EU AI Act or NIST AI RMF: which to pursue first when selling AI into the EU
If your AI system is placed on the EU market, or its output is used in the EU, the EU AI Act is a legal obligation for any system that falls in scope. The NIST AI RMF is voluntary and produces no certificate, so pursue the Act first where it applies and use the RMF as the management structure that organizes the work. Start by classifying each system under Article 6. For most providers and deployers, only systems in the Annex III areas, such as credit scoring or insurance pricing, are high-risk. Under Regulation (EU) 2026/1744, the high-risk rules for Annex III systems apply from 2 December 2027, and those for Annex I product systems from 2 August 2028. Confirm these dates against the consolidated text of the AI Act before you set a plan.
Use the RMF's four functions to organize the Act's duties. Govern assigns ownership, risk tolerance and the provider or deployer roles the Act sets out. Map records intended purpose, context and the Article 6 classification. Measure covers the testing and validation evidence that feeds your technical documentation, and Manage covers post-market monitoring and serious incident handling. The RMF is not a checklist, so the crosswalk between the two is one you design and document yourself. For most Annex III systems, conformity assessment is internal control under Annex VI. Presumption of conformity depends on harmonised standards whose references are published in the Official Journal, so track which standards are cited. The first, EN 18286:2026 on quality management, was cited on 14 October 2026. Confirm which standards apply to your system and whether your notified body or assessor role is required.
The RMF alone is the right choice when no output of your system reaches the EU and no EU deployer or user depends on it, because Article 2 is what brings a non-EU provider into scope. Even then, confirm the boundary with counsel, since a US company whose AI output is used in the EU is covered. Expect the RMF to produce a self-assessment or an independent review you commission, not a certificate. If an EU customer asks for proof, your answer is documentation plus that review. Because NIST says AI RMF 1.0 is being revised and has not published the revision, version your mapping and record which edition you used. Doing both is the default for any company with EU revenue and US governance needs.
How the EU AI Act and NIST AI RMF differ on scope, duties and proof
This table compares the EU AI Act and the NIST AI RMF on legal status, reach, risk approach, dates, fines and the kind of proof each produces. Read it as a sequence check: the Act sets binding duties with fines, while the AI RMF gives a voluntary structure you can use to build the evidence the Act expects.
| Dimension | EU AI Act (Regulation (EU) 2024/1689) | NIST AI RMF 1.0 |
|---|---|---|
| Legal status | Binding EU regulation, in force since 1 August 2024 and amended by Regulation (EU) 2026/1744 | Voluntary US framework published as NIST AI 100-1 in January 2023 |
| Who it applies to | Providers placing AI systems or general-purpose models on the EU market, EU deployers, and non-EU providers or deployers whose output is used in the EU (Article 2) | Any organization that chooses to use it; NIST states neither private nor public organizations are required to use it |
| Risk approach | Four Commission risk levels: unacceptable, high, transparency, and minimal or no risk, which the Act does not regulate | Functions, categories and subcategories that users select or apply in full; NIST says the actions are not a checklist |
| Core structure | Chapters, articles and annexes, with duties for high-risk systems in Chapter III | 4 functions, 19 categories and 72 subcategories: Govern, Map, Measure and Manage |
| High-risk dates after the 2026 amendment | 2 December 2027 for Annex III systems; 2 August 2028 for Annex I product systems | Not applicable; no dates are set because the framework is not a legal obligation |
| Fines | Up to EUR 35 million or 7% of worldwide annual turnover for prohibited practices; EUR 15 million or 3% for most operator duties (Article 99) | None; NIST does not enforce the framework |
| Certification or proof | Conformity assessment and CE marking for high-risk systems; most Annex III systems use internal control, while some biometric and Annex I systems involve notified bodies | No certification, accredited assessor or conformity assessment program; NIST does not validate any organization's use |
| Cost of adoption | Compliance cost estimated in the impact assessment at EUR 6,000 to 7,000 per high-risk system by 2025 (Commission SWD(2021) 84) | No supplied source gives a cost; ask advisers to scope the work in writing |
Who must comply with the AI Act and who simply chooses the AI RMF
Start by testing whether the EU AI Act applies to you, because the answer is set by law and the AI RMF answer is a choice. Under Article 2, the Act reaches providers placing AI systems or general-purpose AI models on the EU market wherever they are established, deployers established in the EU, and non-EU providers and deployers whose AI output is used in the EU. A US company with no EU office can therefore be in scope if its model output is used by customers in the EU. Next, check whether any system is high-risk. Under Article 6(2), an AI system is high-risk if it falls in one of the eight Annex III areas, including biometrics, critical infrastructure, education, employment, credit scoring and insurance pricing, law enforcement, migration, and justice. Confirm the exact Annex III wording against the consolidated text, since a use case that looks adjacent to a listed area may or may not fall inside it.
