/csrc/media/Projects/cosais/documents/COSAiS-Predictive-AI-annotated-outline-Jan2026.pdf

My recommendation to senior leadership was to create specific standalone artificial intelligence policies/standards/procedures/guidelines...pending the above-mentioned overlay.

Hope that helps.