Generative AI

Generative AI (generative artificial intelligence, also called GenAI or gen AI) is a class of artificial intelligence systems that learns patterns and relationships from data and uses them to produce new content, such as text, computer code, images, audio, video, or other digital material. Rather than only assigning a label or calculating a prediction for an existing input, a generative model can synthesize an output that was not explicitly stored as a complete answer. The United States National Institute of Standards and Technology (NIST) describes generative AI in terms of models that emulate characteristics of input data to generate derived synthetic content.

Generative AI is a part of machine learning and, in many contemporary systems, deep learning. A user might ask a text model to explain a technical report, request an image of a proposed design, or ask a coding assistant to draft a function. The system generates a response conditioned on the request and the patterns it learned during training. The response may be useful, but fluent language or realistic media does not, by itself, establish factual accuracy, originality, ownership, or suitability for a particular decision.

The term refers to a technological capability, not a specific product, a single model architecture, or a guarantee of human-like intelligence. A large language model is one important kind of generative model; other kinds generate images, audio, video, and multimodal outputs. An application may add search, databases, business rules, workflow controls, or human review around its model. Those surrounding components are not inherent in the definition of generative AI.

Meaning and defining characteristics

Generative AI is defined principally by what its model is designed to produce. It estimates patterns or statistical structure in training data and uses that learned representation to generate new samples or sequences. This makes it different from a model whose primary output is a classification, an anomaly flag, or a numerical forecast. The distinction is functional rather than absolute: a single AI application can use both generative and non-generative models, and a generative model can also perform tasks such as classification or information extraction.

Three characteristics are central:

• Learned representation: the model acquires statistical relationships from training examples rather than relying only on a hand-written library of complete answers.
• Content synthesis: the model produces an output through a generation process, such as selecting successive text tokens or iteratively constructing visual content.
• Conditioning: generation can be influenced by a prompt, an image, audio, structured input, retrieved evidence, or other context. Some models also generate without a detailed user prompt.

The output need not be wholly unprecedented. Generated content may resemble patterns, styles, or passages in training material, and a model can sometimes reproduce memorized material. Consequently, the word new describes the act of generation, not a certification that the result is legally original or free of pre-existing content. A generated answer may likewise contain claims that sound authoritative but are false. These distinctions matter when the output becomes a public communication, a software component, a business recommendation, or evidence for a consequential decision.

How generative AI works

The operation of a generative AI system can be understood by separating model development, generation at the time of use, and the surrounding application. The stages are connected but are not necessarily performed by the same organization. A company may train its own model, adapt a pre-trained model, or use a model supplied through an external service.

Training and learned patterns

During training, a model's parameters are adjusted so that it performs better on a learning objective using examples from a dataset. For a language model, an important objective may involve predicting missing or subsequent tokens in text. For an image model, an objective may involve learning to reconstruct or generate visual patterns. The relevant data, model design, training objective, and computing resources influence which capabilities emerge and which weaknesses remain.

Large models are often pre-trained on broad collections of material and subsequently adapted. Further training or instruction tuning can help them follow requests, conform to task formats, or specialize in an application. These steps may improve usefulness but do not establish that every answer will be correct. Nor does interacting with a deployed model necessarily update its underlying parameters; whether user data is retained or used for future training depends on the provider and deployment arrangements.

A foundation model is a broadly trained model that can be adapted to many tasks. Many modern generative AI applications use foundation models, but the two terms are not identical: a foundation model describes a general-purpose model's role and training scope, while generative AI describes a capability to synthesize outputs.

Prompts and inference

A prompt provides information or instructions that condition generation. It may contain natural-language text, examples, images, documents, audio, structured fields, or a conversation history. During inference, the trained model processes the available input and produces an output without ordinarily retraining itself for that request.

For many autoregressive language models, text is divided into tokens, and the model estimates a distribution over possible next tokens given the preceding context. The system repeatedly selects or samples tokens to build a response. Generation settings influence variation, while input length, model size and output length can affect latency and cost. This mechanism explains why a response can be coherent without being a verified account of events or a traceable quotation from a source.

