NIST / CAISI requests for information on AI

What it does

Technical input from developers, deployers and security researchers on AI security and standards questions. Recent dockets have covered unique security threats to AI agents, security practices and technical controls, assessment methods for identifying and managing AI vulnerabilities, deployment constraints and monitoring, and research and policy priorities.

Honest assessment

Among the best returns on effort for a technically credible individual. NIST outputs become de facto standards referenced in procurement and regulation worldwide, NIST explicitly solicits practitioner detail, and RFI response volumes are low enough that a substantive submission is genuinely read. Evidence of influence is visible in how NIST documents cite and reflect RFI input.

How to file

Via regulations.gov using the docket number in the Federal Register notice. Answer the numbered questions directly and in order — this is the single most effective structural choice, because NIST staff synthesise responses question by question.

Format

Written response keyed to the RFI's question numbering; attachments accepted.

Timing

Windowed, announced in the Federal Register. Examples: AI agent security RFI closed 9 March 2026 (937 comments); NVD modernisation RFI open until 13 October 2026, 11:59pm ET.

What happens after

Responses are public on the docket and feed NIST publications, profiles and frameworks (e.g. the Cyber AI Profile, AI agent security guidance).

What it accepts

What it does not accept

General opinion. NIST asks for concrete examples, best practices, case studies and actionable recommendations, and structures RFIs around numbered question areas.

Operated by

National Institute of Standards and Technology, US Department of Commerce (including the Center for AI Standards and Innovation)