Appearance
NIST AI RMF vs EU AI Act — Side-by-Side Comparison for AI Governance
NIST AI RMF 1.0 (NIST AI 100-1, January 2023) and the EU AI Act (Regulation (EU) 2024/1689) are different types of document. NIST AI RMF 1.0 is guidance from the National Institute of Standards and Technology (NIST). NIST AI 100-1 writes that the framework is "intended to be voluntary". It gives outcomes for AI risk management and sets no obligation for an organization or an AI actor. The EU AI Act is a Regulation of the European Union. It gives obligations to providers, deployers, and other operators in its scope.
An organization can use NIST AI RMF 1.0 to give a structure to its internal AI risk management. NIST AI RMF 1.0 replaces no obligation of the EU AI Act. For example, it replaces no obligation of providers (Article 16) or deployers (Article 26) of high-risk AI systems.
This page compares the two instruments. It also gives this page's own mapping of the four functions of the AI RMF Core to the obligations of providers of high-risk AI systems.
Which instrument applies
For an organization, the EU AI Act applies through its scope rules. NIST AI RMF 1.0 applies only when the organization decides to use it. These items show where each instrument starts:
- Providers: Article 2(1)(a) covers providers placing AI systems or general-purpose AI models on the Union market, or "putting into service" AI systems there, wherever established.
- Other scope cases: Article 2(1)(b) to (g) covers operators and affected persons in other circumstances, each with its own conditions.
- EU AI Act exclusions: Article 2 includes exclusions and limits, for example for specified military, defense, national security, and scientific research purposes.
- EU AI Act roles: obligations are different for each operator role, and a general-purpose AI model provider is a provider (Article 3(3)).
- What the EU AI Act regulates: prohibited AI practices (Article 5) and high-risk AI systems (Article 6 with Annexes I and III). Also, transparency obligations for providers and deployers of some AI systems (Article 50), and general-purpose AI models (Chapter V). See Find the applicable obligations.
- Conformity assessment: providers of high-risk AI systems have conformity-assessment and CE-marking duties in Article 16(f) and (h), subject to Article 2(2).
- General-purpose AI models: Chapter V applies to providers placing on the market general-purpose AI models in the Union, wherever the providers are established (Article 2(1)(a)). See Summary.
- NIST AI RMF 1.0: NIST AI 100-1 gives no geographic scope and imposes no obligation to use the framework. It gives "law- and regulation-agnostic" as an attribute of the framework (Appendix D, attribute 9). See Legal effect.
- Together: an organization in the scope of the EU AI Act can also use NIST AI RMF 1.0 for its AI risk management. The obligations of the EU AI Act stay the same.
Summary
NIST AI RMF 1.0 and the EU AI Act have these primary differences:
- NIST AI RMF 1.0: NIST AI RMF 1.0 is guidance that NIST published in January 2023 as NIST AI 100-1. Its Core has four functions: GOVERN, MAP, MEASURE, and MANAGE. Each function has categories and subcategories. NIST AI 100-1 also gives Profiles. It describes no certification and gives no penalties.
- EU AI Act: Article 113, as amended by Regulation (EU) 2026/1744, sets different dates for different provisions.
- Penalties for Article 5: Article 99(3) sets administrative fines for non-compliance with the Article 5 prohibitions.
General-purpose AI models: the EU AI Act's Chapter V provider obligations are not part of the AI RMF Core. Article 53(1) requires model documentation, information and documentation for downstream providers, a copyright policy, and a public training-content summary. Article 53(2) excepts specified free and open-source models from the documentation duties in Article 53(1)(a) and (b), on its conditions. Article 54(6) excepts such models from the authorized-representative duty on its conditions, and these exceptions do not apply to models with systemic risk. The Chapter V rules also address notification, representatives, systemic risk, voluntary codes of practice, and the compliance date for earlier models (Article 111(3)). NIST AI 600-1 is a companion profile for generative AI risk management and replaces none of these duties.