Image and video generation may use different mechanisms. In a common diffusion approach, a model learns to reconstruct structured information through a sequence related to adding and removing noise; generation then uses an iterative process to produce a sample. It would be inaccurate to describe all generative models as predicting the next word or all image models as using diffusion.

Grounding and access to information

A model's learned parameters are different from a live database, a current web page, or a company's document repository. Some applications use retrieval-augmented generation (RAG) to find relevant external material and include it in the context provided to the generative model. The model can then draft an answer informed by that retrieved material, sometimes with citations to the underlying sources.

RAG changes the information available to the application; it does not make every output correct. The retrieval system can miss decisive records, return stale versions, or supply incomplete passages, and the model may misinterpret what was found. Grounded answers therefore still require source quality controls, access permissions and proportionate verification.

Model, application and human workflow

An enterprise generative AI application may combine a model with interfaces, identity controls, a document index, business applications, policy checks, logging and review steps. Those components govern who can use the system, what information it can access, what it may produce, and whether its output can affect a business record or process.

For example, drafting an email and sending an email are different operations. A model may write a proposed message, but an application needs authorization and a connected action to send it. An AI agent may be designed to plan tasks and use tools; the underlying generative model is only one part of that larger system. Describing every generative chatbot as an autonomous agent obscures this important boundary.

Main types of generative AI models

Generative AI does not use one universal architecture. Different families of models embody different methods of learning and generating data. The following table describes major families rather than a permanent ranking of approaches.

Model family	How generation generally works	Representative uses and boundary
Autoregressive models and transformers	Generate sequences by estimating successive elements conditioned on preceding context; attention mechanisms can represent relationships among elements of a sequence.	Widely used in language and code generation. Transformer architectures can also be used for other modalities and need not be generative in every application.
Diffusion models	Learn a process that can produce samples through repeated transformations often described as denoising.	Frequently associated with image generation and also used for other media. The underlying mechanism differs from token-by-token language generation.
Generative adversarial networks (GANs)	Train a generator and a discriminator in an adversarial learning arrangement.	Historically influential in image synthesis and synthetic-data research; not the architecture behind every modern image generator.
Variational autoencoders and related latent-variable models	Learn representations of data and generate or reconstruct samples through a latent representation.	Used in generative modeling and as components in more complex systems; output quality and use depend on the design.

The distinction between a model family, a trained foundation model and a finished product is essential. A product described as a generative AI assistant may incorporate several different models, retrieval mechanisms, safety checks and business tools. Its capabilities and risks cannot be inferred reliably from the label alone.

What generative AI can produce

The range of outputs depends on the model and the application. The categories below overlap, particularly in multimodal systems that accept and produce more than one kind of media.

Output	Typical capability	Important limitation
Text and language	Drafting, summarization, rewriting, translation, dialogue and question answering	Factual claims and quotations must be checked; summaries can omit qualifications or misstate source meaning.
Computer code	Suggesting functions, tests, documentation, queries and explanations of code	Generated code may be insecure, incorrect, incompatible or difficult to maintain without testing.
Images and design concepts	Producing or editing illustrations, visual variations, layouts and concept imagery	Visual realism does not establish authenticity, rights clearance or factual accuracy.
Speech, music and sound	Synthesizing spoken audio, sound effects and other audio material	Voice imitation and attribution can raise consent, identity and intellectual-property concerns.
Video and animation	Generating or transforming moving visual sequences	Temporal coherence, provenance, licensing and deceptive-use risks require assessment.
Structured and synthetic data	Producing examples, simulated records or draft structured outputs for testing and development	A plausible synthetic dataset is not automatically statistically representative or free of sensitive-data leakage.

Generation can be conditional: a textual instruction may guide an image, a reference image may guide an edit, or a transcript may guide a spoken response. Some applications are multimodal because they combine text, images, audio or other forms of information. The presence of multiple modalities changes the application interface and evaluation requirements, but the central generative characteristic remains production of derived content rather than mere classification.

