is a voluntary framework for managing AI risks across sectors. Its four functions are GOVERN, MAP, MEASURE and MANAGE. Use them to organise responsibilities, context, testing and risk decisions, then check each AI Act requirement separately. The functions are iterative rather than a mandatory checklist. Record the version used because NIST states that 1.0 is being revised.
Side-by-side comparison
EU AI Act and NIST AI RMF compared
Compare legal duties with voluntary risk-management work, then decide which evidence can be reused.
Primary legal source for AI Act structure, operator duties, risk categories, and conformity requirements.
GOVERN sets responsibilities across the work; MAP identifies context and risks; MEASURE assesses and monitors them; MANAGE prioritises and acts. The functions are iterative.
High-risk requirements include risk and data management, logs, technical documentation, user information, oversight, accuracy, robustness, cybersecurity, monitoring and incidents.
Depending on the system and role, requires technical files, conformity assessment, registration, declarations, CE marking, monitoring records and reports for authorities.
System treatment includes prohibited, high-risk, transparency and minimal/no-risk uses. Transparency can overlap high-risk duties. GPAI models and models with systemic risk have separate rules.
National competent authorities, market-surveillance bodies, the AI Office and Commission enforce relevant duties, including Commission supervision of GPAI.
GPAI providers need technical documentation, integration information, copyright policies and public training summaries, plus systemic-risk duties where applicable.
Primary legal source for AI Act structure, operator duties, risk categories, and conformity requirements.
NIST AI RMF
GOVERN sets responsibilities across the work; MAP identifies context and risks; MEASURE assesses and monitors them; MANAGE prioritises and acts. The functions are iterative.
NIST states that Playbook suggestions are voluntary and users may select the suggestions relevant to their context.
Core work
EU AI Act
High-risk requirements include risk and data management, logs, technical documentation, user information, oversight, accuracy, robustness, cybersecurity, monitoring and incidents.
Primary legal source for high-risk requirements, technical documentation, logging, oversight, and monitoring provisions.
technical documentation
Evidence
EU AI Act
Depending on the system and role, requires technical files, conformity assessment, registration, declarations, CE marking, monitoring records and reports for authorities.
Commission source for voluntary standards and legal certainty from harmonised standards, clarifying that not every framework has conformity effect.
provide legal certainty
Risk classification
EU AI Act
System treatment includes prohibited, high-risk, transparency and minimal/no-risk uses. Transparency can overlap high-risk duties. GPAI models and models with systemic risk have separate rules.
Primary legal source for high-risk classification and related annex structure.
Classification of AI systems as high-risk
Enforcement
EU AI Act
National competent authorities, market-surveillance bodies, the AI Office and Commission enforce relevant duties, including Commission supervision of GPAI.
JRC source for presumption of conformity from European harmonised standards published in the Official Journal.
presumption of conformity
Model-provider duties
EU AI Act
GPAI providers need technical documentation, integration information, copyright policies and public training summaries, plus systemic-risk duties where applicable.
Commission source for why voluntary frameworks must be distinguished from harmonised standards and legal AI Act compliance.
presumed to be compliant
1
Section 1
Check the law first
The AI Act is binding EU law. It sets scope, roles, prohibited practices, high-risk requirements, transparency duties and separate rules for GPAI models.
helps organisations account for trustworthiness in AI design, development, use and evaluation. Adoption is voluntary. It supports governance and risk reviews but does not decide EU market access or legal applicability.
Record the RMF version, mapping date and any profile or Playbook material used. NIST states that version 1.0 is being revised. A requirement map also needs the applicable AI Act text and date.
Regulation (EU) 2026/1744 was published on 24 July and entered into force on 27 July 2026. General application remains 2 August 2026. Chapter III Sections 1-3, except Article 6(5), apply from 2 December 2027 for Annex III high-risk systems and 2 August 2028 for Article 6(1) product-linked systems.
Use the AI Act to decide whether the product, model, role, market activity, or output is legally in scope.
Use to structure governance, context mapping, measurement, risk treatment, monitoring, and reassessment records.
Do not mark an AI Act requirement complete only because an RMF control exists; tie completion to the specific AI Act article, annex, or official guidance source.
Primary NIST source for the GOVERN, MAP, MEASURE, and MANAGE functions and the statement that Core actions are not a checklist or necessarily ordered steps.
Commission implementation page confirming that the final AI Omnibus enters into force in July 2026 and reporting the revised high-risk application dates.