The Act then splits duties by role. Providers carry the heavy design and market-entry work for high-risk systems: Section 2 compliance, quality management, conformity assessment, the declaration, CE marking, registration, post-market monitoring and serious incident reporting. Deployers have their own obligations, so a company that buys a high-risk system and puts it into service in the EU must map its duties separately. Many companies will hold both roles for different products. Record the role for each AI system in your inventory, because the same product can change role when you fine-tune it, rebrand it or change its intended purpose. The 2026 amendment moved the Annex III high-risk rules to 2 December 2027, so the date you plan against depends on the classification you reach.
The NIST AI RMF sits at the other end of this comparison. NIST's FAQ says neither private nor public sector organizations are required to use the framework, and NIST's use cases page states that it does not validate or endorse any individual organization's use of the AI RMF. A company that adopts the AI RMF can therefore choose its own scope, categories and documentation, but it cannot certify against it or treat it as a legal safe harbor. Before deciding that a voluntary framework is enough, have counsel confirm your Article 2 reach and your Annex III status in writing. If either answer is yes, the AI RMF can support the risk work the Act requires, but it does not replace the Act's conformity process.
Where the AI RMF work maps onto AI Act obligations
The AI RMF and the AI Act both expect risk identification, governance, documentation and monitoring, but they are built differently. No official mapping from AI RMF subcategories to AI Act articles is supplied, so each overlap below is a starting point for your own review with counsel or the standard owner, not a confirmed equivalence.
Governance as a cross-cutting layer
AI 100-1 treats Govern as a cross-cutting function that supports the other three functions, rather than a single step. For the AI Act, the closest parallel is the provider's quality management system and the accountability roles around it. Check whether your Govern outcomes name owners, risk tolerance and escalation paths that a notified body or market surveillance authority could later trace to Act obligations.
Map before measure and manage
AI 100-1 says most users start with Map once Govern outcomes are in place, then move to Measure or Manage. Mapping the system's context, intended purpose and impacts is the work that determines whether an Annex III area applies under Article 6(2). Confirm with counsel whether your Map records are detailed enough to support a high-risk classification decision and its justification.
Measurement against trustworthy AI characteristics
AI 100-1 describes seven characteristics of trustworthy AI: valid and reliable; safe; secure and resilient; accountable and transparent; explainable and interpretable; privacy-enhanced; and fair with harmful bias managed. Several overlap with AI Act requirements on accuracy, robustness and cybersecurity. Treat the characteristics as a shared vocabulary for test evidence, and confirm with the standard owner which Act requirement each test result supports.
Monitoring and incident handling
The AI RMF's Manage function covers responding to and recovering from risks after deployment. Under the AI Act, providers of high-risk systems carry post-market monitoring and serious incident reporting duties under Articles 72 and 73. Check whether your monitoring signals, triage steps and incident records can feed the reporting content those articles require, and confirm the reporting timelines with counsel.
Playbook as a documentation companion
The NIST AI RMF Playbook offers suggested actions, documentation prompts and references for each subcategory. It is neither a checklist nor a set of steps, and its audit log shows the last content update in August 2023, with updates expected after the AI RMF is revised. Use it to draft documentation, but do not treat its prompts as proof of Act conformity or as a substitute for the technical documentation the Act requires.
Harmonised standards and presumption of conformity
Under Article 40(1), only harmonised standards whose references are published in the Official Journal give a presumption of conformity. EN 18286:2026, on quality management, was cited in the Official Journal on 14 October 2026. Map your AI RMF documentation against that standard's requirements as it becomes available, and confirm with the standard owner which other harmonised standards apply to your system type before assuming any NIST-based record gives a presumption.
What the 2026 amendment changed in the timeline
The most consequential change is to the high-risk dates. Regulation (EU) 2026/1744, the Digital Omnibus on AI, amended the AI Act on 8 July 2026, was published on 24 July 2026 and entered into force on 27 July 2026. It moved the high-risk rules in Chapter III, Sections 1 to 3, from 2 August 2026 to 2 December 2027 for Annex III systems, which cover areas such as credit scoring, employment and biometrics. For AI in Annex I product systems, the date moved from 2 August 2027 to 2 August 2028. If your AI RMF program was scheduled around the original deadlines, re-baseline it against the new dates and have counsel confirm them in the consolidated text of the Act.
