NIST AI RMF and European regulation

What the mapping provides

NIST AI RMF is a voluntary risk management framework. The AI Act, GDPR, DORA and Czech cybersecurity law establish obligations within defined scopes. One measure may support several duties, but a thematic connection is not legal equivalence or certification.

Start with the AI system’s purpose, your role and applicable legislation. Then select controls and evidence. The NIST Playbook is not a mandatory checklist that must be completed in full.

Four functions and practical evidence

NIST AI RMF function	Practical question	Example evidence
GOVERN	Who decides and is accountable?	System owners, policies, supplier management and risk decisions
MAP	In what context could harm arise?	Inventory, purpose, affected people, dependencies and initial impact assessments
MEASURE	How do we know whether the system meets expectations?	Test data, metrics, results, limitations and uncertainty
MANAGE	What do we do about identified risk?	Corrective actions, operational controls, incident procedures and change decisions

GOVERN cuts across the other functions. These are not four one-off phases after which a system automatically becomes safe. NIST AI 600-1 uses GV, MP, MS and MG as prefixes in full action identifiers, for example GV-1.1-001. A guide’s own label such as MP-1 is not by itself one of these full identifiers; check the exact source.

Thematic connections with legislation

Area	Example provisions	Limits of applicability
AI risk management	AI Act Articles 9 and 17	Primarily high-risk systems and their providers; check role and application date
System data and documentation	AI Act Articles 10 and 11, Annex IV	Requirements for high-risk AI systems, with the relevant role and application date; documentation must reflect the particular system and is not replaced by a general organisational policy
Human oversight and technical requirements	AI Act Articles 14 and 15	High-risk AI systems: oversight, accuracy, robustness and cybersecurity; assess role, context and application date, and justify the metrics
Personal data protection	GDPR Articles 5, 24, 25, 28, 32 and 35	Legal basis, role and likely risk of the specific processing
Cybersecurity	NIS2 Articles 20, 21 and 23 and Czech Act No. 264/2025 Coll.	Regulated service, obligations and deadlines under Czech law
Financial-sector digital resilience	DORA Chapters II–IV and Chapter V Section I	In-scope financial entities, proportionality and specific implementing rules. Chapter V Section II separately establishes oversight of ICT third-party providers designated as critical under Article 31; these roles are not interchangeable
Incidents	GDPR Articles 33–34, AI Act Article 73, NIS2 Article 23, DORA Article 19	Different recipients, triggers, thresholds and deadlines; one generic time limit is insufficient

An AI Act provider, a GDPR controller and a regulated cybersecurity entity are not interchangeable roles. One organisation may hold several roles simultaneously.

Building your own matrix

For each relevant requirement, record the legal source and version, why it applies, applicable deadline, responsible person, measure and evidence. Record who reviewed the evidence and what remains unresolved.

Example: a hiring tool needs more than a row saying “fairness test complete”. Establish purpose and role, the high-risk assessment, measurement method, group representativeness, uncertainty and the response to harmful impacts. Assess personal data protection and human involvement at the same time.

A technical test can provide evidence for part of a requirement. It does not replace legal assessment, risk approval, an operational process or any applicable conformity assessment.

Assessing progress

Measure the availability and quality of evidence, whether controls work and which gaps have been resolved. The presence of software or a policy library does not establish organisational maturity.

Partial, Risk Informed, Repeatable and Adaptive are Tiers in the NIST Cybersecurity Framework. NIST distinguishes Tiers from maturity levels. They are not NIST AI RMF scoring levels. Plan–Do–Check–Act is likewise not an organisational certification ladder.

Verified on 6 September 2026: NIST AI RMF 1.0, NIST Playbook, NIST CSF explanation of Tiers, AI Act, GDPR, NIS2, DORA.