NIST AI RMF vs EU AI Act

By Jorge García Aibar Updated 2026-09-27 First published 2026-09-25

The EU AI Act is binding law, directly applicable in every Member State; it reaches providers, deployers, importers and distributors whose AI systems are placed on the EU market or whose output is used there. The NIST AI RMF 1.0 is a voluntary, US-origin framework that any organisation may adopt; it has no legal force and no certification scheme.

In short

The EU AI Act is binding law and the NIST AI RMF is voluntary guidance. The Act reaches providers placing AI systems or GPAI models on the EU market wherever they are established, and providers and deployers in third countries whose output is used in the Union, so it can apply to US companies. It fines prohibited practices up to EUR 35 million or 7% of worldwide annual turnover, and its Annex III high-risk duties apply from 2 December 2027. The NIST AI RMF 1.0 (NIST AI 100-1) is US-origin and use-case agnostic, with no penalties and no certification scheme. It gives no presumption of conformity with the Act, but its four functions, Govern, Map, Measure and Manage, organise the risk management, testing and monitoring the Act's high-risk articles require. In this crosswalk both file clauses under 23 of 25 topics, 14 of them strongly, so one set of evidence can serve both.

At a glance

The two instruments side by side, as the Body of Knowledge states them. Each cell names the primary source it rests on; the last row links the chapter sections each line comes from.

NIST AI RMF and EU AI Act (post-Omnibus) compared, attribute by attribute
Attribute	NIST AI RMF	EU AI Act (post-Omnibus)
Type	Framework: NIST AI Risk Management Framework 1.0 (NIST AI 100-1). Its companion Generative AI Profile (NIST AI 600-1, 2024) is not mapped on these pages. Sources: NIST AI 100-1, NIST AI 600-1	Law: Regulation (EU) 2024/1689, as amended by the Digital Omnibus, Regulation (EU) 2026/1744 Sources: Regulation (EU) 2024/1689, consolidated text, Regulation (EU) 2026/1744 (Digital Omnibus)
Issuer	NIST (United States) Source: NIST AI 100-1	European Union Source: Regulation (EU) 2024/1689, consolidated text
Legal force	Voluntary and US-origin. It describes itself as voluntary, rights-preserving, non-sector-specific and use-case agnostic. Source: NIST AI 100-1	Binding and directly applicable in every Member State. Fines reach EUR 35 million or 7% of worldwide annual turnover, whichever is higher, for prohibited practices, and EUR 15 million or 3% for operator obligations. Sources: Art. 99, Art. 113
Scope and reach	Any organisation, in any sector and for any use case. GOVERN applies across the whole process; MAP, MEASURE and MANAGE apply per system and per lifecycle stage. Source: NIST AI 100-1	Risk-tiered: prohibited practices, high-risk systems (Annex I products, Annex III uses), transparency cases and GPAI models. It reaches providers placing AI systems or GPAI models on the EU market wherever they are established, deployers in the Union, third-country providers and deployers whose output is used in the Union, importers and distributors. Sources: Art. 2, Art. 5, Art. 6, Art. 50, Art. 51
Certifiable	No. There is no certification scheme for it: NIST AI 100-1 presents the RMF as voluntary guidance. Source: NIST AI 100-1	No certificate of the Act as a whole. A high-risk system passes a conformity assessment (internal control, or a notified body where required), then the provider draws up an EU declaration of conformity, affixes the CE marking and registers the system in the EU database. Sources: Art. 43, Art. 47, Art. 48, Art. 49
Key artefacts	Four functions (Govern, Map, Measure, Manage) in 19 categories and their subcategories, used as control metadata; a current and a target profile, with the gap between them as the action plan. Source: NIST AI 100-1	Risk classification, risk management system, technical documentation, quality management system, logs, human oversight, fundamental rights impact assessment, serious-incident reports. Sources: Art. 6, Art. 9, Art. 11, Art. 12, Art. 14, Art. 17, Art. 27, Art. 73
Dates	1.0 published 2023-01-26; there is no 2.0. A formal review was foreseen by 2028, and as of 2026-09-24 NIST states that 1.0 is being revised, with no revised version published. Sources: NIST AI 100-1, NIST: AI Risk Management Framework	In force 2024-08-01. Prohibitions and AI literacy from 2025-02-02; GPAI obligations from 2025-08-02; Omnibus in force 2026-07-27; high-risk Annex III from 2027-12-02 and Annex I from 2028-08-02. Sources: Art. 113, Regulation (EU) 2026/1744 (Digital Omnibus)
In the Body of Knowledge	22. NIST AI RMF 1.0 in depth 13. NIST AI RMF and ISO/IEC 23894 on the stack	18. The EU AI Act in one pass 08. The regulatory map: EU AI Act

