Governance crosswalk • 2026
NIST AI RMF vs EU AI Act: align the controls, not the legal effect.
NIST AI RMF is a voluntary, risk-management framework. The EU AI Act is binding law within its scope. A strong governance program can reuse NIST processes and evidence, but it still needs an explicit EU AI Act legal mapping.
Updated and legally reviewed: 26 September 2026.
Different instruments
The frameworks solve different problems.
NIST AI RMF
A voluntary, rights-preserving, non-sector-specific and use-case-agnostic risk-management framework. Its core functions are GOVERN, MAP, MEASURE and MANAGE.
EU AI Act
Binding EU regulation with territorial scope, defined actor roles, prohibited practices, transparency duties, GPAI rules, high-risk classification and enforcement consequences.
2026 NIST status
AI RMF 1.0 remains current — and NIST is revising it.
NIST states that AI RMF 1.0, released in January 2023, is being revised in 2026. NIST also maintains the Generative AI Profile (NIST AI 600-1) and is developing additional profiles, including work on critical infrastructure. Organisations should therefore version their crosswalks rather than treating NIST material as static.
Practical crosswalk
Where NIST evidence can support EU AI Act implementation
GOVERN → accountability
Policies, roles, risk appetite, oversight, training and governance records can support AI Act organisational-control requirements and evidence architecture.
MAP → system/context understanding
Intended purpose, users, affected persons, system context and impact mapping can feed EU AI Act scope, role and classification decisions.
MEASURE → evaluation/testing
Performance, bias, robustness and risk-measurement practices can support system-level testing and monitoring, but legal requirements must be checked separately.
MANAGE → controls & treatment
Risk treatment, prioritisation, incident response and monitoring processes can support operational compliance controls and remediation planning.
Where the crosswalk stops
NIST AI RMF cannot answer EU AI Act legal questions by itself.
- It does not determine Article 2 territorial scope.
- It does not assign provider, deployer, importer or distributor roles.
- It does not determine whether a practice is prohibited under Article 5.
- It does not decide Article 6/Annex III high-risk status.
- It does not itself satisfy Article 50 transparency duties.
- It does not replace GPAI-provider obligations or EU representative requirements.
- It does not create a presumption of conformity with the EU AI Act.
Recommended model
Use a legal overlay on top of a reusable governance system.
Keep NIST-style governance processes where they work, but maintain a separate EU AI Act obligation register mapping each legal requirement to the actual control, owner, evidence and effective date.
Primary sources