Generative AI applications

Generative AI can support creative, analytical and operational tasks. In enterprise settings, its role is often to produce a draft, transform unstructured information, or help a person work with a large collection of material. Suitability depends on the accuracy required, available data, cost of an error, and whether outputs can be independently checked.

Application area	Illustrative use	Evidence or control needed
Knowledge and research support	Summarize reports or answer questions using an approved knowledge repository	Source traceability, document version control, retrieval quality and human checking of consequential claims
Software development	Propose code, unit tests or technical documentation	Secure review, functional tests, license review and compatibility checks
Customer and employee service	Draft replies or support a service representative with relevant information	Disclosure rules, escalation for unusual cases, privacy controls and limits on account changes
Content and communication	Create first drafts, translations, accessible versions or design concepts	Editorial verification, audience suitability, attribution and permissions
Product and engineering design	Generate concepts, prototypes or alternative designs	Physical or technical validation against real constraints
Learning and workforce support	Offer explanations, practice exercises or feedback	Accuracy checks, assessment integrity, appropriate disclosure and teacher or supervisor review

In each case, the distinction between producing a plausible artifact and producing a valid business outcome matters. Generating a proposed contract clause is not the same as confirming legal sufficiency. Drafting a system configuration is not the same as demonstrating that it is secure. Producing a customer-service answer is not the same as authorizing a refund. The surrounding business process defines who may rely on the output and what checks are needed.

Capabilities, benefits and conditions for value

Generative AI can reduce effort involved in drafting, transforming, searching across or organizing unstructured content. It can also help users explore design alternatives, explain technical material in different language, or interact with a system through natural language. These are capabilities and plausible benefits, not guaranteed outcomes for every deployment.

The realized benefit depends on the full task. A generated draft may be fast to produce yet expensive to verify. Output errors can create rework or reputational harm. An application may speed a visible step while moving effort to data preparation, quality assurance, policy review or downstream correction. For this reason, organizations should compare the complete workflow with an appropriate non-generative or human-managed alternative rather than equating the number of generated items with business value.

The 2026 Stanford AI Index documents increasing adoption of AI alongside differences in capability, investment and use across sectors. Adoption figures describe reported use within their surveyed populations; they do not show that a particular deployment produced savings, productivity improvement or superior business results.

Limitations and failure modes

Generative models can produce confident, coherent content that is wrong. A language model may invent a citation, combine facts from incompatible sources, omit a critical condition, or produce an inaccurate calculation. NIST identifies confabulation among the risks relevant to generative AI: a response may present false or misleading content as though it were valid. Such problems are particularly significant when readers cannot readily check the underlying information.

Other limitations include:

• Bias and representativeness: training data and design choices can reflect uneven coverage, stereotypes or other patterns that affect results differently across users or populations.
• Prompt sensitivity and inconsistency: changes in wording, context, generation settings or model versions can change results, including when a task appears similar.
• Limited explainability: an apparently persuasive answer does not necessarily reveal the model's causal basis or a source that verifies it.
• Out-of-date or missing knowledge: a model without suitable retrieval or updated data may not know relevant recent or private facts.
• Privacy and confidentiality exposure: prompts, retrieved documents, model outputs and logs may contain protected information, depending on access arrangements and provider practices.
• Intellectual-property uncertainty: rights and obligations can differ for training materials, generated outputs, licenses and subsequent reuse.
• Cost and resource demands: training, hosting, repeated inference, review, monitoring and integration consume financial and technical resources.

Risks vary by task. A factual mistake in an internal brainstorm may be easy to correct, whereas a fabricated citation in a regulatory filing or an incorrect instruction in a critical system can have much greater consequences. A suitable assessment therefore considers the output, its intended use and how readily errors can be detected and corrected.

Security risks specific to generative applications

Security risks arise not only in the model but in prompts, retrieved documents, plugins, connected tools and downstream applications. In a prompt injection attack, malicious instructions in input or retrieved content attempt to redirect a model-based application away from its authorized task. Other risks include sensitive-information disclosure, data or model poisoning, insecure output handling, vulnerable dependencies and granting a model-based application excessive authority to act.

