Building an AI RMF Profile: Current vs Target

The NIST AI RMF gives you the outcomes; Profiles are how you make them yours. A Profile is a selection and prioritisation of the RMF's Functions, Categories and Subcategories tailored to a specific use case, sector or organisation. Build a Current Profile that describes your AI risk management as it stands today, and a Target Profile that describes where it needs to be, and the difference between them is, quite literally, your action plan.

The two Profiles

• Current Profile: an honest snapshot of which outcomes you are already achieving for a given AI system or programme, and how well.
• Target Profile: the outcomes you need to achieve, driven by your risk tolerance, your obligations and what your customers and regulators expect.
• The gap: the Subcategories where Current falls short of Target, prioritised by risk, become your roadmap.

A Profile is not paperwork. It is the single artefact that lets a non-technical board see, in one view, how far your AI risk posture is from where it needs to be.

Tailor it, do not boil the ocean

The point of a Profile is focus. You are not committing to all 72 outcomes at maximum rigour for every system. You select the outcomes that matter for the context, set realistic targets, and work the highest-risk gaps first. A generative AI product aimed at consumers will have a very different Target Profile from an internal forecasting model, and that is exactly the intent.

In Compliance One you build Current and Target Profiles against the full AI RMF library, the platform turns the gap into an owned, prioritised plan, and every outcome is cross-mapped to your ISO 42001 controls so evidence you already collect populates the Current Profile automatically. The Profile stays live as your models and use cases change, instead of being a document that is stale the week after you write it.