Governing Generative AI: NIST AI RMF and the EU AI Act in Plain Language

Two documents dominate conversations about governing AI: the US National Institute of Standards and Technology's AI Risk Management Framework (AI RMF) and the European Union's AI Act. One is voluntary guidance; the other is binding law with penalties. This article explains both in plain language and suggests a proportionate approach for a smaller organization. It is general information, not legal advice, and regulations change, so confirm current requirements with official sources or counsel.

NIST AI RMF: a voluntary framework

The AI RMF, first published in January 2023, helps organizations manage risks from AI systems. It does not certify anything and has no legal force by itself, but it is widely used as a common vocabulary and is referenced in procurement and policy. It is organized around four functions:

• Govern: establish policies, roles, accountability and a risk-aware culture.
• Map: understand the context, intended use, stakeholders and potential harms of each system.
• Measure: test and monitor for accuracy, robustness, security, privacy, fairness and other qualities.
• Manage: prioritize and act on risks, with plans for incidents and decommissioning.

NIST also published a Generative AI Profile that applies the framework to risks specific to generative systems, such as confabulation, data privacy, information security and harmful content.

The EU AI Act: a binding regulation

The AI Act (Regulation (EU) 2024/1689) entered into force in August 2024 and applies in phases. It takes a risk-based approach:

There are also specific obligations for providers of general-purpose AI models, such as technical documentation, copyright-compliance measures and, for the most capable models, additional risk-management duties. These provider obligations have applied since August 2025.

Timeline: check the current dates

The schedule for high-risk systems has been changing. A provisional political agreement in May 2026 on the EU's "Digital Omnibus" amendments moves obligations for stand-alone high-risk systems from August 2026 to 2 December 2027, and for high-risk systems embedded in regulated products to 2 August 2028, while leaving the rules on prohibited practices and general-purpose models in place. Reports also describe adjusted dates for labeling AI-generated content. Because the final legal text and dates matter, check the official journal or the Commission's AI Act pages before relying on these figures.

Who is affected

The Act applies by role and market, not only by where a company is based. A company outside the EU can be covered if its AI system is placed on the EU market or its outputs are used in the EU. Obligations differ for providers (who develop or place a system on the market) and deployers (who use it). Many small companies are deployers of third-party models and need to focus on transparency, appropriate use and, for any high-risk use, human oversight and monitoring.

How they compare

They complement each other: following the AI RMF builds the documentation and testing habits that make AI Act compliance easier.

A lightweight governance program

You do not need a large department. A small team can do the following:

1. Inventory your AI use. List every AI system and tool, who owns it, what data it touches and what decisions it influences. Include third-party services and employee-adopted tools (data privacy guide).
2. Classify by risk. Does any use affect people's employment, credit, education, health or legal rights? Those need the most care and may be high risk under the Act.
3. Assign accountability. Name an owner for each system and a person responsible for the overall program.
4. Set policies. Acceptable use, data handling, human oversight requirements, and procurement checks for vendors.
5. Test and monitor. Evaluate accuracy and safety before launch and regularly after (evaluation practice), and track the security risks in the OWASP LLM Top 10.
6. Be transparent. Tell users when they are interacting with AI and label synthetic content where required.
7. Keep records. Documentation of decisions, tests, incidents and changes serves both customers and regulators, and fits into your existing compliance evidence (SOC 2 automation).
8. Plan for incidents. Define how to respond when a system causes harm, and how to switch it off.
9. Review regularly. Revisit the inventory and rules every few months.

Questions customers will ask

Enterprise buyers increasingly ask: Which AI do you use? Is our data used for training? How do you test for errors and bias? Who is accountable? Having written answers to these is often more valuable than a long policy document.

Summary

Use the NIST AI RMF as your working method and track the EU AI Act where it applies to you. Start with an inventory and risk classification, keep proportionate records, and verify current legal deadlines with official sources.