EU AI Act ↔ NIST AI Risk Management Framework
5 canonical controls in Keel's library satisfy clauses of both EU AI Act and NIST AI Risk Management Framework. Implement each once, attach the evidence once, and it counts toward each standard. The overlap is the work you don't repeat.
Controls that satisfy both
| Canonical control | EU AI Act clauses | NIST AI Risk Management Framework clauses |
|---|---|---|
| AI system inventory A maintained inventory of the AI systems the organization develops, deploys, or uses, with each system's purpose, owner, and risk classification. | HOBL-5 | MAP-1 |
| AI system impact assessment A process to assess the potential impacts of AI systems on individuals, groups, and society, and to document and act on the results. | HREQ-1 | MAP-5 |
| AI risk management process A process to identify, analyze, prioritize, and treat the risks an AI system can pose, tracked over its lifecycle. | HREQ-1 | MAP-4, MEASURE-1, MANAGE-1 |
| AI verification, validation & robustness Testing that an AI system meets its requirements and performs with appropriate accuracy, robustness, and security before and during use. | HREQ-7 | MEASURE-2 |
| AI monitoring & malfunction reporting Ongoing monitoring of AI systems in operation, with a process to detect, communicate, and report malfunctions and serious incidents. | HOBL-6, HOBL-7 | MANAGE-4 |
Clause identifiers (EU AI Act and NIST AI Risk Management Framework) are referenced factually for mapping. Keel is not affiliated with or endorsed by the bodies that publish these standards. Control descriptions are Keel's own; a framework's full authored control count is on its framework page.
Why this is one project, not two
On a crosswalk-native model, NIST AI Risk Management Framework mostly lights up controls you already built for EU AI Act. You're not re-uploading the same screenshot for a second audit. You apply the framework and see the genuine delta worth working. That's the whole idea behind collect once, comply everywhere.