NIST AI RMF and the EU AI Act: How the Two Frameworks Map

What is the NIST AI Risk Management Framework?

The NIST AI Risk Management Framework, version 1.0, was released by the US National Institute of Standards and Technology in January 2023. It is voluntary, sector neutral and designed to help organisations incorporate trustworthiness into the design, development, use and evaluation of AI systems. The official page is NIST AI Risk Management Framework.

The framework is organised around four functions. GOVERN covers the culture, accountability and policies that run through everything else. MAP establishes context and identifies risks for a specific AI system. MEASURE analyses, tests and tracks those risks. MANAGE prioritises and treats them and plans responses to incidents.

NIST has also published a Generative AI Profile, NIST AI 600-1, in July 2024, which applies the framework to risks specific to generative AI. Many teams call the whole family the NIST AI framework.

What is the EU AI Act?

The EU AI Act is Regulation (EU) 2024/1689, published on EUR-Lex. It entered into force on 1 August 2024 and applies in stages: prohibitions from 2 February 2025, obligations for general-purpose AI models from 2 August 2025, and most remaining obligations from 2 August 2026. Regulation (EU) 2026/1744, in force since 27 July 2026, moved the high-risk requirements to 2 December 2027 for Annex III systems and 2 August 2028 for Annex I products, so check the current consolidated text for the applicable dates.

The Act takes a risk-based approach. It prohibits certain practices, imposes detailed requirements on high-risk AI systems, sets transparency duties for some systems and regulates general-purpose AI models. Under Article 2 it reaches providers placing AI systems on the EU market regardless of where they are established, and providers and deployers outside the EU where the output is used in the EU. The European Commission explains the regulatory framework on its digital strategy site.

What is the difference between a voluntary framework and a regulation?

The practical differences matter more than the labels.

• Legal force: the NIST AI RMF creates no legal obligation by itself. The EU AI Act does, and it is enforced by national authorities and the EU AI Office. Penalties can reach EUR 35 million or 7% of worldwide annual turnover for prohibited practices, and EUR 15 million or 3% for most other obligations.
• Prescription: the NIST framework describes outcomes and leaves the method to you. The Act sets specific requirements for specific roles such as provider and deployer, and for specific categories such as high-risk systems.
• Classification: the Act requires you to decide which category an AI system falls into. The framework asks you to understand risk in context but does not sort systems into legal classes.
• Evidence: under the Act you may need technical documentation and records that an authority or notified body can inspect. The framework encourages documentation but does not define a conformity procedure.

A framework can therefore be adopted at your own pace, while a regulation sets the minimum you must meet if it applies to you.

Roles also differ. The Act distinguishes providers, deployers, importers and distributors, and the duties change with the role. The NIST framework speaks of AI actors across the life cycle and expects each organisation to assign accountability internally. If your organisation both builds AI systems and uses third party models, you may hold more than one legal role at the same time, which is worth recording early because it shapes every later decision.

How do NIST AI RMF and the EU AI Act map?

The EU AI Act sets out requirements for high-risk AI systems in Articles 9 to 15. The NIST functions line up with them in a general way. The list below is an orientation, not a legal equivalence, and a framework outcome never replaces a legal requirement.

• Article 9, risk management system: GOVERN sets the policies and accountability, MAP identifies risks in context, MANAGE treats them across the life cycle.
• Article 10, data and data governance: MAP documents data provenance and context, MEASURE tests for quality, representativeness and bias.
• Article 11, technical documentation: GOVERN and MAP drive the documentation of purpose, design and known limits.
• Article 12, record-keeping: MEASURE and MANAGE depend on logging and monitoring that produce traceable records.
• Article 13, transparency and information to deployers: MAP and GOVERN support clear communication of capabilities, limits and intended use.
• Article 14, human oversight: GOVERN defines roles and escalation, MANAGE puts intervention and override into practice.
• Article 15, accuracy, robustness and cybersecurity: MEASURE provides testing and metrics, MANAGE handles response and improvement.

The framework does not cover everything the Act requires. Conformity assessment, registration in the EU database, the quality management system for providers and deployer duties such as fundamental rights impact assessments for certain uses are legal mechanics that sit outside the NIST structure.

What should an organisation subject to both do?

If you operate in the EU market and also follow US or global practice, a sequence like this keeps effort contained:

1. Build one AI inventory. List every system, its purpose, its role in your organisation (provider, deployer or both) and where its output is used.
2. Classify under the Act. Decide which systems are prohibited, high-risk, subject to transparency duties or out of scope. The Act decides the legal workload.
3. Use the NIST functions as the operating model. GOVERN, MAP, MEASURE and MANAGE give you a repeatable way to run risk work, test results and incident response.
4. Close the legal gaps separately. For each high-risk system, check the Article 9 to 15 requirements and the provider and deployer duties against your evidence.
5. Keep evidence in one place. Decisions, test results, logs and approvals should be retrievable per system.

Our 90-day EU AI Act mapping guide walks through the inventory and classification steps in more detail. A management system standard such as ISO/IEC 42001 can sit on top as the organising structure, and its details are on iso.org.

How Krasper helps

Krasper Technologies works with regulated organisations in the UAE, the GCC and the EU. Our AI governance consulting covers the inventory, classification and gap analysis described above, and helps you decide how much of the NIST structure to adopt as your operating model.

Raigate is a self-hosted AI governance platform that applies policy to AI traffic and records the decisions in an audit trail. It supports evidence for MEASURE and MANAGE style activities and for record-keeping needs. It does not certify an organisation, and it does not guarantee compliance with the EU AI Act or any other regulation.