NIST AI RMF Generative AI Profile: Where PII Sanitization Fits
NIST published AI 600-1, the Generative Artificial Intelligence Profile, in July 2024 as a companion to the AI Risk Management Framework. It lists data privacy among its generative AI risk categories. This page shows where a client-side sanitization control supports each of the four AI RMF functions.
Summary
The AI RMF is voluntary. It organizes risk work into GOVERN, MAP, MEASURE, and MANAGE, and the Generative AI Profile applies those functions to risks that are new or amplified by generative systems, including data privacy.
ZTDS is a technical control that sits mostly in MANAGE, produces evidence for MEASURE, and depends on data-flow knowledge from MAP and policy from GOVERN. It does not make an organization NIST compliant, because the framework is not a certification scheme.
Function-Level Mapping
| AI RMF function | What the organization does | ZTDS contribution |
|---|---|---|
| GOVERN | Sets policy on what data may be sent to external models and who owns the decision. | Gives policy a concrete enforcement point: sanitization before egress is testable and auditable. |
| MAP | Identifies where personal data and confidential content enter prompts, retrieval, and agent tools. | Entity category counts from sanitization runs show which data types actually flow toward models. |
| MEASURE | Tests whether controls work and tracks leakage metrics. | Local compliance receipts and the browser-based scanner provide repeatable egress evidence. |
| MANAGE | Applies controls and responds to incidents. | Pre-egress tokenization reduces the data exposed if a provider or integration is compromised. |
How ZTDS Applies
A practical sequence for a security or risk team:
- Record in GOVERN policy that regulated identifiers must be tokenized before reaching any external model.
- Use MAP workshops to list the channels: chat interfaces, document upload, retrieval pipelines, and agent tools.
- Run sanitization on a representative corpus and keep the receipts as MEASURE evidence.
- Treat any channel that bypasses the local step as a MANAGE finding with an owner and a due date.
What This Control Does Not Cover
- The AI RMF and AI 600-1 are voluntary guidance. There is no formal NIST certification a product can obtain.
- ZTDS addresses data privacy exposure at the client boundary. Other profile risks, such as confabulation or harmful content, need other controls.
- The mapping above is an interpretation by the ZTDS consortium, not an endorsement by NIST.
Frequently Asked Questions
Is there a NIST certification for AI RMF compliance?
No. The NIST AI Risk Management Framework and the AI 600-1 Generative AI Profile are voluntary guidance. Organizations describe how their controls align with the framework, but NIST does not certify products or programs.
Which AI RMF function does client-side sanitization support most directly?
MANAGE, because tokenizing identifiers before egress is a risk treatment. It also supports MEASURE through local receipts and MAP through entity category counts.
Does AI 600-1 mention data privacy?
Yes. The Generative AI Profile identifies data privacy as one of its generative AI risk categories, covering concerns such as personal data in training and inputs and unintended disclosure.
Related Specifications and Tools
- ZTDS RFC v1.0 Specification — The four invariants referenced on this page.
- Global Regulatory Compliance Matrix — Cross-framework statutory mapping.
- CISO Procurement Pack — Vendor-questionnaire and safe harbor material.
- Framework Mappings Hub — All framework mappings in one index.
- OWASP LLM02 Sensitive Information Disclosure — Maps pre-egress tokenization to OWASP LLM02:2025 and states what it does not cover.
- EU AI Act Article 10 Data Governance — Describes how pre-ingestion sanitization supports Article 10 data governance practices.
- GDPR Articles 25 and 32 for AI Prompts — Explains data protection by design and security of processing for prompts sent to AI providers.
- HIPAA Safe Harbor for LLM Prompts — Shows how 18-identifier removal applies to clinical text sent to language models.
- MCP stdio PII Sanitization — Describes a local gateway that sanitizes JSON-RPC traffic over the MCP stdio transport.
- RAG Pipeline PII Sanitization — Places sanitization at ingestion, retrieval, and prompt assembly stages of a RAG pipeline.
- Client-Side Sanitization vs Proxy DLP — Compares client-side in-memory sanitization with network proxy and cloud DLP approaches.