Comparisons anchored on the EU AI Act, Regulation (EU) 2024/1689 as amended in 2026: against the NIST AI RMF, the GDPR and the Cyber Resilience Act.
Binding EU law versus a voluntary US framework: the AI Act classifies AI by risk and puts conformity assessment, quality management and fines on providers and deployers, while the AI RMF offers functions, categories and profiles with no certification. Covers application dates after the 2026 amendment, harmonized standards, cost estimates, and how a company selling into the EU should sequence the two.
For organizations deploying AI on personal data in the EU: the AI Act regulates AI systems by risk, the GDPR regulates the personal data they use. Covers where the Act points back to the GDPR (data protection impact assessments, fundamental rights impact assessments, bias-detection data, emotion recognition), automated decision fines, who enforces each, and how to run one assessment process for both.
For makers of AI-enabled software and devices: when a high-risk AI system is also a product with digital elements, meeting the CRA essential requirements can satisfy AI Act Article 15 cybersecurity. Covers CRA Article 12 and AI Act Article 42(3), which conformity procedure applies, who supervises the product, sandboxes, and the timelines of each regulation.
For AI providers and deployers that process personal data: how the three EU AI Act fine tiers in Article 99, the separate Commission fines for general-purpose AI model providers and the SME rule compare with the two GDPR tiers, and which obligations sit in which tier, so teams can rank compliance work by exposure.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.