Skip to content

AI Act vs NIST AI RMF: what they share and how they differ

AI Act and NIST AI RMF share 14 of 24 control themes and 9 checks. 22% of NIST AI RMF requirements can be proven with checks AI Act already uses, 15% the other way round.

EURegulationPhasing in

AI Act

How to make an AI system compliant with the EU AI Act

33 requirementsNext Aug 2, 2027

USVoluntary frameworkVoluntary

NIST AI RMF

How to apply the NIST AI RMF to your AI systems

72 requirementsNext Dec 2026

14/24shared control themes

9shared checks

22%of NIST AI RMF requirements covered by AI Act evidence

15%of AI Act requirements covered by NIST AI RMF evidence

At a glance

	AI Act	NIST AI RMF
Jurisdiction	European Union	United States (federal)
Kind	Regulation	Voluntary framework
Status	Phasing in	Voluntary
Binding	Yes	No
Object analysed	AI system same	AI system same
Scope	Providers, deployers, importers and distributors of AI systems; providers of GPAI models.	Any organisation designing, deploying or using AI.
Territorial reach	Extraterritorial: applies when the system is placed on the EU market or its output is used in the EU.	No territorial scope; de facto reference for US public buyers.
Penalties	Up to €35M or 7% of worldwide turnover (prohibited practices); €15M or 3% (other obligations); €7.5M or 1% (incorrect information).	None (voluntary). Leverage: safe harbour in state laws.
Qualification axes	AI Act risk level, Organisation role, General-purpose model	Internal risk tier (organisation-defined)
Roles	Provider, Deployer, GPAI provider	AI actor
Requirements	33	72
Next milestone	Aug 2, 2027, Annex I high risk (regulated products); GPAI placed on the market before Aug 2025	Dec 2026, Expected RMF revision

Theme by theme

requirements per theme

What they share: one piece of evidence, two frameworks

9

Code	Check	Requirements AI Act	Requirements NIST AI RMF
VER-003-01	Documented and up-to-date risk register	EX-003	MEASURE-3.1 MEASURE-3.2
VER-008-01	Documented escalation and emergency stop procedure	EX-008	GOVERN-3.2 MAP-3.5
VER-008-02	System designed to allow human oversight (stop button, override)	EX-008	MANAGE-2.4
VER-008-03	Competent overseers assigned to the system	EX-008	GOVERN-3.2 MAP-3.5
VER-AUTO-05	Accuracy monitoring in operation	EX-009	MEASURE-4.3
VER-009-02	Accuracy and robustness verified and documented	EX-009	MEASURE-2.3 MEASURE-2.5
VER-021-F-01	Operational monitoring plan	EX-021	MEASURE-2.4 MANAGE-2.2 MANAGE-4.1
VER-022-F-01	Risk and incident response procedure	EX-022	GOVERN-1.5 GOVERN-4.3 GOVERN-6.2 MANAGE-2.3 MANAGE-4.1 MANAGE-4.3
VER-022-D-01	Serious incident reporting procedure	EX-022	GOVERN-1.5 GOVERN-4.3 GOVERN-6.2 MANAGE-2.3 MANAGE-4.1 MANAGE-4.3

Differences: requirements specific to each framework

Requirements with no check serving the other framework: the extra work.

AI Act

28

EX-001

AI literacy Art. 4

EX-002

Prohibited practices Art. 5

EX-004

Data and data governance Art. 10

EX-005

Technical documentation Art. 11 + Annexe IV

EX-006

Record-keeping / logging Art. 12

EX-007

Transparency to deployers Art. 13

EX-010

QMS Art. 17

EX-011

10-year retention Art. 18

EX-012

Automatically generated logs Art. 19

EX-013

Corrective actions Art. 20

EX-014

Cooperation with authorities Art. 21 + Art. 26§12

EX-015

EU declaration of conformity Art. 47

EX-016

CE marking Art. 48

EX-017

EU database registration Art. 49

EX-018

Transparency for all systems Art. 50

EX-019

DPIA Art. 26§9

EX-020

FRIA Art. 27

EX-023

Accessibility Art. 16(l)

EX-024

Conformity assessment Art. 43

EX-025

Authorised representative outside the EU Art. 22

EX-026

Value chain Art. 25

EX-027

Compliant use Art. 26§1

EX-028

Input data Art. 26§4

EX-029

Information to affected persons Art. 26§11

EX-030

Information to workers' representatives Art. 26§7

EX-031

GPAI obligations Art. 53

EX-032

GPAI obligations with systemic risk Art. 55

EX-033

Right to explanation of individual decision-making Art. 86

NIST AI RMF

56

GOVERN-1.1

Legal and regulatory requirements involving AI are understood, managed, and documented. GOVERN

GOVERN-1.2

The characteristics of trustworthy AI are integrated into organizational policies, processes, procedures, and practices. GOVERN

GOVERN-1.3

Processes, procedures, and practices are in place to determine the needed level of risk management activities based on the organization's risk tolerance. GOVERN

GOVERN-1.4

The risk management process and its outcomes are established through transparent policies, procedures, and other controls based on organizational risk priorities. GOVERN

