NIST AI RMF vs the EU AI Act: A Practical Crosswalk

What Each One Is

A voluntary framework and a binding law, designed for different purposes:

• The NIST AI RMF (AI 100-1, released January 2023) is a voluntary framework from the US National Institute of Standards and Technology. It helps organizations manage AI risk through four functions and is designed to be flexible, sector-agnostic, and non-prescriptive. There is no certification and no legal obligation to use it.
• The EU AI Act (Regulation (EU) 2024/1689) is directly applicable EU law. It sorts AI systems into risk tiers and imposes concrete, enforceable obligations on providers and deployers, backed by fines.
• The NIST RMF tells you how to organize risk management; the EU AI Act tells you what you must do and prove for specific systems.

Voluntary Framework vs Binding Law: The Four Functions

The RMF's four functions form a continuous cycle. Understanding each is the key to the crosswalk:

• GOVERN — cross-cutting culture, policies, roles, and accountability for AI risk. It underpins the other three functions.
• MAP — establish context and categorize the AI system: its purpose, its setting, and the risks that arise from it.
• MEASURE — analyze, assess, benchmark, and monitor AI risks using quantitative and qualitative methods.
• MANAGE — prioritize and act on risks: allocate resources, respond, recover, and document decisions over the system's life.

Crosswalk: NIST Functions to EU AI Act Obligations

Where each NIST function does the work the EU AI Act requires. Use this to reuse existing RMF evidence against EU article-level duties:

• GOVERN → Article 17 (quality management system) and organizational accountability — the governance layer that the EU AI Act expects to sit behind every high-risk system.
• MAP → Article 9 (risk identification and intended purpose) and Article 13 (transparency about intended use, capabilities, and limitations to deployers).
• MEASURE → Article 9 (risk analysis and evaluation) and Article 15 (accuracy, robustness, and cybersecurity testing and metrics).
• MANAGE → Article 9 (risk treatment and mitigation), Article 12 (record-keeping / logging of operation), and Article 14 (human oversight and intervention).
• Documentation across all four functions → Article 11 and Annex IV (technical documentation) — the RMF's emphasis on documenting decisions maps onto the Act's documentation duties.

This is a directional crosswalk to guide gap analysis, not an official equivalence table. NIST publishes its own crosswalks between the AI RMF and other frameworks; treat this mapping as a starting point, then confirm each EU article's specific evidence for each in-scope system.

Where NIST RMF Stops and EU Law Begins

The RMF supports EU AI Act work but never discharges it. Keep these boundaries clear:

• No legal effect. The RMF is voluntary US guidance; it creates no rights or obligations under EU law and cannot be cited as compliance.
• No conformity route. Following the RMF does not produce CE marking, conformity assessment, EU-database registration, or an EU authorized representative — all of which the EU AI Act requires for high-risk systems.
• System-specific evidence still needed. The RMF is deliberately flexible; the EU AI Act is prescriptive. You still have to produce article-level evidence (Articles 9–15) for each specific high-risk system, not a general risk posture.
• Presumption of conformity comes from EU standards. Only harmonized European standards — not the NIST RMF — can grant a presumption of conformity under the Act.