Where they overlap, topic by topic

The crosswalk maps 25 AI governance topics. Both instruments file clauses under 23 of them, 14 strongly (a core clause on each side). 0 topics have a core clause only in the NIST AI RMF and 2 only in the EU AI Act; 0 are reached by neither. A shared topic means the two deal with the same thing, not that meeting one meets the other.

Strong: both file a core clause. Partial: both file a clause, at least one only in passing. Only, in passing: one side files a related clause and the other none. Clause ids link to their page in the obligation register where one exists. The last column names a pattern only where it serves a core clause on both sides: the crosswalk row's register entry lists it and the pattern's own "Maps to" line names that clause. Otherwise the cell is empty.

Per-topic overlap of NIST AI RMF and EU AI Act (post-Omnibus), from the crosswalk, core clauses first
Topic	What NIST AI RMF asks for	What EU AI Act asks for	Overlap	Patterns for both
Risk management	MAP 1 Context is established and understood MAP 5 Impacts to individuals, groups, communities, organizations, and society are characterized MANAGE 1 AI risks based on assessments and other analytical output are prioritized, responded to, and managed 6 more in the crosswalk	Art. 9 Risk management system Art. 3 Definitions	Strong	Downstream Use Register
Governance and accountability	GOVERN 1 Policies, processes, procedures, and practices across the organization related to the mapping, measuring, and managing of AI risks are in place, transparent, and implemented effectively GOVERN 2 Accountability structures are in place so that the appropriate teams and individuals are empowered, responsible, and trained GOVERN 4 Organizational teams are committed to a culture that considers and communicates AI risk 1 more in the crosswalk	Art. 17 Quality management system Art. 4 AI literacy Art. 87 Reporting of infringements and protection of reporting persons	Strong
Impact assessment	MAP 3 AI capabilities, targeted usage, goals, and expected benefits and costs are understood MAP 5 Impacts to individuals, groups, communities, organizations, and society are characterized	Art. 27 Fundamental rights impact assessment for high-risk AI systems Art. 9 Risk management system	Strong
Data governance	MAP 2 Categorization of the AI system is performed MEASURE 2.10 Privacy risk of the AI system is examined and documented MEASURE 2.11 Fairness and bias are evaluated and results are documented	Art. 10 Data and data governance Art. 10(2)(f)–(g) Examination for possible biases; measures to detect, prevent and mitigate them Art. 4a Special-category data for bias detection 3 more in the crosswalk	Partial
Documentation and transparency	MAP 1 Context is established and understood MEASURE 2.8 Risks associated with transparency and accountability are examined and documented MAP 1.6 System requirements are elicited from and understood by relevant AI actors. Design decisions take socio-technical implications into account to address AI risks 1 more in the crosswalk	Art. 11 Technical documentation Art. 13 Transparency and provision of information to deployers Art. 53 Obligations for providers of general-purpose AI models 6 more in the crosswalk	Partial
Inventory and registration	GOVERN 1.6 Mechanisms are in place to inventory AI systems and are resourced according to organizational risk priorities GOVERN 1.7 Processes and procedures are in place for decommissioning and phasing out AI systems safely and in a manner that does not increase risks or decrease the organization's trustworthiness	Art. 49 Registration Art. 71 EU database for high-risk AI systems Art. 6 Classification rules for high-risk AI systems 2 more in the crosswalk	Strong	Use-Case Intake & Risk Tiering
Logging and traceability	MANAGE 4 Risk treatments, including response and recovery, and communication plans for the identified and measured AI risks are documented and monitored MEASURE 3 Mechanisms for tracking identified AI risks over time are in place	Art. 12 Record-keeping Art. 26(6) Deployers keep the automatically generated logs Art. 26 Obligations of deployers of high-risk AI systems 1 more in the crosswalk	Partial