The Act applies in phases, and Article 113 sets the sequence. Chapters I and II, covering definitions, AI literacy and prohibitions, have applied since 2 February 2025. The general-purpose AI, governance, notified body and penalty chapters have applied since 2 August 2025, with Article 101 excluded. The rest of the Act applies from 2 August 2026, except the high-risk rules the amendment moved. The Act now has 13 chapters and 113 articles, plus Articles 4a, 60a and 75a to 75d inserted in 2026. For a team selling into the EU, the prohibitions and AI literacy duties are already in force, so check now whether any system in use touches a prohibited practice, and give each obligation its own date.
The NIST side of the timeline has the opposite problem: the target is moving. NIST says AI RMF 1.0 is being revised as part of the White House AI Action Plan, and as of 17 October 2026 it had not published a revised version. The July 2025 Action Plan recommends removing references to misinformation, diversity, equity and inclusion, and climate change. NIST expects a formal review with community input no later than 2028. Plan against 1.0 and its 72 subcategories, record the exact version you mapped to, and confirm the revision status on the NIST AI Risk Management Framework page before each audit or board report. The Playbook's audit log shows its last content update in August 2023, so treat its suggested actions as dated until NIST revises them.
How to sequence the AI Act and the AI RMF in one program
The sequence starts with legal scope, then uses the AI RMF to build governance and risk evidence that the AI Act's provider duties can later draw on, so one program produces both the voluntary risk record and the binding technical file.
Classify each AI system against Article 6 and Annex III
Legal or compliance staff, with the system owners, list every AI system in the portfolio and test each against Article 6(2) and the eight Annex III areas, such as biometrics, credit scoring, employment and critical infrastructure. Classification is recorded as high-risk, transparency risk, unacceptable or minimal, with the reasoning written down. The step is done when each system has a dated classification that a named owner has signed off and that Legal can defend to a regulator.
Confirm scope under Article 2
Legal counsel confirms the company's role for each system, whether provider, deployer, or a non-EU party whose output is used in the EU, and whether the system is placed on the EU market or its output is used there. Roles can differ for the same system across business units, so each role is recorded separately. The step closes when the scope memo lists every in-scope system, its role and the EU touchpoint that brings it in scope. Ask counsel to confirm the position against the current consolidated text as amended in 2026.
Establish governance under the Govern function
The AI risk owner, with executive sponsorship, sets the policies, accountability roles, risk tolerance and staff training that the AI RMF places under Govern, a cross-cutting function that the framework treats as a foundation for the others. The same accountable roles are mapped to the Act's provider and deployer duties, including AI literacy under Chapters I and II. The step is complete when named owners, a decision process and a policy set exist and can be shown to auditors and to customers. The AI RMF lets users select categories and subcategories, so the team should record which ones it adopts and why.
Map each system and its context
System owners and data teams use the AI RMF Map function to document intended purpose, deployment setting, affected people, data sources, dependencies and foreseeable misuse for each in-scope system. This record feeds the Act's risk management and the intended-purpose information that high-risk documentation must describe. The step closes when every high-risk and transparency-risk system has a context record reviewed by its owner and the risk team. Confirm with counsel which mapping details the Act requires in its own format, since the AI RMF does not prescribe templates.
Measure risks and test trustworthiness
The technical and risk teams use the Measure function to choose metrics, run tests and evaluate the seven trustworthiness characteristics described in AI 100-1, such as validity, security, explainability and bias management. Results are logged with the test method, data used, limits and the reviewer. The step is done when each risk identified in mapping has a measured result or a documented reason it was not measured, with the residual risk accepted by an owner. Keep these records in a form that can later be shown as evidence under the Act's risk management and testing requirements.
Manage and treat risks with decision records
Risk owners use the Manage function to prioritize risks, select and apply treatments, assign responsibility and record how each residual risk is accepted, transferred or reduced. Treatments for high-risk systems are tied to the requirements they address so the team can see which Act obligations each control supports. The step closes when every risk above tolerance has an action with an owner and a review date, and the decision log can be produced on request. Where the team uses the NIST Playbook for suggested actions, it should note that the Playbook is not a checklist and was last updated in August 2023.
