The EU AI Act (binding law, risk-tiered, phasing in through 2025–2027) and NIST AI RMF (voluntary US framework: Govern/Map/Measure/Manage) — and the specific engineering obligations they create.
How it works
The EU AI Act categorizes AI systems based on their risk levels, creating a framework for compliance that impacts engineering practices. Prohibited uses are banned outright, while 'high-risk' applications, such as those in hiring, credit assessment, and biometrics, must adhere to strict requirements. This includes implementing risk management strategies, ensuring strong data governance, maintaining human oversight, and conducting thorough logging and accuracy testing. For instance, if you are developing a hiring algorithm, you must document how you mitigate bias and ensure the model's decisions are transparent and explainable. Limited-risk applications, like chatbots and generative media, face fewer restrictions but still require transparency measures such as AI-content labeling. As a result, engineers need to create an AI system inventory, maintain model cards that detail the model's purpose and performance, and establish immutable audit logs to track changes and decisions.
On the engineering side, the NIST AI Risk Management Framework (RMF) provides a structured approach to managing these obligations. It helps organize compliance efforts through its four components: Govern, Map, Measure, and Manage. For example, when you 'Govern', you establish policies and procedures that align with the EU AI Act's requirements. 'Mapping' involves identifying how your AI systems fit within the risk categories defined by the Act. 'Measuring' assesses the performance and risks of your AI systems, while 'Managing' focuses on implementing controls to mitigate identified risks. This framework aligns well with existing standards like ISO 42001, making it easier for engineers to integrate compliance into their development processes.
To illustrate, consider a company developing a facial recognition system. Under the AI Act, they must conduct bias evaluations, maintain technical documentation, and ensure human oversight of the system's decisions. If they fail to implement these requirements, they risk being classified as non-compliant, which could lead to significant penalties. The NIST RMF helps the engineering team systematically address these requirements throughout the development lifecycle, ensuring that compliance is not an afterthought but an integral part of the system's design and implementation.
- Create an AI system inventory/register.
- Document models and datasets with model cards.
- Implement bias and robustness evaluation suites.
- Maintain immutable audit logs for transparency.
- Establish a human override path for oversight.
The software-engineering analogue
You can think of the EU AI Act and NIST RMF as similar to compliance frameworks like GDPR or SOC 2, which focus on data governance and security in software development. However, the key difference lies in the nature of the obligations. With GDPR, the focus is primarily on how data is handled and stored. In contrast, the AI Act and NIST RMF place obligations on Model behavior. This means that engineers must provide evidence of the model's performance, such as its accuracy and bias, rather than just ensuring data is securely managed. This shift requires a deeper integration of compliance measures into the AI system itself, rather than treating them as separate components.
Where this analogy breaks down is in the need for continuous monitoring and evaluation of model behavior. In traditional software compliance, once the system is built and meets the requirements, it can be considered compliant. For AI systems, however, compliance is an ongoing process. Models can drift over time, leading to changes in performance or bias. Therefore, engineers must build in mechanisms for continuous evaluation and documentation, ensuring that compliance with the AI Act is maintained throughout the system's lifecycle.
Why not the obvious alternative
A common misconception is that compliance can be achieved with a one-time legal review right before launch. This approach is flawed because the necessary artifacts, such as evaluation results, model lineage, and comprehensive documentation, cannot be generated retroactively. If the system was not designed with these compliance requirements in mind from the outset, it becomes nearly impossible to produce the evidence needed to demonstrate adherence to the regulations.
Instead, engineers must embed compliance features into the system from the beginning. This means creating an evidence pipeline that captures performance metrics, bias evaluations, and documentation as part of the development process. Without this proactive approach, organizations risk facing penalties and losing market access due to non-compliance, which could have been avoided with proper planning and integration of compliance measures.
When to use which
If your AI system is intended for the EU market or falls into a high-risk category, you should engineer your solution to comply with the EU AI Act as soon as possible. This proactive stance ensures that you are prepared for regulatory scrutiny as the Act phases in from 2025 to 2027. For organizations operating primarily in the US or focusing on internal applications, adopting the NIST RMF as your operational model will help you align with future regulations while also providing a solid framework for managing AI risks.
Choosing between these frameworks depends on your target market and the risk level of your AI applications. If you anticipate needing to comply with the EU AI Act, integrating its requirements early in your development process will save time and resources later. On the other hand, if you are primarily focused on internal use or US markets, the NIST RMF offers a flexible approach that can help you prepare for future regulations without the immediate pressure of compliance requirements.
In production: when it breaks
Why it happens. The failure often stems from inadequate documentation and risk assessment processes that do not align with the EU AI Act's requirements. This can occur if the engineering team has not properly mapped the model's operations to the regulatory criteria or if the risk management framework has not been updated to reflect recent changes in legislation.
- Step 1: Review compliance documentation to ensure it aligns with EU AI Act requirements.
- Step 2: Audit the risk assessment process to identify gaps in mapping AI operations to regulatory criteria.
- Step 3: Conduct an internal review of the NIST AI RMF implementation to check for missing measures or management practices.
What it delivers
By adhering to the EU AI Act and NIST RMF, organizations gain market access and avoid potential penalties that can reach up to 7% of global turnover. More importantly, these frameworks foster buyer trust, as compliance artifacts demonstrate a commitment to reliability and ethical AI practices. This trust is crucial for attracting customers and partners, as it shows that your organization prioritizes responsible AI development and governance.