NIST AI RMF to EU AI Act: Side-by-Side Compliance Mapping

Updated 2 October 2026 — correction. This guide used draft-era article numbers (61, 72, 49, 51, 29 and 26 for the wrong duties), counted 85 articles and 23 NIST categories, gave most NIST subcategories the wrong number or wording, and carried overlap percentages, effort hours and an audit price with no source. It now uses the adopted numbering of Regulation (EU) 2024/1689 (113 articles; post-market monitoring Article 72, serious incidents Article 73, CE marking Article 48, registration Article 49, deployers Article 26, authorised representatives Article 22) and the subcategories of NIST AI 100-1 (19 categories), and the unsourced figures are removed.

Updated 4 August 2026 — deadlines changed. The EU AI Act applies in phases, and the Digital Omnibus (adopted 16 and 29 June 2026) moved two of them. GPAI obligations have applied since 2 August 2025; Article 50 transparency since 2 August 2026 (not deferred); Annex III high-risk obligations from 2 December 2027; Annex I from 2 August 2028. This article has been corrected accordingly.

If you're building AI systems for global markets, you're facing two major frameworks: NIST AI RMF (voluntary in the US) and the EU AI Act (mandatory in the EU, applying in phases through 2028). The good news: they overlap significantly. The bad news: overlap is not equivalence. You cannot assume NIST compliance automatically satisfies EU AI Act obligations.

This guide provides a side-by-side mapping of NIST AI RMF functions to EU AI Act articles, identifies where NIST outcomes support EU requirements, and flags gaps you must close before each phase applies. The statutory maximums are €35M or 7% for the Article 5 prohibited practices, and €15M or 3% for the operator obligations most companies live under — with SMEs capped at whichever figure is lower. Getting the mapping right is not optional.

Framework Overview: NIST AI RMF vs. EU AI Act

Dimension	NIST AI RMF	EU AI Act
Legal status	Voluntary (US)	Mandatory (EU); legally binding regulation
Scope	All AI systems (risk-based guidance)	Prohibited practices (Article 5) + high-risk AI (Article 6: Annex I and Annex III) + transparency duties (Article 50) + general-purpose AI models (Chapter V)
Structure	4 functions (Govern, Map, Measure, Manage) + 19 categories + 72 subcategories	113 articles + 13 annexes (technical requirements, conformity)
Enforcement	None (voluntary); can be required by contract	EU member state authorities; €35M/7% (Art. 5 prohibitions), €15M/3% (operator obligations), €7.5M/1% (misleading information)
Focus	Risk management process	Legal compliance (documentation, conformity, market surveillance)
Timeline	Published Jan 2023; ongoing updates	Phased: prohibitions Feb 2025; GPAI Aug 2025; Art. 50 transparency Aug 2026; Annex III high-risk Dec 2027; Annex I Aug 2028

Key insight: NIST AI RMF is a process framework (how to manage AI risk). EU AI Act is a compliance framework (what you must document and prove). NIST helps you build good practices; EU AI Act tells you what's legally required.

High-Level Mapping: NIST Functions to EU AI Act Chapters

NIST AI RMF Function	Primary EU AI Act Mapping
Govern	Chapter III, Section 2 (Articles 8–15: requirements for high-risk AI systems, including risk management, transparency, oversight) and the provider's quality management system (Article 17)
Map	Article 9 (risk management), Article 10 (data governance), Annex IV (technical documentation)
Measure	Article 9 (risk management), Article 15 (accuracy, robustness, cybersecurity), Article 10 (data quality)
Manage	Article 9 (risk management), Article 72 (post-market monitoring), Article 73 (serious incident reporting)

Critical gap: NIST AI RMF does not address conformity assessment (Article 43), the EU declaration of conformity (Article 47), CE marking (Article 48), or registration (Article 49) in the EU database (Article 71). These are EU-specific legal obligations with no NIST equivalent.

Detailed Mapping: NIST Subcategories to EU AI Act Articles

NIST Govern Function → EU AI Act Governance Requirements

NIST Subcategory	EU AI Act Article	Overlap	Gap
GOVERN 1.4: Risk management process established through transparent policies	Article 9 (risk management system)	High	NIST is voluntary; EU requires a risk management system established, implemented, documented and maintained for each high-risk system (Article 9(1))
GOVERN 2.1: Roles and responsibilities	Article 16 (provider obligations), Article 22 (authorised representatives of non-EU providers)	Medium	EU requires legal accountability (named natural/legal persons); NIST is role-based
GOVERN 1.3: Level of risk management based on risk tolerance	Article 9(5) (residual risk judged acceptable), Article 9(8) (testing against prior defined metrics and probabilistic thresholds)	Medium	EU sets the test for high-risk AI; NIST leaves the tolerance to the organisation
GOVERN 2.3: Executive leadership takes responsibility	Article 16 (provider obligations), Article 26 (deployer obligations)	Medium	EU assigns legal liability; NIST assigns process ownership
GOVERN 1.1: Legal and regulatory requirements	Chapter III (Articles 6–49, high-risk AI systems)	Low	NIST references compliance generally; EU specifies exact requirements
GOVERN 4.1: Organizational culture (critical thinking and safety-first mindset)	No direct mapping	None	EU does not regulate culture; focuses on documented processes