The two instruments side by side
For NIST AI RMF 1.0 and the EU AI Act, the table below gives each item side by side.
| Item | NIST AI RMF 1.0 | EU AI Act |
|---|---|---|
| Publisher | NIST (U.S. Department of Commerce) | The European Parliament and the Council |
| Document and date | NIST AI 100-1, January 2023 | Regulation (EU) 2024/1689 of 13 June 2024. It entered into force on 1 August 2024. Article 113 gives the dates from which its provisions apply |
| Type | Guidance, not a law | A Regulation that is "binding in its entirety and directly applicable in all Member States" |
| Legal effect | No obligation for an organization or an AI actor | Obligations for the operators in its scope, from the dates of Article 113 |
| Scope | NIST AI 100-1 gives no geographic scope. It is "a resource to the organizations designing, developing, deploying, or using AI systems" | Operators in Article 2(1)(a) to (f), and affected persons located in the Union in point (g), subject to the exclusions of Article 2 |
| Risk model | Four functions. NIST AI 100-1 writes: "Assuming a governance structure is in place, functions may be performed in any order across the AI lifecycle". NIST AI 100-1 adds that "the process should be iterative". It prioritizes risks and categorizes AI systems (MAP 2), but it does not give the EU AI Act's legal risk categories | Legal categories: prohibited AI practices (Article 5), high-risk AI systems (Article 6 with Annexes I and III), and transparency obligations for some AI systems (Article 50). Article 50 does not change the requirements of Chapter III (Article 50(6)). General-purpose AI models are in Chapter V |
| Certification or conformity | NIST AI 100-1 describes no certification | The provider of a high-risk AI system makes sure that the system undergoes the conformity assessment of Article 43. The provider also affixes the CE marking (Article 16(f) and (h)). A notified body takes part only in the Article 43 procedures that include one, for example the Annex VII procedure. Notified bodies issue certificates in the Annex VII procedure (Article 44(1)) |
| Roles | AI actors (Section 2 and Appendix A). NIST AI 100-1 gives them no obligation | Operators (Article 3(8)): provider, product manufacturer, deployer, authorized representative, importer, distributor. A provider of a general-purpose AI model is a provider (Article 3(3)) |
| Generative AI | NIST AI 600-1 (July 2024) is a profile of AI RMF 1.0 for generative AI. It defines 12 risks that are novel to generative AI or that generative AI makes worse | General-purpose AI models in Chapter V, Articles 51 to 56. Article 55 adds obligations for systemic risk. These are models, not a class of generative AI. Providers and deployers have conditional marking and disclosure duties for synthetic content and deep fakes (Article 50(2) and (4)). For systems that make synthetic content and were placed on the market before 2 August 2026, providers have until 2 December 2026 to comply with Article 50(2) (Article 111(4)) |
| Documentation | Profiles, for example a Current Profile and a Target Profile. NIST AI 100-1 gives no profile templates (Section 6) | For high-risk AI systems: technical documentation (Article 11 and Annex IV), a quality management system (Article 17), and automatic recording of events (logs) (Article 12). Deployers keep the logs that they control (Article 26(6)) |
| Monitoring after deployment | MANAGE 4.1: post-deployment monitoring plans (an outcome) | Article 72 requires providers of high-risk AI systems to "establish and document a post-market monitoring system" |
| Incidents | No reporting obligation to an authority. GOVERN 4.3 and MANAGE 4.3 give outcomes about incidents | Providers of high-risk AI systems report serious incidents to market surveillance authorities (Article 73). For high-risk AI systems in Article 75(1), Article 75(1a) requires providers to report serious incidents to the AI Office. Providers of general-purpose AI models with systemic risk report to the AI Office and, "as appropriate", to national competent authorities (Article 55(1)(c)) |
| Penalties | None | Up to EUR 35 000 000 or 7% for the Article 5 prohibitions (Article 99(3)). Up to EUR 15 000 000 or 3% for non-compliance with the provisions of Article 99(4). Examples are obligations of providers, deployers, and Article 50. Up to EUR 7 500 000 or 1% for "incorrect, incomplete or misleading information to notified bodies or national competent authorities in reply to a request" (Article 99(5)). The percentage is of the total worldwide annual turnover of an undertaking for the preceding financial year, "whichever is higher". Micro, small and medium-sized enterprises (SMEs), "including start-ups", get the lower value (Article 99(6)). Small mid-cap enterprises get the lower value only for paragraphs 4 and 5 (Article 99(6a)). The Commission can fine providers of general-purpose AI models (Article 101). The AI Office applies Article 99(3) to (7) to the operators of Article 75(1) (Article 75c(4)). See Penalties and enforcement |
| Enforcement | None | National competent authorities, the Commission, and the AI Office have different enforcement powers (Articles 70, 74, 75, and 88) |
| Used when | An organization decides to use it for its AI risk management | An operator is in the scope of Article 2(1) |
The four functions and the EU AI Act Articles
The table below is this page's own mapping of the four functions of NIST AI RMF 1.0 to EU AI Act Articles. NIST AI 100-1 does not map its Core to the EU AI Act, and the EU AI Act does not refer to NIST AI RMF. The only EU item on the NIST crosswalks page is an illustration of January 26, 2023. It relates the NIST trustworthiness characteristics to the "Proposed EU AI Act" and to other texts.
