EU AI Act (Regulation (EU) 2024/1689) EU AI Act and NIST AI RMF

NIST describes the AI RMF as a voluntary framework to help organizations designing, developing, deploying, or using AI systems manage risk and support trustworthy AI. The core uses four functions: Govern, Map, Measure, and Manage. That structure is useful because it gives product and risk teams a common language that is broader than model safety alone.

The playbook and related NIST resources are especially helpful when an organization needs a repeatable way to define purpose, identify context, measure risks, prioritize responses, and keep improving over time.

The AI Act adds legal routing. It asks whether the system is prohibited, high risk, transparency triggered, or connected to GPAI provider duties. It also assigns obligations to specific operator roles and attaches penalties to non compliance. NIST AI RMF does not make those legal classifications for you.

This is why a good AI RMF program can still miss core AI Act obligations if it never runs Article 5 screening, Annex III classification, Article 50 product disclosure analysis, or Chapter V model level documentation checks.

Use AI RMF as the operating logic for governance and risk management. Then insert AI Act checkpoints inside each function. Govern should include operator role ownership and AI literacy. Map should include EU scope, intended purpose, and affected persons. Measure should include Article 5 screening, Article 50 design review, and high risk testing evidence. Manage should include launch decisions, residual risk treatment, incident handling, and corrective action.

This combined model is also consistent with the ETSI material in the local source pack, which references the NIST AI RMF as part of a structured risk and governance approach for AI systems.

You can reuse a large share of your evidence. Risk registers, role assignments, impact review outputs, control test results, and monitoring reports all carry over. What you cannot reuse is the claim that a completed AI RMF cycle equals AI Act compliance.

Keep one evidence pack with a clear legal appendix. That appendix should show the AI Act classifications, article triggers, and any mandatory artifacts such as FRIA, Annex IV planning, Article 50 evidence, or Chapter V model outputs.