Key takeaway: NIST Govern establishes process governance. EU AI Act requires legal accountability with named responsible parties, documented policies, and conformity evidence. If you've implemented NIST Govern, you have a foundation — but you must add legal accountability, documentation, and conformity procedures to satisfy the EU AI Act.

NIST Map Function → EU AI Act Risk & Data Requirements

NIST Subcategory	EU AI Act Article	Overlap	Gap
MAP 1.1: Context of use	Article 9(2)(a)–(b) (intended purpose, reasonably foreseeable misuse)	High	EU requires documented intended purpose in technical documentation (Annex IV)
MAP 3.3: Application scope based on system categorisation	Article 6 with Annex I and Annex III (classification)	Medium	NIST leaves categorisation to the organisation; EU classifies by law: high-risk or not (Article 6), prohibited practices (Article 5), transparency duties (Article 50)
MAP 5.1: Likelihood and magnitude of impacts	Article 27 (fundamental rights impact assessment for high-risk AI)	Medium	EU requires a fundamental rights impact assessment from certain deployers (public bodies, private entities providing public services, and deployers of credit-scoring and life and health insurance systems); NIST is general
MAP 2.3: Data representativeness and suitability (TEVV considerations)	Article 10 (data governance: relevance, representativeness, bias)	High	Strong overlap; EU adds legal requirements (documented bias examination, data origin)
MAP 4.1: Third-party data and legal risks of components	Article 10(2)(b) (data collection processes and origin of data)	High	EU requires documented data sources in technical documentation (Annex IV.2(d))
MAP 2.2: Knowledge limits and human oversight of outputs	Article 13 (transparency: capabilities, limitations, accuracy)	High	EU requires disclosure in instructions for use; NIST is internal assessment

Key takeaway: NIST Map helps you understand your AI system. EU AI Act requires you to document and disclose that understanding in technical documentation (Annex IV) and instructions for use (Article 13). If you've completed NIST Map, you have the content — but you must format it for EU compliance.

NIST Measure Function → EU AI Act Testing & Validation

NIST Subcategory	EU AI Act Article	Overlap	Gap
MEASURE 1.1: Approaches and metrics for measurement	Article 9(6)–(8) (testing procedures), Article 15 (accuracy, robustness)	High	EU requires documented validation in technical documentation (Annex IV.2(g))
MEASURE 2.1: Test sets, metrics and tools documented	Article 10(3) (training, validation and testing data quality)	High	EU applies the same quality criteria to testing data as to training data, and requires the validation and testing data to be described (Annex IV.2(g))
MEASURE 2.3: Performance criteria measured for deployment conditions	Article 15 (appropriate accuracy metrics), Article 13 (disclosure of accuracy)	High	EU requires the levels of accuracy and the accuracy metrics to be declared in the instructions for use (Article 15(3))
MEASURE 2.11: Fairness and bias evaluated	Article 10(2)(f)–(g) (bias examination, detection and mitigation)	High	EU requires documented bias examination in technical documentation
MEASURE 2.11: Fairness metrics	Article 10(2)(f)–(g) (bias), Article 15(4) (biased feedback loops in systems that keep learning)	Medium	EU does not specify fairness metrics; requires bias mitigation evidence
MEASURE 3.1: Tracking risks from performance in deployment	Article 72 (post-market monitoring), Article 73 (serious incident reporting)	Medium	EU requires ongoing monitoring plan and incident reporting to authorities
MEASURE 2.5–2.7: Safety, robustness, security and resilience evaluated	Article 15 (robustness, cybersecurity)	High	EU requires documented robustness testing in technical documentation

Key takeaway: NIST Measure provides testing methodology. EU AI Act requires documented test results in technical documentation (Annex IV) and ongoing monitoring (Article 72). If you've implemented NIST Measure, you have the tests — but you must document results and establish post-market monitoring.

