Organisations that have adopted the NIST AI Risk Management Framework often assume it makes them ready for the EU AI Act, but one is a voluntary method for managing AI risk and the other is a regulation with legal duties, deadlines and fines. The AI RMF (NIST AI 100-1) helps you decide what good AI risk management looks like. Regulation (EU) 2024/1689, the AI Act, tells providers and deployers what they must do, depending on the risk class of each AI system and the role they play. This guide compares the two on legal force, scope, structure and evidence, maps AI RMF outcomes to AI Act articles, and shows the obligations that no framework adoption covers: conformity assessment, CE marking, registration and role-specific duties. It is for AI governance, GRC, legal-facing security and product leads, especially in organisations outside the EU that sell into it. Status line, checked on 13 November 2026: NIST's AI RMF page states that AI RMF 1.0, released on 26 January 2023, is being revised as part of the White House AI Action Plan; the AI Act text used here is the consolidated version as at 27 July 2026 on the European Commission's AI Act Service Desk, which includes the Digital Omnibus on AI amendments.
Key takeaways
- Short answer: the AI RMF is how you can manage AI risk, the AI Act is what the law requires. Use the AI RMF as the method inside your programme, and treat the AI Act as a separate set of obligations to map, evidence and meet by its dates.
- Jurisdiction decides, not preference. The AI Act reaches providers outside the EU when they place systems on the EU market, and providers and deployers outside the EU when the output of their AI system is used in the Union. AI RMF adoption does not change that.
- Risk class and role drive the work. Under the AI Act, a high-risk provider carries Article 16 duties, a deployer carries Article 26 duties, and most other systems carry far less. The AI RMF has no risk classes or legal roles.
- The overlap is real but partial. AI RMF outcomes cover much of Article 9 risk management, Article 17 quality management themes and post-market monitoring, but nothing in the AI RMF produces a conformity assessment, an EU declaration of conformity, CE marking or EU database registration.
- Dates have moved. The Digital Omnibus on AI moved high-risk application to 2 December 2027 for Annex III systems and 2 August 2028 for Annex I product systems; prohibitions and AI literacy have applied since 2 February 2025.
What each one is
NIST AI RMF 1.0
NIST describes the AI RMF as intended for voluntary use, to help incorporate trustworthiness into the design, development, use and evaluation of AI systems. Its Core has four functions: GOVERN (cross-cutting), MAP, MEASURE and MANAGE, with 6, 5, 4 and 4 categories respectively. The Core states that its actions do not constitute a checklist, nor are they necessarily an ordered set of steps. Companion resources include the Playbook, crosswalks, the Generative AI Profile (NIST AI 600-1, released 26 July 2024) and a concept note for a critical infrastructure profile released on 7 April 2026. It carries no penalties and no regulator enforces it. For the full structure see the NIST AI RMF Guide and, for generative AI, the NIST AI 600-1 Generative AI Profile Guide.
EU AI Act
The AI Act is an EU regulation, directly applicable in every Member State. Obligations depend on the system's risk class (prohibited practices, high-risk, transparency obligations, general-purpose AI models) and on the operator's role: provider, deployer, importer, distributor, product manufacturer or authorised representative. High-risk providers must meet the requirements in Chapter III Section 2 (Articles 8 to 15), run a quality management system, complete conformity assessment and register in the EU database. Article 99 sets fines. The programme view is in the EU AI Act Compliance Guide; this page does not repeat it.