Human oversight	MANAGE 2.4 Mechanisms are in place and applied, and responsibilities are assigned and understood, to supersede, disengage, or deactivate AI systems that demonstrate performance or outcomes inconsistent with intended use MAP 3.5 Processes for human oversight are defined, assessed, and documented in accordance with organizational policies from the GOVERN function GOVERN 3.2 Policies and procedures are in place to define and differentiate roles and responsibilities for human-AI configurations and oversight of AI systems	Art. 14 Human oversight Art. 26 Obligations of deployers of high-risk AI systems Art. 14(4)(b) Awareness of automation bias	Strong
Runtime guardrails	MANAGE 2 Strategies to maximize AI benefits and minimize negative impacts are planned, prepared, implemented, documented, and informed by relevant AI actors	Art. 5 Prohibited AI practices Art. 15 Accuracy, robustness and cybersecurity Art. 5(1)(a)–(b) Manipulative techniques; exploitation of vulnerabilities	Partial
Robustness, security and evaluations	MEASURE 2 AI systems are evaluated for trustworthy characteristics MEASURE 2.7 AI system security and resilience as identified in the MAP function are evaluated and documented MEASURE 2.1 Test sets, metrics, and details about the tools used during TEVV are documented 1 more in the crosswalk	Art. 15 Accuracy, robustness and cybersecurity Art. 55 Obligations for providers of general-purpose AI models with systemic risk Art. 60 Testing of high-risk AI systems in real-world conditions outside AI regulatory sandboxes 3 more in the crosswalk	Strong	AI Threat Model Model Artefact Integrity
Incident response and monitoring	MANAGE 4 Risk treatments, including response and recovery, and communication plans for the identified and measured AI risks are documented and monitored MANAGE 4.3 Incidents and errors are communicated to relevant AI actors, including affected communities. Processes for tracking, responding to, and recovering from incidents and errors are followed and documented MANAGE 2.4 Mechanisms are in place and applied, and responsibilities are assigned and understood, to supersede, disengage, or deactivate AI systems that demonstrate performance or outcomes inconsistent with intended use 1 more in the crosswalk	Art. 72 Post-market monitoring by providers and post-market monitoring plan Art. 73 Reporting of serious incidents Art. 26(5) Deployer monitoring, informing the provider and suspending use 3 more in the crosswalk	Strong	Disclosure & Notification Pipeline
Supply chain and third parties	GOVERN 6 Policies and procedures are in place to address AI risks and benefits arising from third-party software and data and other supply chain issues MAP 4 Risks and benefits are mapped for all AI system components including third-party software and data MANAGE 3 AI risks and benefits from third-party entities are managed 2 more in the crosswalk	Art. 25 Responsibilities along the AI value chain Art. 25(4) Written agreement with third-party suppliers Art. 26 Obligations of deployers of high-risk AI systems 4 more in the crosswalk	Strong
Prohibited practices	GOVERN 1.1 Legal and regulatory requirements involving AI are understood, managed, and documented	Art. 5 Prohibited AI practices	Partial
Fairness and non-discrimination	MEASURE 2.11 Fairness and bias as identified in the MAP function are evaluated and results are documented GOVERN 3.1 Decision-making related to mapping, measuring, and managing AI risks throughout the lifecycle is informed by a diverse team	Art. 10(2)(f)–(g) Examination for possible biases; measures to detect, prevent and mitigate them Art. 4a Special-category data for bias detection	Strong	Fairness Eval Suite Drift & Fairness Monitor
Privacy and data protection	MEASURE 2.10 Privacy risk of the AI system as identified in the MAP function is examined and documented	Art. 59 Further processing of personal data in the AI regulatory sandbox Art. 4a Special-category data for bias detection	Partial
Explainability and right to explanation	MEASURE 2.9 The AI model is explained, validated, and documented, and AI system output is interpreted within its context as identified in the MAP function to inform responsible use and governance MEASURE 2.8 Risks associated with transparency and accountability as identified in the MAP function are examined and documented	Art. 86 Right to explanation of individual decision-making Art. 13(3)(b)(iv)–(v) Information relevant to explain output; performance for specific persons or groups	Strong