GOVERN-1.6

Mechanisms are in place to inventory AI systems and are resourced according to organizational risk priorities. GOVERN

GOVERN-1.7

Processes and procedures are in place for decommissioning and phasing out AI systems safely and in a manner that does not increase risks or decrease the organization's trustworthiness. GOVERN

GOVERN-2.1

Roles and responsibilities and lines of communication related to mapping, measuring, and managing AI risks are documented and are clear to individuals and teams throughout the organization. GOVERN

GOVERN-2.2

The organization's personnel and partners receive AI risk management training to enable them to perform their duties and responsibilities consistent with related policies, procedures, and agreements. GOVERN

GOVERN-2.3

Executive leadership of the organization takes responsibility for decisions about risks associated with AI system development and deployment. GOVERN

GOVERN-3.1

Decision-making related to mapping, measuring, and managing AI risks throughout the lifecycle is informed by a diverse team (e.g., diversity of demographics, disciplines, experience, expertise, and backgrounds). GOVERN

GOVERN-4.1

Organizational policies and practices are in place to foster a critical thinking and safety-first mindset in the design, development, deployment, and uses of AI systems to minimize potential negative impacts. GOVERN

GOVERN-4.2

Organizational teams document the risks and potential impacts of the AI technology they design, develop, deploy, evaluate, and use, and they communicate about the impacts more broadly. GOVERN

GOVERN-5.1

Organizational policies and practices are in place to collect, consider, prioritize, and integrate feedback from those external to the team that developed or deployed the AI system regarding the potential individual and societal impacts related to AI risks. GOVERN

GOVERN-5.2

Mechanisms are established to enable the team that developed or deployed AI systems to regularly incorporate adjudicated feedback from relevant AI actors into system design and implementation. GOVERN

GOVERN-6.1

Policies and procedures are in place that address AI risks associated with third-party entities, including risks of infringement of a third-party's intellectual property or other rights. GOVERN

MAP-1.1

Intended purposes, potentially beneficial uses, context-specific laws, norms and expectations, and prospective settings in which the AI system will be deployed are understood and documented. Considerations include: the specific set or types of users along with their expectations; potential positive and negative impacts of system uses to individuals, communities, organizations, society, and the planet; assumptions and related limitations about AI system purposes, uses, and risks across the development or product AI lifecycle; and related TEVV and system metrics. MAP

MAP-1.2

Interdisciplinary AI actors, competencies, skills, and capacities for establishing context reflect demographic diversity and broad domain and user experience expertise, and their participation is documented. Opportunities for interdisciplinary collaboration are prioritized. MAP

MAP-1.3

The organization's mission and relevant goals for AI technology are understood and documented. MAP

MAP-1.4

The business value or context of business use has been clearly defined or - in the case of assessing existing AI systems - re-evaluated. MAP

MAP-1.5

Organizational risk tolerances are determined and documented. MAP

MAP-1.6

System requirements (e.g., 'the system shall respect the privacy of its users') are elicited from and understood by relevant AI actors. Design decisions take socio-technical implications into account to address AI risks. MAP

MAP-2.1

The specific tasks and methods used to implement the tasks that the AI system will support are defined (e.g., classifiers, generative models, recommenders). MAP

MAP-2.2

Information about the AI system's knowledge limits and how system output may be utilized and overseen by humans is documented. Documentation provides sufficient information to assist relevant AI actors when making decisions and taking subsequent actions. MAP

MAP-2.3

Scientific integrity and TEVV considerations are identified and documented, including those related to experimental design, data collection and selection (e.g., availability, representativeness, suitability), system trustworthiness, and construct validation. MAP

MAP-3.1

Potential benefits of intended AI system functionality and performance are examined and documented. MAP

MAP-3.2

Potential costs, including non-monetary costs, which result from expected or realized AI errors or system functionality and trustworthiness - as connected to organizational risk tolerance - are examined and documented. MAP

MAP-3.3

Targeted application scope is specified and documented based on the system's capability, established context, and AI system categorization. MAP

MAP-3.4

Processes for operator and practitioner proficiency with AI system performance and trustworthiness - and relevant technical standards and certifications - are defined, assessed, and documented. MAP

MAP-4.1

Approaches for mapping AI technology and legal risks of its components - including the use of third-party data or software - are in place, followed, and documented, as are risks of infringement of a third party's intellectual property or other rights. MAP

MAP-4.2

Internal risk controls for components of the AI system, including third-party AI technologies, are identified and documented. MAP

MAP-5.1

Likelihood and magnitude of each identified impact (both potentially beneficial and harmful) based on expected use, past uses of AI systems in similar contexts, public incident reports, feedback from those external to the team that developed or deployed the AI system, or other data are identified and documented. MAP

MAP-5.2

Practices and personnel for supporting regular engagement with relevant AI actors and integrating feedback about positive, negative, and unanticipated impacts are in place and documented. MAP

MEASURE-1.1

Approaches and metrics for measurement of AI risks enumerated during the map function are selected for implementation starting with the most significant AI risks. The risks or trustworthiness characteristics that will not - or cannot - be measured are properly documented. MEASURE