NIST Manage Function → EU AI Act Lifecycle Management

NIST Subcategory	EU AI Act Article	Overlap	Gap
MANAGE 1.3: Risk response	Article 9(2)(d) (risk management measures), Article 9(5) (residual risk)	High	EU requires the risk management system to be described in technical documentation (Annex IV.5)
MANAGE 1.2: Prioritised treatment of documented risks	Article 9(2) (continuous iterative process with regular systematic review and updating)	Medium	EU requires the risk management system to be documented and maintained (Article 9(1))
MANAGE 4.3: Incidents communicated and tracked	Article 20 (corrective actions, withdrawal, recall), Article 73 (serious incident reporting)	Medium	EU requires notification to authorities within specific timelines
MANAGE 4.1: Change management	Article 43(4) (substantial modification triggers new conformity assessment)	Low	EU defines "substantial modification" legally (Article 3(23)); NIST is process-based
MANAGE 4.1: Post-deployment monitoring plan	Article 72 (post-market monitoring plan)	High	EU requires the plan to be part of the technical documentation (Article 72(3))
MANAGE 4.2: Continual improvement	Article 9(2) (regular systematic review and updating throughout the lifecycle)	Medium	EU requires documented update procedures and version control

Key takeaway: NIST Manage establishes continuous improvement processes. EU AI Act requires documented lifecycle management with legal triggers (substantial modification, incident reporting, corrective actions). If you've implemented NIST Manage, you have the process — but you must add legal triggers and authority notification procedures.

Critical Gaps: What NIST AI RMF Does NOT Cover

Even if you've fully implemented NIST AI RMF, you still have EU AI Act gaps:

EU AI Act Requirement	NIST AI RMF Coverage	What You Must Add
Article 11: Technical documentation (Annex IV)	Partial (content exists, format does not)	Compile NIST outputs into the nine points of Annex IV
Article 13: Instructions for use	Partial (MAP 2.2 documents knowledge limits; no instructions-for-use format)	Write user manual with accuracy, limitations, oversight procedures
Article 14: Human oversight controls	Partial (GOVERN 3.2, MAP 3.5 and MANAGE 2.4 cover oversight roles and deactivation)	Implement override controls, stop buttons, audit logging
Article 43: Conformity assessment	None	Engage notified body or self-assess (depending on Annex III category)
Article 48: CE marking	None	Affix CE mark after conformity assessment
Article 49: Registration in EU database (Article 71)	None	Register high-risk AI system in EU database before market placement
Article 72: Post-market monitoring plan	Partial (MEASURE/MANAGE cover monitoring)	Document the plan as part of the technical documentation (Article 72(3))
Article 73: Serious incident reporting	Partial (MANAGE covers incidents)	Report serious incidents to the market surveillance authority within the Article 73 limits: 15 days at the latest, 10 days in the event of a death, 2 days for a widespread infringement or a serious and irreversible disruption of critical infrastructure

Bottom line: NIST AI RMF gives you the substance of compliance (risk management, testing, monitoring). EU AI Act adds legal formalities (documentation format, conformity assessment, registration, CE marking). You cannot skip the formalities.

Worked Example: Mapping NIST to EU AI Act for a Recruitment AI

System: AI-powered CV screening tool (high-risk under Annex III.4(a), from 2 December 2027)

NIST AI RMF implementation (existing):

• Govern: AI risk policy, roles (AI product owner, data scientist, HR lead), risk tolerance defined
• Map: Intended purpose documented, high-risk classification confirmed, bias impact assessment completed, training data sources logged
• Measure: Validation on a held-out set of CVs with accuracy measured and documented, bias audit on gender/age, a stated fairness metric with its threshold
• Manage: Monthly performance monitoring, incident response plan, quarterly model retraining

EU AI Act gaps identified:

1. Article 11 (technical documentation): NIST outputs exist but not in Annex IV format.
   Action: Compile into an Annex IV document covering its nine points.

2. Article 13 (instructions for use): No user manual.
   Action: Write a user manual covering accuracy, limitations, oversight procedures, input requirements.

3. Article 14 (human oversight): Informal review process exists; no documented controls.
   Action: Implement override buttons in UI, add audit logging, write oversight protocol.

4. Article 43 (conformity assessment): Not started.
   Action: Self-assessment (Annex VI internal control), draft EU declaration of conformity (Article 47).

5. Article 48 (CE marking): Not applicable until conformity assessment complete.
   Action: Affix a digital CE marking accessible from the system's interface, or on the documentation (Article 48), after conformity.

6. Article 49 (EU database registration): Not started.
   Action: Register the provider and the system in the EU database (Article 71) with the information listed in Annex VIII, Section A.

7. Article 72 (post-market monitoring plan): Monitoring exists; plan not documented in EU format.
   Action: Write a post-market monitoring plan and keep it as part of the technical documentation.

8. Article 73 (serious incident reporting): Incident response plan exists; no authority notification procedure.
   Action: Add the Article 73 reporting procedure and time limits to the incident response plan, and identify the market surveillance authority of each Member State where an incident may occur (Article 73(1)).

Effort and cost: Depend on the system and the team; this guide gives no estimate, because none would have a source.

---

This article is for informational purposes only and does not constitute legal advice. Consult a qualified EU AI Act attorney for binding guidance on your specific system.