AI literacy and competence	GOVERN 2.2 The organization's personnel and partners receive AI risk management training to enable them to perform their duties and responsibilities consistent with related policies, procedures, and agreements MAP 3.4 Processes for operator and practitioner proficiency with AI system performance and trustworthiness, and relevant technical standards and certifications, are defined, assessed, and documented	Art. 4 AI literacy Art. 26(2) Oversight by people with the competence, training and authority it needs Art. 95(2)(c) Codes of conduct: promoting AI literacy	Strong	Sanctioned AI Gateway
Conformity assessment and certification	MEASURE 1.3 Internal experts who did not serve as front-line developers for the system and/or independent assessors are involved in regular assessments and updates	Art. 43 Conformity assessment Art. 47 EU declaration of conformity Art. 48 CE marking 1 more in the crosswalk	Partial
GPAI and foundation models	Not mapped	Art. 53 Obligations for providers of general-purpose AI models Art. 55 Obligations of providers of general-purpose AI models with systemic risk Art. 51 Classification of general-purpose AI models as general-purpose AI models with systemic risk 1 more in the crosswalk	EU AI Act only
IP and copyright	GOVERN 6.1 Policies and procedures are in place that address AI risks associated with third-party entities, including risks of infringement of a third-party's intellectual property or other rights MAP 4.1 Approaches for mapping AI technology and legal risks of its components, including the use of third-party data or software, are in place, followed, and documented, as are risks of infringement of a third party's intellectual property or other rights	Art. 53(1)(c) Copyright policy, including rights reservations Art. 53(1)(d) Public summary of the content used for training	Strong
Agent identity and autonomy	GOVERN 3.2 Policies and procedures are in place to define and differentiate roles and responsibilities for human-AI configurations and oversight of AI systems	Art. 14 Human oversight	Partial
Content provenance and deepfakes	Not mapped	Art. 50(2) Machine-readable marking of synthetic content Art. 50(4) Disclosure of deep fakes Art. 3(60) Definition of deep fake	EU AI Act only
Sandboxes and real-world testing	MEASURE 2.3 AI system performance or assurance criteria are measured qualitatively or quantitatively and demonstrated for conditions similar to deployment setting(s)	Art. 57 AI regulatory sandboxes Art. 60 Testing of high-risk AI systems in real world conditions outside AI regulatory sandboxes Art. 58 Detailed arrangements for, and functioning of, AI regulatory sandboxes 2 more in the crosswalk	Partial
Environmental impact	MEASURE 2.12 Environmental impact and sustainability of AI model training and management activities as identified in the MAP function are assessed and documented	Annex XI 1(2)(e) Known or estimated energy consumption of the GPAI model Art. 40(2) Standardisation deliverables on energy and resource performance Art. 95(2)(b) Codes of conduct: environmental sustainability	Strong
Deployment, change and decommissioning	MANAGE 2.4 Mechanisms are in place and applied, and responsibilities are assigned and understood, to supersede, disengage, or deactivate AI systems that demonstrate performance or outcomes inconsistent with intended use MANAGE 4.1 Post-deployment AI system monitoring plans are implemented, including mechanisms for capturing and evaluating input from users and other relevant AI actors, appeal and override, decommissioning, incident response, recovery, and change management GOVERN 1.7 Processes and procedures are in place for decommissioning and phasing out AI systems safely and in a manner that does not increase risks or decrease the organization's trustworthiness	Art. 26 Obligations of deployers of high-risk AI systems Art. 25 Responsibilities along the AI value chain Art. 43(4) New conformity assessment on substantial modification 3 more in the crosswalk	Strong	Decision Notice & Contest Path Staged Rollout with Rollback Criteria Drift & Fairness Monitor