Build the Act-specific technical documentation and quality management system
For each high-risk system, the provider assembles the technical documentation and the quality management system required under the Act's provider duties (Articles 16 and 17 and related Section 2 requirements), reusing AI RMF evidence where the reader confirms it fits the Act's content. Legal and quality staff confirm the gaps the AI RMF does not cover, such as the declaration, CE marking and registration steps. Check whether harmonised standards are relevant, since only standards whose references are published in the Official Journal give a presumption of conformity, and EN 18286:2026 on quality management was cited on 14 October 2026. The step is done when a gap list against the Act's requirements is closed or assigned.
Complete conformity assessment and set up post-market monitoring
The provider completes the conformity assessment route that applies to the system, which for most Annex III systems is the internal-control procedure in Annex VI, and then issues the declaration, applies CE marking and registers the system where required. Notified bodies apply only to some biometric systems and Annex I products under Article 43, so the route should be confirmed for each system. Post-market monitoring and serious incident reporting under Articles 72 and 73 then feed back into the AI RMF Measure and Manage records. The program is complete for a system when the signed declaration, the monitoring plan and the incident procedure are on file, and the schedule for each step is written down, because no supplied fact gives durations and the reader should ask the internal or external team for a written plan.
Questions buyers ask before choosing between the AI Act and the AI RMF
Does following the NIST AI RMF satisfy the EU AI Act?
No. The AI RMF is a voluntary US framework with no certification, and NIST does not validate or endorse any organization's use of it. The AI Act is binding EU law, and for high-risk systems it requires a quality management system, technical documentation, a conformity assessment, a declaration and CE marking where applicable. Harmonised standards published in the Official Journal are the route to a presumption of conformity under Article 40(1), and the AI RMF is not one of them. The AI RMF can still supply useful risk processes and documentation patterns. Confirm the mapping and the legal position with qualified EU counsel before relying on it.
What drives the cost of complying with the AI Act?
The main drivers are the number of high-risk AI systems you place on the EU market, the conformity route each one takes, and the volume of documentation you must produce and keep current. Most Annex III systems use internal-control conformity assessment under Annex VI, while notified bodies are involved for some biometric systems and Annex I products under Article 43, which adds third-party cost and lead time. The Commission's impact assessment in SWD(2021) 84 estimated compliance at EUR 6,000 to 7,000 per high-risk AI system by 2025, or roughly 4 to 5% of development cost. That is an estimate from before the 2026 amendment, so treat it as a planning reference, not a quote. Ask any provider for a written scope that separates one-time build work from recurring monitoring and re-assessment.
Can our own team run an AI Act compliance program without outside help?
Often yes for internal-control systems, provided you have people who understand the Act's provider and deployer duties, the Annex III classification, and how to build technical documentation and post-market monitoring. Your staff can run the work, but they need named owners in engineering, legal and product, and time for the documentation to stay accurate as models change. Outside help is most useful for a gap assessment, for building the quality management system, or for preparing evidence for a notified body where one is required. DeployOpen plans, implements and documents controls inside the client's own environment under a fixed scope agreed in writing, but it does not issue conformity assessments or certifications, which independent bodies provide.
How long does AI Act readiness take for a high-risk system?
No reliable duration is supplied for this work, so do not plan against a generic number. The timing depends on how many systems are in scope, how much of the required documentation already exists, whether your data and logging controls are mature, and whether a notified body is involved. Application dates are fixed by law: after the 2026 amendment, the high-risk rules for Annex III systems apply from 2 December 2027 and those for Annex I product systems from 2 August 2028. Ask any provider for a written schedule with milestones, dependencies on your teams, and the point at which the work is handed over to your operations staff.
What do engineering, legal and product teams need to contribute?
Compliance work is split across functions, so the project fails if one of them is missing. Engineering produces the technical documentation, logging, data governance records, testing evidence and monitoring hooks. Legal and compliance confirm the risk classification under Article 6, the intended purpose, the instructions for use, and the declaration of conformity. Product owns the intended purpose, the human oversight design, and the decision about whether a change is substantial enough to trigger reassessment. Ask each provider how they will assign owners, how they will run the work in your tooling, and what they will hand over at the end.
What fines can apply under Article 99 of the AI Act?