The table shows only the obligations of providers of high-risk AI systems. A mapping does not change an obligation. The EU AI Act gives obligations to operators, and an outcome of NIST AI RMF 1.0 is not a replacement for these obligations.
| Function of NIST AI RMF 1.0 | Subjects in NIST AI 100-1 | EU AI Act Articles for providers of high-risk AI systems |
|---|---|---|
| GOVERN | Policies, accountability, workforce diversity, culture, feedback from AI actors, and third-party risk (GOVERN 1 to 6) | The risk management system (Article 9). The provider makes sure that the system complies with Article 9 (Article 16(a)). The quality management system (Article 17 and Article 16(c)) |
| MAP | Context and intended purposes (MAP 1), categorization of the AI system (MAP 2), capabilities and costs (MAP 3), risks of components (MAP 4), and impacts (MAP 5) | Identification, analysis, and estimation of risks for the intended purpose and for reasonably foreseeable misuse (Article 9(2), points (a) and (b)). Technical documentation (Article 11 and Annex IV) |
| MEASURE | Methods and metrics (MEASURE 1), the trustworthy characteristics of AI systems (MEASURE 2), tracking of risks (MEASURE 3), and feedback about measurement (MEASURE 4) | Tests, "as appropriate, at any time throughout the development process, and, in any event, prior to their being placed on the market or put into service", against prior defined metrics and probabilistic thresholds (Article 9(6) to (8)). "Accuracy, robustness and cybersecurity" (Article 15) |
| MANAGE | Risk treatment and response (MANAGE 1 and 2), third-party risks (MANAGE 3), and post-deployment monitoring, incidents, and communication (MANAGE 4) | Risk management measures (Article 9(2), point (d)). The post-market monitoring system (Article 72). Reports about serious incidents (Article 73) |
For the obligations in each Article, see the provider obligations of Articles 8 to 15 and Post-market monitoring and serious incidents.
Where the two instruments agree and where they are different
NIST AI RMF 1.0 and the EU AI Act address some of the same subjects. Only the EU AI Act gives obligations. These items compare the two texts:
- Risk: the two instruments are risk-based. NIST AI 100-1 prioritizes risks against the organization's context (Section 1.2.3 and MANAGE 1.2). Its system categorization (MAP 2) does not give the EU AI Act's legal risk categories. The EU AI Act sets legal categories for practices (Article 5), AI systems (Article 6), and general-purpose AI models (Article 51(1)).
- Prohibited practices: NIST AI 100-1 names no prohibited practice. Where an AI system presents unacceptable negative risk levels, Section 1.2.3 recommends that "development and deployment should cease in a safe manner until risks can be sufficiently managed". Article 5 of the EU AI Act prohibits listed practices, and some of the prohibitions have conditions or exceptions. Article 5(1), points (ba) and (bb), apply from 2 December 2026. See the prohibited AI practices of Article 5.
- Transparency and human oversight in the EU AI Act: for high-risk AI systems, the EU AI Act has Article 13 (information to deployers) and Article 14 (human oversight). It also has Article 26 (obligations of deployers, for example human oversight in Article 26(2)). Article 50 is not a high-risk provision. It gives transparency obligations to providers and deployers of some AI systems, and it does not change the rules of Chapter III (Article 50(6)).
- Transparency and human oversight in NIST AI RMF 1.0: "Accountable and Transparent" (Section 3.4) and "Explainable and Interpretable" (Section 3.5) are characteristics of trustworthy AI in Part 1 of NIST AI 100-1. MEASURE 2.8 and MEASURE 2.9 examine them. GOVERN 3.2 and MAP 3.5 give outcomes about human oversight. The subjects are related to the EU AI Act provisions, but no source makes them equal. See Trustworthy AI characteristics.