Side-by-side comparison
| Dimension | NIST AI RMF 1.0 | EU AI Act |
|---|---|---|
| Legal force | Voluntary framework | Binding regulation (EU) 2024/1689, as amended |
| Publisher | NIST, US Department of Commerce | European Parliament and Council; Commission and AI Office implement |
| Who it applies to | Any organisation that chooses to use it | Providers, deployers, importers, distributors, product manufacturers and authorised representatives within Article 2 |
| Territorial reach | None; used worldwide by choice | EU market placement, EU deployers, and non-EU operators whose AI output is used in the Union |
| Unit of analysis | AI risks across the lifecycle, set by the organisation | Each AI system's risk class and each operator's role |
| Structure | Four functions, categories, subcategories; profiles | Articles, annexes, implementing and delegated acts, harmonised standards |
| Risk tiers | None defined; organisation sets risk tolerance (MAP 1.5) | Prohibited, high-risk (Annex I and Annex III), transparency, general-purpose AI |
| Assurance outcome | Self-declared alignment, profiles | Conformity assessment, EU declaration of conformity, CE marking, registration |
| Enforcement | None | National market surveillance authorities; AI Office for general-purpose AI models |
| Penalties | None | Up to EUR 35 million or 7% of worldwide annual turnover for prohibited practices |
| Change mechanism | NIST revision, new profiles | Legislative amendment (for example the Digital Omnibus), delegated acts, guidelines, standards |
Scope, jurisdiction and role
Article 2 sets the AI Act's reach. It covers providers placing AI systems or general-purpose AI models on the EU market or putting systems into service in the Union, irrespective of whether they are established in the Union or a third country; deployers established or located in the Union; providers and deployers in third countries where the output produced by the AI system is used in the Union; importers and distributors; product manufacturers placing AI with their product under their own name; authorised representatives; and affected persons located in the Union. Exclusions include AI used exclusively for military, defence or national security purposes, research and development before placing on the market (testing in real-world conditions is not excluded), and the deployer obligations of natural persons in purely personal, non-professional activity.
Role can change by action. Under Article 25(1), a distributor, importer, deployer or other third party becomes the provider of a high-risk AI system, with all Article 16 duties, if it puts its name or trademark on the system, makes a substantial modification so that the system remains high-risk, or changes the intended purpose of a system, including a general-purpose one, so that it becomes high-risk. A US company that fine-tunes and rebrands a model for an EU employment-screening use can become a provider without intending to. The AI RMF has no equivalent concept; its AI actors are descriptive, not legal roles. See the EU AI Act Provider vs Deployer Obligations Guide.
Risk classes against AI RMF risk tolerance
The AI RMF asks you to set and document your own risk tolerance (MAP 1.5) and categorise systems (MAP 2). The AI Act sets the classes for you, and your tolerance cannot lower them.
- High-risk by product (Article 6(1)): an AI system that is a safety component of a product, or is itself a product, covered by Annex I legislation and required to undergo third-party conformity assessment. The Omnibus added paragraphs 1a to 1c: systems used solely for non-safety purposes such as user assistance, performance optimisation or quality control are not safety components, unless their failure would endanger health and safety.
- High-risk by use (Article 6(2) and Annex III): listed use cases, subject to the Article 6(3) derogation where a system performs a narrow procedural task, improves a completed human activity, detects decision patterns without replacing human assessment, or performs a preparatory task. Annex III systems that profile natural persons are always high-risk.
- Documented non-high-risk (Article 6(4)): a provider relying on the derogation must document the assessment before placing on the market and register under Article 49(2). An AI RMF MAP record can be the working paper, but the AI Act decides what it must contain and where it goes.
Prohibited practices, transparency duties and general-purpose AI model obligations sit alongside these classes; see the EU AI Act High-Risk vs General-Purpose AI Obligations and the EU AI Act Prohibited Practices Guide.
Mapping AI RMF outcomes to AI Act articles
The mapping below is NHI Mgmt Group's reading of the fetched texts, not an official crosswalk. Use it to reuse AI RMF work as evidence, and read the "gap" column as work the AI RMF will not produce.
| AI RMF outcome | AI Act article | Overlap | Gap to close |
|---|---|---|---|
| GOVERN 1.1 legal and regulatory requirements understood | Article 2 scope; Article 6 classification | Process for identifying applicable law | Per-system classification record and role determination |
| GOVERN 1.6 AI system inventory | Article 6(4); Article 49 registration | Inventory is the starting point | EU database entries before placing on the market |
| GOVERN 2 accountability structures | Article 17(1)(m) accountability framework | Defined responsibilities | Written QMS policies, procedures and instructions |
| MAP 1.5 risk tolerance; MAP 5 impacts | Article 9(2) to (5) risk management | Identify, estimate and evaluate risks | Residual risk judged acceptable per hazard; consider under-18s and vulnerable groups |
| MEASURE 2 evaluation of trustworthy characteristics; MEASURE 2.7 security and resilience | Article 9 testing; Article 15 accuracy, robustness and cybersecurity | Test, evaluation, verification and validation | Testing against predefined metrics and probabilistic thresholds before market placement |
| GOVERN 6 and MANAGE 3 third-party risk | Article 25(4) written agreements with suppliers | Supplier risk process | Contract terms on information and assistance needed for compliance |
| MANAGE 4.1 post-deployment monitoring | Article 72 post-market monitoring; Article 26(5) deployer monitoring | Monitoring plans | Provider post-market monitoring system; deployer duty to inform provider and suspend use on risk |
| MANAGE 4 incident communication | Article 73 serious incident reporting (via Article 17(1)(i)) | Incident response and communication | Legal reporting to authorities within set deadlines |
| No equivalent | Article 43 conformity assessment; Article 47 declaration; Article 48 CE marking | None | Entire legal assurance process |
| No equivalent | Article 26(6) log retention; 26(7) worker information; 26(11) informing persons | Partial (logging practice) | Logs kept at least six months; notices before use |
For other crosswalks, including ISO/IEC 42001, see the AI Security Frameworks Crosswalk Guide and NIST AI RMF vs ISO/IEC 42001.