Article 99 sets three tiers, and the highest applicable amount applies. Prohibited practices can draw fines up to EUR 35 million or 7% of worldwide annual turnover. Most operator obligations, which cover many high-risk duties, can draw fines up to EUR 15 million or 3%. Supplying misleading information to authorities can draw fines up to EUR 7.5 million or 1%. Market surveillance authorities enforce these rules for AI systems, so an absence of certification does not limit exposure. Map each high-risk duty to its tier with counsel so you can rank work by exposure.
Should we start with the AI RMF or the AI Act?
If you sell into the EU, start with the AI Act's classification question, because it decides which obligations apply and when. Once you know whether a system is high-risk, the AI RMF can help you organize risk identification, measurement and governance work that feeds the Act's documentation and risk management needs. The AI RMF Core has 4 functions, 19 categories and 72 subcategories, and NIST describes it as flexible rather than a checklist. Use it as a working method, not as evidence of AI Act conformity, and confirm the sequence with counsel.
How to start without overbuilding a program
Start by inventorying every AI system your company builds, buys or deploys, then decide which of them reach the EU. Under Article 2 of the AI Act, the Act applies to providers placing AI systems on the EU market wherever they are established, to deployers in the EU, and to non-EU providers and deployers whose output is used in the EU. Record, for each system, its owner, its purpose, the data it uses and the users or customers it touches. That single register feeds both frameworks: the AI Act classification decision and the AI RMF Map function. Confirm with counsel where a system sits in the EU chain, since a US-based team selling a product whose output is used in the EU may still carry provider duties.
Next, classify only the systems that could be high-risk. Check each against the eight Annex III areas, such as credit scoring, insurance pricing, employment and biometrics, and against Annex I product rules. Under the 2026 amendment, Annex III high-risk rules apply from 2 December 2027, so the first evidence set is due in that window, not today. For systems that fall outside those areas, the work is lighter: keep a documented rationale and any transparency duties that apply. Then pick the smallest control set you must evidence for each high-risk system: a quality management system, technical documentation, risk management, logging, and post-market monitoring. Use the AI RMF categories as a working vocabulary for these controls, but do not treat the Playbook as the source of required actions. Do not treat the Playbook as a checklist. NIST describes its suggested actions as neither a checklist nor a set of steps, and AI 100-1 says the same of the Core. Its audit log shows the last content update in August 2023, and AIRC says it will be updated after AI RMF 1.0 is revised, so some suggested actions may lag current practice. Ask your assessor or counsel which evidence each EU obligation requires, and use the Playbook only as a source of ideas for how to meet it.
How DeployOpen scopes and delivers readiness for both frameworks
DeployOpen is a Chainscore Labs company that plans, implements, documents and supports self-hosted open-source platforms inside the client's own infrastructure, and prepares evidence for compliance assessments. For EU AI Act vs NIST AI RMF, the work is agreed in writing as a fixed-scope engagement before delivery starts, with the EU obligations and the voluntary AI RMF mapping treated as separate deliverables.
How we scope
- Written scope lists which AI systems, providers or deployer roles, and EU markets are in view.
- Scope records which Annex III or Annex I categories apply, based on the client's own classification.
- Deliverables separate EU AI Act obligations from optional AI RMF function and category mapping.
How we build
- Technical controls, logging and documentation are implemented inside the client's own cloud, data center or air-gapped network.
- Security testing of AI systems and agents is run against the agreed scope before readiness is reported.
- Quality management and risk management records are structured so one body of evidence serves both frameworks.
How we hand over
- Documentation covers system descriptions, risk registers, test results and an AI RMF crosswalk for the client's team.
- Handover records state which items are evidence for the AI Act and which are self-assessment material.
- Independent conformity assessment or certification remains with notified bodies or auditors the client selects.
How we support
- Ongoing support, upgrades and continuous testing are available as a retainer after handover.
- Retainer scope is agreed in writing, including how changes to the AI Act and the AI RMF revision are handled.
- Confirm with DeployOpen during scoping which regulatory updates and review cycles the retainer covers.
Sources and further reading
- Regulation (EU) 2024/1689, consolidated text as amended by Regulation (EU) 2026/1744 ↗
- NIST AI 100-1, Artificial Intelligence Risk Management Framework (AI RMF 1.0) ↗
- NIST AI Risk Management Framework FAQs ↗
- AI RMF use cases page from NIST AIRC ↗
- Regulatory framework for AI, European Commission ↗
- Commission Implementing Decision (EU) 2026/2274 on harmonised standards for high-risk AI systems ↗
