How do I map the NIST AI RMF to EU AI Act requirements for high-risk AI?

Mapping NIST AI RMF to EU AI Act requirements for high-risk AI involves aligning the RMF's four functions (Govern, Map, Measure, Manage) with the EU AI Act's emphasis on robust risk management, transparency, and accountability. This can be achieved by implementing specific controls that address both frameworks' objectives.

To align with EU AI Act requirements for high-risk AI, organizations should implement the following controls:

• NIST-GOVERN-1.1 — Legal & policy requirements mapped: Understand, manage, and document legal and regulatory requirements for AI, including maintaining an acceptable-use policy for AI/agent systems covering permitted and prohibited uses, and human-oversight expectations. This cross-maps to ISO/IEC 42001 A.2 AI policy.
• NIST-GOVERN-2.1 — Roles, responsibilities & accountability: Document clear roles, responsibilities, and lines of communication for AI risk, ensuring a named risk owner or accountable executive exists for each deployed AI/agent system. This cross-maps to ISO/IEC 42001 Cl.5 Leadership and A.3 Internal organization.
• NIST-MAP-1.5 — AI system inventory: Maintain a current inventory of all AI/agent systems, including models, agents, tools, and data flows, as you cannot govern what is not inventoried.
• NIST-MAP-5.1 — Impact & harm identification: Identify potential positive and negative impacts of AI systems on individuals, groups, and society, including data sensitivity and regulated data exposure. This cross-maps to ISO/IEC 42001 A.5 AI impact assessment.
• NIST-MEASURE-2.8 — Transparency & accountability mechanisms: Establish mechanisms to log decisions and trace AI behavior, ensuring every AI decision is logged with strict data contracts.
• NIST-MEASURE-3.1 — Risk tracking over time: Implement approaches for tracking identified and emergent risks through monitoring, logging, and drift detection. This cross-maps to ISO/IEC 42001 Cl.9 Performance evaluation and OWASP LLM10 (abuse/consumption monitoring).
• NIST-GOVERN-6.1 — Third-party / supply-chain risk policy: Address risks from third-party models, datasets, and tools, tracking provenance, licensing, and model-update risks. This cross-maps to OWASP LLM03/LLM05 (supply chain) and ISO/IEC 42001 A.10 Third-party relationships.