Obligations the AI RMF does not produce
These are the items most often missed by teams who treat AI RMF adoption as AI Act readiness. Article 16 lists them for high-risk providers.
- Conformity assessment (Article 43): for Annex III points 2 to 8, internal control under Annex VI. For Annex III point 1 (biometrics), the provider may choose internal control only where it has applied harmonised standards or common specifications; otherwise the notified body procedure in Annex VII applies. Annex I products follow their sectoral procedure. A substantial modification triggers a new assessment, except for pre-determined changes in a continuously learning system documented at the initial assessment. See the EU AI Act Conformity Assessment and Harmonised Standards Guide.
- EU declaration of conformity and CE marking (Articles 47 and 48): formal documents and marking that no voluntary framework issues.
- Registration (Article 49): providers register themselves and each Annex III high-risk system in the EU database under Article 71 before placing it on the market; deployers that are public authorities or EU bodies register their use; Annex III point 2 critical infrastructure systems are registered at national level.
- Quality management system (Article 17): written policies covering points (a) to (m), from regulatory compliance strategy and change management to data management, post-market monitoring, incident reporting and an accountability framework. Paragraph 2, amended by the Omnibus, allows proportionality for SMEs and small mid-caps without lowering the required rigour.
- Documentation and logs (Articles 18 and 19): retention of documentation and automatically generated logs.
- Deployer duties (Article 26): use per instructions, human oversight by people with competence, training and authority, representative input data where the deployer controls it, monitoring and reporting, log retention of at least six months, informing workers and their representatives before workplace use, and informing people subject to Annex III decisions.
Timeline and penalties
| Date | What applies (Article 113, consolidated 27 July 2026) |
|---|---|
| 2 February 2025 | Chapters I and II: general provisions including AI literacy, and prohibited practices |
| 2 August 2025 | Notified bodies, general-purpose AI models (Chapter V), governance, penalties (except Article 101), confidentiality (Article 78) |
| 27 July 2026 | Articles 102 to 110 (new point (d)) |
| 2 August 2026 | General application of the Regulation |
| 2 December 2026 | Article 5(1) points (ba) and (bb), and Article 5(1a) and (1b) |
| 2 December 2027 | Chapter III Sections 1 to 3 for Annex III high-risk systems |
| 2 August 2028 | Chapter III Sections 1 to 3 for Annex I product systems |
Article 99 sets maximum fines of EUR 35 million or 7% of worldwide annual turnover for prohibited practices, EUR 15 million or 3% for listed operator obligations including Articles 16, 26 and 50, and EUR 7.5 million or 1% for incorrect, incomplete or misleading information to authorities or notified bodies, whichever is higher. For SMEs and start-ups the lower figure applies; under the new paragraph 6a, the lower figure also applies to small mid-caps for the EUR 15 million and EUR 7.5 million tiers. The AI RMF has no timeline or penalties; its revision is the only date to track. Follow dates in the EU AI Act Implementation Timeline Tracker.