Binding amendment supporting the 27 July 2026 entry into force and the revised Chapter III application dates.
2
Section 2
Classify the system and your role
Identify whether you are a provider, deployer, importer, distributor, authorised representative, product manufacturer or GPAI provider. Check whether modifying a system or model changes that role. Then assess prohibitions, high-risk status and transparency duties; check GPAI model duties separately.
RMF records can document context, intended use, affected people, risks, measurements and treatment decisions. Link them to specific duties, such as technical documentation, provider instructions, deployer oversight, a required fundamental rights impact assessment (FRIA), model documentation or user notices.
High-risk status depends on Article 6, Annex I or III, intended purpose and applicable exceptions. RMF severity, likelihood and acceptable-risk decisions cannot replace that legal test.
Keep an AI Act role/risk register separate from the RMF risk register, even if both link to the same product inventory.
For high-risk systems, connect RMF evaluation and monitoring evidence to AI Act requirements such as risk management, data governance, logging, documentation, human oversight, accuracy, robustness, and cybersecurity.
For GPAI, separate model-provider documentation, downstream information, copyright policy, training-content summary, systemic-risk assessment, and serious-incident handling from generic model-risk notes.
Commission guidelines on the scope of GPAI model obligations, provider status, systemic risk, documentation, and enforcement under Chapter V.
Chapter V of the AI Act
3
Section 3
Reuse evidence where it answers the requirement
Keep a record of each legal item needed: technical documentation, declaration, CE marking where applicable, registration, required FRIA, GPAI documentation, integration information, training summary, notices, monitoring and incident reports.
RMF work can explain methods, assumptions, measurements, residual risk, owners and review triggers. It creates no presumption of conformity, the legal assumption of compliance available for covered requirements under relevant harmonised standards or common specifications in Articles 40 and 41.
Choose companion resources deliberately. The Core defines functions, categories and subcategories. The Playbook suggests optional actions. Profiles adapt outcomes to a sector, technology or use. Name the resource and version behind each record.
Operational example: link an RMF evaluation report to the legal requirement, then record the system version, use, test conditions, result, limitations and approver. Keep declarations, registration or disclosures open until their own evidence exists.
EN 18286:2026 was cited on 14 October 2026 by Decision (EU) 2026/2274. Its conformity effect is limited to covered provider quality-management requirements. Check Annex ZA and implementation evidence separately; an RMF assessment alone cannot establish conformity with that standard.
Label each evidence item with its AI Act duty and its RMF function, such as Govern, Map, Measure, or Manage.
Use RMF outputs to explain why controls were chosen, how risks were measured, and how monitoring will continue.
Check the AI Act for required market-access steps, conformity assessment, disclosures, registration and records for authorities.
Article 1 and the Annex cite EN 18286:2026. Article 2 and recital 6 establish effect from publication on 14 October 2026, limited to requirements covered by the standard.
Next step
Check what your RMF records cover
Sorena can help link RMF records to AI Act duties and identify remaining classification, conformity or disclosure work.
Commission overview for risk tiers, high-risk obligations, transparency risk, conformity steps, and GPAI rules.
Commission implementation page confirming that the final AI Omnibus enters into force in July 2026 and reporting the revised high-risk application dates.
Commission page summarising the AI Act risk-based approach, high-risk obligations, transparency risk, conformity steps, and GPAI rules.
Show 4 more
Commission source for the AI Act risk-based approach and categories of risk.
Commission source listing strict obligations for high-risk AI systems.
Commission source for high-risk conformity workflow, EU database registration, declaration of conformity, CE marking, and post-market monitoring.
Commission source for unacceptable, high, transparency, and minimal risk categories.
"risk-based rules for AI developers and deployers"
Primary NIST source for the four Core functions, their iterative use, and the warning that Core actions are not a checklist or mandatory sequence.
Primary NIST source for the GOVERN, MAP, MEASURE, and MANAGE functions and the statement that Core actions are not a checklist or necessarily ordered steps.
Primary NIST source for the Core's functions, categories, subcategories, iterative use, and non-checklist status.
Show 3 more
Primary NIST source for the four functions, their purposes, iterative use, and non-checklist status.
Primary NIST source for the four functions and their lifecycle use.
Primary NIST source for the four functions and their non-checklist, iterative use.
Article 1 and the Annex cite EN 18286:2026. Article 2 and recital 6 establish effect from publication on 14 October 2026, limited to requirements covered by the standard.