- Accuracy, robustness, and cybersecurity: Article 15 gives these requirements for high-risk AI systems. MEASURE 2.5 ("valid and reliable"), MEASURE 2.6 ("safe"), and MEASURE 2.7 ("security and resilience") address related subjects. No source makes them equal.
- Value chain: Article 25 ("Responsibilities along the AI value chain") and GOVERN 6 and MANAGE 3 (third-party software, data, and entities) address related subjects.
- Post-market monitoring: Article 72 is an obligation of providers of high-risk AI systems. MANAGE 4.1 is an outcome for post-deployment monitoring plans.
- Incidents: Article 73 and Article 55(1)(c) give obligations to report to authorities. GOVERN 4.3 is about identification of incidents and information sharing. MANAGE 4.3 is about communication of incidents to AI actors, with affected communities. These two outcomes include no report to an authority.
- No counterpart in NIST AI RMF 1.0: legal obligations, conformity assessment, CE marking, and penalties.
NIST AI RMF and the EU AI Act in Modulos
Modulos gives NIST AI RMF and the EU AI Act as different Frameworks at two levels:
| Level | NIST AI RMF | EU AI Act | Where to add it |
|---|---|---|---|
| Organization | OFF-3 | OFF-1 | The organization AI System. If your organization has no organization AI System, contact Modulos |
| AI System | MFF-3 | MFF-1 | Each AI System in scope |
The two NIST AI RMF Frameworks have Requirements in all four functions, and together they have all subcategories. The EU AI Act Frameworks hold Requirements for different roles and categories.
In Modulos, the NIST AI RMF and EU AI Act Frameworks share 54 Controls at AI System level. These are 89% of the Controls of MFF-3 and 47% of the Controls of MFF-1. At Organization level, they share 4 Controls, which are 21% of the Controls of OFF-3 and 22% of the Controls of OFF-1. A share describes the full Framework. It does not show what one operator owes. See Control overlap.
A completed Control does not make a Requirement Fulfilled. When all linked Controls have a final status, the Requirement Owner reviews the Requirement and marks it Fulfilled. This applies to the Requirements of each Framework. See Requirements.
To set up the two instruments in Modulos, do these steps:
- Identify your organization's operator role in the EU AI Act.
- Find the classification of each AI system in the EU AI Act.
- Add the Frameworks at the levels in the table.
- Complete the applicable Control work for each Requirement.
- Attach Evidence in the Controls.
For the Requirements and the sequence of work, see Operationalizing NIST AI RMF in Modulos and EU AI Act operationalizing in Modulos.
Where to go next
NIST AI RMF guide
GOVERN, MAP, MEASURE, MANAGE, Profiles, Generative AI Profile
EU AI Act guide
Prohibited practices, high-risk AI systems, conformity assessment, post-market monitoring
NIST Generative AI Profile (AI 600-1)
The 12 risks of generative AI in a NIST profile of AI RMF 1.0
ISO 42001 vs NIST AI RMF
A management system standard compared with NIST guidance for AI risk management
EU AI Act vs GDPR
The EU AI Act and the GDPR for AI systems and the processing of personal data
AI governance frameworks compared
The status and scope of each framework that these pages document
Frequently asked questions
Questions and answers about the frameworks that these pages compare
Sources of this page
- EU AI Act, Regulation (EU) 2024/1689 of 13 June 2024, OJ L, 12.7.2024 (EUR-Lex). Consolidated text of 27 July 2026 (EUR-Lex): Articles 2, 3, 5, 6, 9, 11 to 17, 25, 26, 43, 44, 50 to 56, and 70(1). Also Articles 72 to 75, 75c(4), 88(1), 99, 101, 111(3) and (4), and 113, and the text after Article 113.
- Regulation (EU) 2026/1744 of 8 July 2026, the Digital Omnibus on AI, OJ L, 24.7.2026 (EUR-Lex). Amendments to Articles 75, 99, and 113 of the EU AI Act.
- NIST AI 100-1, Artificial Intelligence Risk Management Framework (AI RMF 1.0), January 2023: Part 1 (Sections 1.2.3, 2, 3.4, and 3.5), Part 2 (Sections 5 and 6, Tables 1 to 4), and Appendices A and D.
- NIST AI 600-1, Generative Artificial Intelligence Profile, July 2024: Sections 1 and 2.
- NIST Trustworthy and Responsible AI Resource Center, AI RMF crosswalks page: the item "OECD/EU/EO13960".
Disclaimer
This page gives general information. It is not legal advice.