Crosswalk
NIST AI RMF ↔ EU AI Act GPAI Code of Practice
The EU AI Act General-Purpose AI Code of Practice (Chapter V, Article 56) sets voluntary commitments for GPAI model providers. NIST AI RMF, and specifically NIST AI 600-1 (Generative AI Profile), is the leading US operational framework. Signatories to the Code of Practice can use RMF documentation to demonstrate systemic-risk management.
| NIST AI RMF | EU AI Act GPAI Code of Practice | Notes |
|---|---|---|
GAI-2 (Systemic risk) Systemic risk identification | Map 5, Measure 1 Impact + metrics | Adversarial-use and misuse taxonomy. |
GAI-3 (Adversarial testing) Model evaluations | Measure 2 Testing (adversarial) | Direct alignment. |
GAI-4 (Incident reporting) Serious incident reporting | Manage 3 Incident response | EU AI Act incident timelines vary by severity. |
GAI-6 (Transparency) Model documentation | Manage 4 Documentation | Model card structure works for both. |
GAI-8 (Cyber) Cybersecurity | Measure 2.8 Adversarial resilience | Model theft, weight exfiltration. |
What to watch
Key differences
- · Code of Practice applies only to GPAI models (with a systemic-risk tier); RMF applies to any AI system.
- · Code of Practice is voluntary but its adoption is de-facto expected for market access with GPAI in EU.
- · RMF is a US publication; Code of Practice is an EU instrument.
- · Code of Practice thresholds are compute-based (10^25 FLOPs); RMF uses risk-based scoping.
Primary sources
Where every mapping was verified
Next steps
Turn a crosswalk into an audit-ready posture
Free vendor matchmaking
Need vendors that cover both frameworks?
Get matched with vendors that ship controls, evidence, and mappings across both frameworks on this page.
No credit card. Independent directory — we do not sell software ourselves.