These are application security problems requiring controls around trust boundaries and privileges. A natural-language instruction inside an external document should not acquire the authority of a system owner merely because a model has read it. Output filtering can help, but it is not a substitute for conventional permission checks, validated tool calls, logging and independent review where consequences are material.

Copyright and other legal questions

Legal treatment is jurisdiction-dependent. For example, the United States Copyright Office's January 2025 report on copyrightability concluded that the protection of AI-assisted works depends on sufficient human authorship of expressive elements; merely providing a prompt does not by itself establish copyright in an otherwise AI-generated output under the Office's analysis. Questions about training data and other legal issues require separate treatment. This is a United States policy and legal analysis, not a universal rule for every country or every output.

Organizations using generative AI must also consider contracts, personal-data protection, confidentiality, retention, sector rules and applicable disclosure requirements. The obligations depend on jurisdiction, use, affected people and suppliers; describing a model as safe or compliant in general terms is insufficient.

Enterprise system architecture and controls

A deployed generative AI service commonly has several layers. The boundaries help explain why selecting a model does not, by itself, produce a governed enterprise solution.

Layer	What it contributes	Main question
User or application interface	Receives requests and presents outputs	Who may use the system, for what purpose, and with what disclosure?
Identity, data and access controls	Enforces authorized access to prompts, records and connected services	Is each user entitled to the information and actions available to the application?
Context and retrieval	Supplies relevant instructions, documents or other external evidence when required	Is the source current, trustworthy, complete and permissioned?
Generative model and execution service	Produces content from the available context	Is this model capable, appropriately configured and suitable for the task?
Output and action controls	Checks or constrains generated material and any connected tool use	Can an incorrect or malicious response create an unauthorized action?
Monitoring, evaluation and review	Records appropriate performance evidence and triggers change or intervention	Do quality, risk, cost and outcome remain acceptable after deployment?

Not every application needs every layer as a separate product. Simple private drafting tools may require relatively few integrations. A customer-facing assistant with access to confidential records and transaction tools requires stronger controls. The needed architecture follows the actual business task and its consequences, rather than a standard checklist applied without context.

How generative AI is evaluated

Evaluation asks whether a particular system performs an assigned task sufficiently well under defined conditions. A fluent demonstration is not enough. Results depend on the selected test cases, the population represented by them, the model version, the prompts, the retrieval corpus and the human workflow.

Useful measures include:

Dimension	Example evidence	Interpretation boundary
Task quality	Expert-graded correctness, completeness and usability on representative tasks	Performance on one demonstration does not establish reliability across new tasks.
Groundedness and factuality	Whether material claims are supported by the supplied evidence; citation accuracy	A cited source can still be outdated, incomplete or incorrectly interpreted.
Safety and policy compliance	Tested harmful outputs, refusal behavior, privacy violations and rule breaches	A low observed failure rate depends on the test population and attack coverage.
Robustness and security	Prompt-injection exercises, abuse tests, privilege-boundary tests and regression results	Passing known tests does not show that unknown attacks are impossible.
Service performance	Latency, availability, throughput and operational failures	Technical service levels do not establish answer quality.
Full-workflow cost and value	Model charges, integration, reviewer time, corrections, changes in task outcomes	Faster generation may still be uneconomic if verification or remediation is expensive.

Evaluation should distinguish model quality from application quality and business effect. A model might answer well in a controlled test but perform badly when a retrieval index returns the wrong policy version. A technically effective assistant may be little used because it does not fit the job. A high adoption rate may reflect curiosity or convenience without proving a benefit. Useful evaluation therefore compares intended outcomes, the relevant baseline and foreseeable failure costs, with the data and uncertainty stated explicitly.

Generative AI and organizational accountability

Generative AI is one technology category within an organization's broader AI strategy. The strategy identifies purposes and priorities; AI governance assigns authority and oversight; an AI roadmap may sequence capability investments and deployments. None of these is synonymous with the technology itself.

