Crosswalk
EU AI Act ↔ NIST AI RMF
The EU AI Act (Regulation 2024/1689) is a binding regulation with penalties; NIST AI RMF is voluntary US guidance. NIST AI RMF is widely used as the operational backbone to prove EU AI Act compliance. The AI Office draft Code of Practice (2025) explicitly acknowledges RMF as a valid controls framework.
| EU AI Act | NIST AI RMF | Notes |
|---|---|---|
Article 9 Risk management system | Manage 1, Map 3 Risk prioritization + benefits and costs | Continuous, iterative process across the lifecycle. |
Article 10 Data and data governance | Map 2, Measure 2 System categorization + testing | Training, validation, testing data quality. |
Article 11 Technical documentation | Manage 4 Documentation | Annex IV specifies EU AI Act minimum content. |
Article 12 Record-keeping (logging) | Measure 3 Monitoring for identified risks | Automatic logs. |
Article 13 Transparency to deployers | Govern 4 Culture, transparency | Instructions for use. |
Article 14 Human oversight | Govern 1 Governance policies | Design-in and organizational measures. |
Article 15 Accuracy, robustness, cybersecurity | Measure 2 Testing (incl. adversarial) | Article 15(5) explicitly requires resilience against adversarial attacks. |
Article 17 Quality management system | Govern 1-4 Governance | Full QMS analogous to ISO 9001 style. |
Article 26 Obligations of deployers | Manage 2 Third parties | Downstream obligations. |
Article 50 Transparency obligations | Govern 4 Transparency | Applies to chatbots, deepfakes, emotion recognition, generative AI. |
Article 72 Post-market monitoring | Measure 3 Monitoring | Provider obligation with public plan. |
Article 73 Serious incident reporting | Manage 3 Incident response | 2 / 10 / 15-day windows depending on severity. |
What to watch
Key differences
- · EU AI Act is binding law with fines up to €35M or 7% turnover; NIST AI RMF is voluntary.
- · EU AI Act applies risk-based categorization (prohibited, high-risk, limited, minimal); RMF is category-agnostic.
- · EU AI Act requires third-party conformity assessment for some high-risk systems; RMF does not.
- · RMF is a US publication in English; the EU AI Act applies across 24 official languages and market surveillance authorities.
Primary sources
Where every mapping was verified
Next steps
Turn a crosswalk into an audit-ready posture
Free vendor matchmaking
Need vendors that cover both frameworks?
Get matched with vendors that ship controls, evidence, and mappings across both frameworks on this page.
No credit card. Independent directory — we do not sell software ourselves.