A Current Profile describes how you manage AI risk today, and a Target Profile describes where you want to be. List the framework subcategories you care about, mark current and target status for each, and the differences become your roadmap. NIST defines both profile types in AI RMF 1.0.
What the framework says
AI RMF 1.0 describes use-case profiles as implementations of the functions, categories and subcategories for a specific setting, based on requirements, risk tolerance and resources. It describes temporal profiles as descriptions of the current or desired target state of risk management activities in a given sector, organization or application. A Current Profile shows how AI is managed now. A Target Profile shows the outcomes needed to reach goals.
Step 1: choose the scope
Pick the organization as a whole or a single use case, such as a customer support assistant. Scope the first exercise narrowly.
Step 2: select subcategories
Begin with Govern 1 and 2 (policies, inventory, accountability), the Map subcategories on context and risk tolerance, Measure 2.x testing items, and Manage on response and incidents. You can leave out items that do not apply, and write down why.
Step 3: score the current state
Use a four-level scale: none, partial, defined, operating with evidence. Require an artifact link for the top level. Gather the evidence from policies, tickets and test records, not memory.
Step 4: set the target by risk
Targets should differ by tier. A low-tier chat tool may need "defined". A high-tier decision system may need "operating with evidence" across testing and oversight. The target should follow from your tolerance statement and obligations.
Step 5: rank the gaps
For each gap, note impact if left open, effort, dependencies and owner. Do dependencies first: you cannot test what you have not inventoried.
Step 6: turn it into a roadmap
Group gaps into quarterly themes. Assign owners and dates and report progress to the governance group. Re-score every six months.
Keep it honest
A gap analysis that shows no gaps is probably not looking. Treat unknowns as gaps until evidence exists.
Where Safeguard fits
Safeguard offers compliance and evidence automation, which can help collect and organize the artifacts that back each status in a profile. You still decide the targets and own the judgments.
Example rows
For the inventory subcategory, current might be partial: a spreadsheet exists but no owner updates it. Target for the organization is operating with evidence: quarterly review records and procurement hooks. The gap is ownership and a review cadence, a small piece of work. For testing a high-tier system, current might be none and target operating, which is a larger gap that deserves an earlier slot on the roadmap.
Quick check
Do we need to use every subcategory?
No. Choose those that match your risks and record exclusions with reasons.
Can we share the profile with customers?
You can share a summary of practices if every statement is accurate and backed by evidence. Avoid presenting a target as a current state.
Sources
Last reviewed: 19 October 2026.