Responsibility is normally distributed. Business owners determine the purpose and acceptable consequences of a use case. Technology and data specialists select or integrate systems, assess quality and maintain services. Security, privacy, risk and legal functions review relevant exposures and obligations. Procurement and vendor-management teams examine suppliers, contracts, dependence and exit arrangements. The precise authority model varies by organization.

Data governance remains relevant to the quality, permission and provenance of information supplied to generative applications. Information security management addresses protection of information and services. AI-specific oversight adds concerns such as generated content, model evaluation, prompt manipulation, output misuse and changes in behavior. NIST's Generative AI Profile is a voluntary companion to its AI Risk Management Framework intended to help organizations address generative AI risks throughout the lifecycle; it is not a general certification of products or a mandatory legal regime.

The most important operational boundary is between assistance and authority. An assistant can propose an answer or action. Only the surrounding organization and its authorized systems can decide whether the recommendation is relied upon, approved or executed. This remains true when applications use tool calling or agent-like workflows that can act without a person reviewing each intermediate step.

Illustrative organizational example

Consider a fictional organization that receives large numbers of employee questions about internal policies and IT services. It already has a searchable document repository, but employees often struggle to find the current version of a policy or interpret what applies to their situation.

The organization considers a generative AI assistant that uses retrieval to locate approved documents and drafts an answer with references to relevant passages. For common questions, staff may receive a useful explanation more quickly than by reading several long documents. However, the organization does not treat the model as the source of policy authority: each policy retains its owner, effective date and approval record. The assistant is restricted to material the employee is permitted to access and is expected to acknowledge when the available evidence is insufficient.

A policy about travel reimbursement offers a concrete test. The assistant may summarize a published allowance, but it must not invent an exception or approve a payment. If the documents conflict or a request requires discretion, the system routes the employee to the authorized department. The evaluation includes current and superseded policy versions, ambiguous questions, access-control tests and unsupported claims. The business case compares the complete process with existing search and support arrangements, including any additional review time.

This example illustrates how the generative model, retrieval, authoritative records, decision rights and verification form one application. It does not claim that such a system is automatically reliable, inexpensive, secure or appropriate in every organization.

Relationship to other AI concepts

The following distinctions help prevent different aspects of AI from being treated as interchangeable.

Concept	Distinction from generative AI
Artificial intelligence	The broad field includes generative and non-generative systems, including classification, optimization and decision support.
Machine learning	A broader family of methods that learn from data; many learning systems do not create media or other synthesized content.
Predictive analytics	Primarily estimates likely events or values; it may use machine learning or generated scenarios without being synonymous with content generation.
Large language model	A model centered on language processing and generation; it is an important subset or enabling model for many generative AI systems, not the whole field.
Foundation model	Describes a broadly trained model that supports many downstream tasks; whether and how it generates depends on the model.
Retrieval-augmented generation	An application pattern that supplies retrieved external information to a generative model; retrieval is an addition, not an intrinsic guarantee of truth.
AI agent	An application or system organized to pursue goals and use tools or actions; it can employ generative AI but also needs authorization, orchestration and operational controls.
Artificial general intelligence	A separate and contested concept about broad general-purpose intelligence; generating coherent text or images does not establish AGI.

Development of the field

Generative modeling predates current conversational AI. Modern deep generative systems developed through several research advances, including generative adversarial networks described in 2014, the transformer architecture introduced in 2017, and influential diffusion-model work published in 2020. These innovations contributed different ways to learn representations and generate content; none is the single origin of all generative AI.

Public interest expanded as accessible conversational, image, coding and multimedia applications became widespread in the early 2020s. The field continues to change through improvements in model capabilities, inference efficiency, multimodal systems, tool integration and evaluation methods. Historical progress should not be confused with proof that any current system can perform every human intellectual task, or that capability gains translate directly into economic value or trustworthy deployment.

See also

• Artificial Intelligence (AI)
• Machine Learning
• Deep Learning
• Natural Language Processing (NLP)
• Neural Network
• Predictive Analytics
• LLM
• Foundation Model
• Retrieval-Augmented Generation (RAG)
• AI Governance
• AI Strategy
• Data Governance