Can you use the NIST AI RMF to comply with the EU AI Act?

Not by itself. Only harmonised standards cited in the Official Journal (Article 40) and the Commission's common specifications (Article 41) give a presumption of conformity, and the RMF, voluntary US guidance, is neither. It is still scaffolding: its four functions organise the risk management, testing and monitoring the Act's high-risk articles require, and one set of evidence can serve both.

Which should you start with?

If your AI systems reach the EU market or their output is used there, start with the Act: its scope and risk tiers decide which duties apply and from when. Use the NIST AI RMF alongside it as the working method for risk management; it is use-case agnostic, and its functions map onto the Act's risk, testing and monitoring duties.

Next step

Put the comparison to work on your own systems, in the browser.

Check where your system falls under the EU AI Act
The EU AI Act risk classification checker: indicative roles and risk classes, each with its article, and a decision record to file.
List the EU AI Act obligations and deadlines that bind you
The obligations planner: the register rows for your roles, the artefact that evidences each and the date it applies.
Write a FRIA or an AI system impact assessment as one record
The impact assessment builder: every risk linked to the measure and pattern that mitigate it, and the triggers that reopen it.

Indicative, not legal advice and not a conformity claim. Nothing you enter leaves your browser.

Frequently asked questions

Does the EU AI Act apply to US companies?

Yes, when they are in its scope. Article 2(1) reaches providers placing AI systems or GPAI models on the EU market wherever they are established, and providers and deployers in third countries whose system's output is used in the Union. The scope question is where the output is used, not where the system is hosted.

Source: Art. 2

What are the penalties under each?

The Act fines prohibited practices up to EUR 35 million or 7% of worldwide annual turnover, and breaches of operator obligations up to EUR 15 million or 3%, whichever is higher; SMEs pay the lower of the two. The NIST AI RMF carries no penalties: it is voluntary.

Sources: Art. 99, NIST AI 100-1

Is there a NIST AI RMF 2.0?

No. AI RMF 1.0 (NIST AI 100-1, 26 January 2023) remains the citable text. As of 2026-09-24 NIST's framework page states that 1.0 is being revised as part of the White House AI Action Plan, but no revised version is published. Pin the version in control metadata.

Sources: NIST AI 100-1, NIST: AI Risk Management Framework

What does the EU AI Act cover that the NIST AI RMF does not?

In this crosswalk, 2 of the 25 topics have a core EU AI Act clause and no NIST AI RMF clause mapped: GPAI and foundation models; Content provenance and deepfakes. A topic with no NIST AI RMF clause here is one this mapping does not reach, not one the NIST AI RMF is shown to leave out. The overlap table on this page lists the clauses; mappings are illustrative, not a claim of conformity. The NIST column maps AI RMF 1.0 (NIST AI 100-1) only: its companion Generative AI Profile (NIST AI 600-1) adds suggested actions for 12 risks that generative AI creates or exacerbates, among them information integrity and intellectual property, and is not mapped here.

Source: NIST AI 600-1

Both instruments sit inside a wider field: AI governance, explained, from the laws and standards to the engineering practice.

Sources

NIST AI RMF: https://www.nist.gov/itl/ai-risk-management-framework
NIST AI RMF: https://airc.nist.gov/airmf-resources/airmf/
EU AI Act (post-Omnibus): https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27/eng
NIST AI 100-1: https://doi.org/10.6028/NIST.AI.100-1
NIST AI 600-1: https://doi.org/10.6028/NIST.AI.600-1
Regulation (EU) 2026/1744 (Digital Omnibus): https://eur-lex.europa.eu/eli/reg/2026/1744/oj/eng

Every clause on this page, with its note and verification status, is in the topic × framework crosswalk and its JSON download.

Other comparisons: ISO 42001 vs EU AI Act · NIST AI RMF vs ISO 42001