Decision criteria
| Situation | What to do | Why |
|---|---|---|
| No EU market, no EU users, no output used in the EU | AI RMF as the programme method | AI Act does not apply under Article 2 |
| Non-EU company, AI output used in the EU | AI RMF method plus AI Act obligation register per system | Article 2(1)(c) reach |
| Provider of an Annex III high-risk system | AI Act first: Article 16 duties, QMS, conformity assessment, registration; AI RMF inside Article 9 and 17 processes | Legal duties with fixed dates and fines |
| Deployer of a high-risk system | Article 26 duties; AI RMF MANAGE outcomes for monitoring and oversight | Deployer obligations are narrower but binding |
| Fine-tuning or rebranding another provider's system | Check Article 25 before release | You may become the provider |
| Only minimal-risk systems | AI RMF plus AI literacy and any Article 50 transparency duties | Few AI Act duties, but not none |
Small organisations can keep one AI register with a column for AI Act class and role and use AI RMF outcomes as the risk method. Large organisations should run a single control set with two tags per control (AI RMF subcategory and AI Act article), so one test result evidences both, and assign legal review to classification and role decisions.
Worked scenario: a US HR software provider
A US company sells a CV-ranking feature to EU employers and has aligned to the AI RMF for two years, with GOVERN policies, a MAP inventory and MEASURE test reports.
- Scope: the system is placed on the EU market, so Article 2(1)(a) applies regardless of where the company is established.
- Classify: recruitment and selection is an Annex III use. Annex III systems that profile natural persons cannot use the Article 6(3) derogation, and candidate scoring will usually involve profiling, so the company treats the feature as high-risk and records its reasoning.
- Role: the company is the provider; each EU employer is a deployer with Article 26 duties, including informing workers' representatives and candidates.
- Reuse: AI RMF MAP and MEASURE artefacts feed the Article 9 risk management file and Article 15 testing evidence; GOVERN policies seed the Article 17 QMS.
- Close gaps: write the remaining QMS procedures, build Annex IV technical documentation, run internal control under Annex VI, draw up the EU declaration, affix CE marking, register in the EU database, and appoint an authorised representative in the Union.
- Plan to date: Annex III obligations apply from 2 December 2027; schedule the conformity work back from that date.
Detection and measurement
- Classification coverage: percentage of inventoried AI systems with a recorded AI Act class, role and reasoning.
- Dual-tagged controls: percentage of AI controls tagged to both an AI RMF subcategory and an AI Act article.
- Gap closure: open items per high-risk system against Article 16 points (a) to (l).
- Role change checks: percentage of model fine-tunes, rebrands and purpose changes reviewed against Article 25 before release.
- Deadline runway: days remaining to the applicable Article 113 date for each high-risk system, against planned completion.
Common failure patterns
- Treating RMF alignment as compliance: a well-run AI RMF programme with no conformity assessment, declaration or registration is not compliant for a high-risk provider.
- Assuming distance protects you: non-EU providers and deployers are in scope when AI output is used in the Union.
- Ignoring role changes: fine-tuning and rebranding under Article 25 turns a deployer into a provider.
- Self-set risk tiers: using an internal "low risk" rating for a system the AI Act lists in Annex III.
- Stale dates: plans built on the original 2 August 2026 high-risk date rather than the amended Article 113.
- Using the derogation without paperwork: relying on Article 6(3) without documenting the assessment and registering under Article 49(2).
Practitioner checklist
- Record, per AI system, whether Article 2 applies and why.
- Record AI Act class, Article 6(3) reasoning where used, and your role.
- Check Article 25 before every fine-tune, rebrand or change of intended purpose.
- Tag each AI control with its AI RMF subcategory and AI Act article.
- For high-risk provision, plan conformity assessment, declaration, CE marking and registration as separate workstreams.
- For high-risk deployment, assign human oversight, log retention of at least six months, and worker and individual notices.
- Track Article 113 dates against the consolidated text and the AI RMF revision.
- Get legal review of classification and role decisions; frameworks do not replace it.
Standards and references
- European Commission AI Act Service Desk: Article 113 Entry into force and application
- European Commission AI Act Service Desk: Article 2 Scope
- European Commission AI Act Service Desk: Article 6 Classification rules for high-risk AI systems
- European Commission AI Act Service Desk: Article 16 Obligations of providers
- European Commission AI Act Service Desk: Article 26 Obligations of deployers
- European Commission AI Act Service Desk: Article 43 Conformity assessment
- NIST: AI Risk Management Framework
- NIST AI Resource Center: AI RMF Core
Related NHI Mgmt Group resources: NIST AI RMF Guide, EU AI Act Compliance Guide, EU AI Act Readiness Checklist, AI Register and AI Inventory Template. This guide summarises the NIST AI RMF and the EU AI Act as at 13 November 2026 and is not legal advice.