Crosswalk
NIST AI RMF ↔ EU AI Act GPAI Code of Practice
The EU AI Act General-Purpose AI Code of Practice (Chapter V, Article 56) sets voluntary commitments for GPAI model providers. NIST AI RMF, and specifically NIST AI 600-1 (Generative AI Profile), is the leading US operational framework. Signatories to the Code of Practice can use RMF documentation to demonstrate systemic-risk management.
| NIST AI RMF | EU AI Act GPAI Code of Practice | Notes |
|---|---|---|
GAI-2 (Systemic risk) Systemic risk identification | Map 5, Measure 1 Impact + metrics | Adversarial-use and misuse taxonomy. |
GAI-3 (Adversarial testing) Model evaluations | Measure 2 Testing (adversarial) | Direct alignment. |
GAI-4 (Incident reporting) Serious incident reporting | Manage 3 Incident response | EU AI Act incident timelines vary by severity. |
GAI-6 (Transparency) Model documentation | Manage 4 Documentation | Model card structure works for both. |
GAI-8 (Cyber) Cybersecurity | Measure 2.8 Adversarial resilience | Model theft, weight exfiltration. |
What to watch
Key differences
- · Code of Practice applies only to GPAI models (with a systemic-risk tier); RMF applies to any AI system.
- · Code of Practice is voluntary but its adoption is de-facto expected for market access with GPAI in EU.
- · RMF is a US publication; Code of Practice is an EU instrument.
- · Code of Practice thresholds are compute-based (10^25 FLOPs); RMF uses risk-based scoping.
Primary sources
Where every mapping was verified
Next steps
Turn a crosswalk into an audit-ready posture
Free vendor matchmaking
Need vendors that cover both frameworks?
Get matched with vendors that ship controls, evidence, and mappings across both frameworks on this page.
No sign-up. Independent directory — we do not sell software ourselves.