MEASURE-1.2

Appropriateness of AI metrics and effectiveness of existing controls are regularly assessed and updated, including reports of errors and potential impacts on affected communities. MEASURE

MEASURE-1.3

Internal experts who did not serve as front-line developers for the system and/or independent assessors are involved in regular assessments and updates. Domain experts, users, AI actors external to the team that developed or deployed the AI system, and affected communities are consulted in support of assessments as necessary per organizational risk tolerance. MEASURE

MEASURE-2.1

Test sets, metrics, and details about the tools used during TEVV are documented. MEASURE

MEASURE-2.2

Evaluations involving human subjects meet applicable requirements (including human subject protection) and are representative of the relevant population. MEASURE

MEASURE-2.6

The AI system is evaluated regularly for safety risks - as identified in the map function. The AI system to be deployed is demonstrated to be safe, its residual negative risk does not exceed the risk tolerance, and it can fail safely, particularly if made to operate beyond its knowledge limits. Safety metrics reflect system reliability and robustness, real-time monitoring, and response times for AI system failures. MEASURE

MEASURE-2.7

AI system security and resilience - as identified in the map function - are evaluated and documented. MEASURE

MEASURE-2.8

Risks associated with transparency and accountability - as identified in the map function - are examined and documented. MEASURE

MEASURE-2.9

The AI model is explained, validated, and documented, and AI system output is interpreted within its context - as identified in the map function - to inform responsible use and governance. MEASURE

MEASURE-2.10

Privacy risk of the AI system - as identified in the map function - is examined and documented. MEASURE

MEASURE-2.11

Fairness and bias - as identified in the map function - are evaluated and results are documented. MEASURE

MEASURE-2.12

Environmental impact and sustainability of AI model training and management activities - as identified in the map function - are assessed and documented. MEASURE

MEASURE-2.13

Effectiveness of the employed TEVV metrics and processes in the measure function are evaluated and documented. MEASURE

MEASURE-3.3

Feedback processes for end users and impacted communities to report problems and appeal system outcomes are established and integrated into AI system evaluation metrics. MEASURE

MEASURE-4.1

Measurement approaches for identifying AI risks are connected to deployment context(s) and informed through consultation with domain experts and other end users. Approaches are documented. MEASURE

MEASURE-4.2

Measurement results regarding AI system trustworthiness in deployment context(s) and across the AI lifecycle are informed by input from domain experts and relevant AI actors to validate whether the system is performing consistently as intended. Results are documented. MEASURE

MANAGE-1.1

A determination is made as to whether the AI system achieves its intended purposes and stated objectives and whether its development or deployment should proceed. MANAGE

MANAGE-1.2

Treatment of documented AI risks is prioritized based on impact, likelihood, and available resources or methods. MANAGE

MANAGE-1.3

Responses to the AI risks deemed high priority, as identified by the map function, are developed, planned, and documented. Risk response options can include mitigating, transferring, avoiding, or accepting. MANAGE

MANAGE-1.4

Negative residual risks (defined as the sum of all unmitigated risks) to both downstream acquirers of AI systems and end users are documented. MANAGE

MANAGE-2.1

Resources required to manage AI risks are taken into account - along with viable non-AI alternative systems, approaches, or methods - to reduce the magnitude or likelihood of potential impacts. MANAGE

MANAGE-3.1

AI risks and benefits from third-party resources are regularly monitored, and risk controls are applied and documented. MANAGE

MANAGE-3.2

Pre-trained models which are used for development are monitored as part of AI system regular monitoring and maintenance. MANAGE

MANAGE-4.2

Measurable activities for continual improvements are integrated into AI system updates and include regular engagement with interested parties, including relevant AI actors. MANAGE

Timelines

PastSet in the textPotentialTo verify

Apr 21, 2021AI Act · Commission proposal

Jan 26, 2023NIST AI RMF · AI RMF 1.0

Jul 12, 2024AI Act · Published in the Official Journal

Jul 26, 2024NIST AI RMF · Generative AI Profile (NIST AI 600-1)

Aug 1, 2024AI Act · Entry into force

Feb 2, 2025AI Act · Prohibited practices (Art. 5) and AI literacy (Art. 4)

Jul 10, 2025AI Act · GPAI Code of Practice published

Jul 23, 2025NIST AI RMF · AI Action Plan asks for a revision of the framework

Aug 2, 2025AI Act · GPAI obligations, governance, penalties, notified bodies

Nov 19, 2025AI Act · Digital Omnibus proposal: high-risk delay tied to standards

Aug 2, 2026AI Act · General application: Art. 50, sandboxes, Annex III high risk (unless Omnibus delay)

Dec 2026NIST AI RMF · Expected RMF revision

Aug 2, 2027AI Act · Annex I high risk (regulated products); GPAI placed on the market before Aug 2025

Dec 2, 2027AI Act · Omnibus backstop for Annex III high risk

Aug 2, 2028AI Act · Omnibus backstop for Annex I high risk

Aug 2, 2030AI Act · High-risk systems of public authorities already in service (Art. 111)

Run these requirements across all your AI systems

TrustFlow inventories your systems, qualifies them under each regulation and collects evidence once for every referential.