Why the two regimes converge
The NIST AI RMF is voluntary and organized around four functions: Govern, Map, Measure, Manage. The EU AI Act is binding law and organizes obligations around the role you play (provider or deployer) and the risk tier of the system (prohibited, high-risk, limited-risk, minimal-risk).
Different vocabulary, same underlying question: can you prove, on a specific date, that you knew what your model was doing and that you controlled it? That is an evidence question, not a policy question. And evidence is where most programs are thin.
The mapping that matters
The table below is the one we use in practice. Each EU AI Act obligation for high-risk systems has a natural NIST AI RMF home, and each has a concrete artifact an auditor will request by name.
| EU AI Act obligation | NIST AI RMF function | Artifact an auditor requests |
|---|---|---|
| Art. 9 — Risk management system | Map 1–5, Manage 1–4 | Versioned risk register with owner, likelihood, impact, and closure evidence per entry |
| Art. 10 — Data governance | Map 2, Measure 2 | Dataset provenance record, bias examination results, and data-quality acceptance criteria |
| Art. 11 & Annex IV — Technical documentation | Govern 1, Map 3 | Annex IV dossier: intended purpose, architecture, training methodology, validation results |
| Art. 12 — Record-keeping (logging) | Measure 3, Manage 3 | Immutable event log with retention period, tamper evidence, and queryable audit trail |
| Art. 13 — Transparency & instructions for use | Govern 4, Map 4 | Published instructions-for-use document with known limitations and human-oversight guidance |
| Art. 14 — Human oversight | Govern 3, Manage 2 | Documented oversight design plus sampled intervention records showing a human actually acted |
| Art. 15 — Accuracy, robustness, cybersecurity | Measure 1–4 | Test reports, adversarial evaluation results, and dependency vulnerability posture |
| Art. 17 — Quality management system | Govern 1–6 | QMS manual, change-control records, and internal audit findings with remediation status |
| Art. 72 — Post-market monitoring | Manage 4 | Continuous monitoring plan plus live dashboards showing drift and incident trends |
The 20% that does not overlap
Three obligations have no clean NIST analogue, and these are the ones that produce findings:
- Conformity assessment and CE marking (Art. 43). NIST has no certification concept. You need a documented internal-control procedure and, for certain systems, a notified-body engagement.
- Registration in the EU database (Art. 49). A filing obligation with a timestamp. It is either done or it is not.
- Serious-incident reporting timelines (Art. 73). Fifteen days for a general serious incident, two days where widespread infringement or critical-infrastructure harm is involved. This is an operational runbook requirement, not a documentation requirement.
If your program is built purely on NIST AI RMF language, you will pass a maturity review and still fail an EU AI Act conformity assessment. The reverse is also true.
Generate evidence continuously, not retroactively
The failure mode we see repeatedly is a team that assembles an Annex IV dossier in the six weeks before an audit, from screenshots and memory. That dossier is stale the day it is signed, and it cannot survive a follow-up question.
The alternative is to make each artifact a byproduct of normal engineering:
- Risk register entries are created from the same ticket that introduces the model change.
- Logging evidence is a query against the production event store, not a screenshot of a dashboard.
- Human-oversight evidence is sampled from real intervention records with timestamps and reviewer identity.
- Post-market monitoring is a live metric with a retention policy, not a quarterly PDF.
This is exactly what TrustAudit™ is built to do: it holds the control set for both regimes, maps each control to its evidence source, and reports the gap between “control defined” and “evidence present and current.” A control with no fresh evidence is reported as failing, not as compliant.
A concrete starting sequence
- Classify. Determine the risk tier of every AI system in your inventory. Most organizations discover at least one system they had not classified at all.
- Map once. Build the single evidence map above. Do not build two programs.
- Instrument. For each artifact, name the system of record that produces it. If the answer is “a person writes it,” that is your highest-risk control.
- Test the gap. Ask for each artifact as an auditor would, with a date. Whatever you cannot produce in ten minutes is a finding waiting to happen.
- Close the three non-overlapping items — conformity procedure, registration, and incident runbook — explicitly and separately.
Bottom line
The EU AI Act and NIST AI RMF are not two compliance programs. They are one evidence program with two reporting formats. Build the evidence once, continuously, and both regimes become a formatting exercise instead of a fire drill.