AI compliance means showing that the AI systems you build or use meet legal and policy requirements. Start by listing every AI system, classify each by risk, name an owner, and map the result to the rules that apply to you. The EU AI Act is binding law. The NIST AI RMF is voluntary guidance.
Why does it matter now?
Rules are in force and still moving. The EU AI Act classifies AI systems by risk. A summary from the AI Act information site, updated on 31 August 2026 for amendments adopted in the Digital Omnibus on AI, says unacceptable risk practices are prohibited, high-risk systems are regulated, limited risk systems carry transparency duties, and minimal risk systems are unregulated.
The same page gives dates: obligations for general-purpose AI models began on 2 August 2025, transparency obligations under Article 50 apply from 2 August 2026, high-risk systems under Annex III from 2 December 2027, and those under Annex I from 2 August 2028.
That page is a secondary summary. Check the dates against the official text and the European Commission's pages before relying on them, because they have been amended.
What is the EU AI Act?
It is a regulation with reach beyond the EU. The summary notes that providers placing high-risk systems on the EU market are covered regardless of where they are established, and so are third country providers whose system output is used in the EU. Most obligations fall on providers of high-risk systems, with a separate set for deployers.
Examples of prohibited practices given in the summary include social scoring and manipulative AI. High-risk areas it lists include education, employment and worker management, such as systems used for recruitment or selection.
What is the NIST AI RMF?
The NIST AI Risk Management Framework is intended for voluntary use, to improve the ability to incorporate trustworthiness into the design, development, use and evaluation of AI products, services and systems. NIST released version 1.0 on 26 January 2023. It also published a Generative AI Profile, NIST-AI-600-1, on 26 July 2024, to help organisations identify risks unique to generative AI. NIST's page says the AI RMF 1.0 is being revised, so check for the current version.
It is not a certification and it carries no penalties on its own. Its value is a shared structure for talking about AI risk, which customers and auditors increasingly recognise.
How do they differ?
The Act tells you what you must do and sets the legal consequences. The RMF tells you how a risk programme can work. Many teams use the RMF to build the internal process and the Act to decide which systems need formal documentation. Neither is a substitute for the other, and neither makes a product compliant by itself.
ISO/IEC 42001, an AI management system standard, is another reference customers may ask about. We could not open its ISO page for this review, so read the standard's catalogue entry before citing its scope.
A constructed example
A 200 person software company uses a hosted language model for a support chatbot, a resume screening feature in its HR system and a code assistant for developers. Its inventory shows three systems.
The chatbot is a limited risk case: customers must be told they are talking to AI. The resume screening tool falls in a field the summary lists as high-risk, employment, so the company needs to understand its provider's documentation, human oversight and logging before relying on it. The code assistant is an internal tool that needs a usage policy and security controls rather than regulatory documentation. One company, three different outcomes, all from the same first step.
What belongs in the first 90 days?
Inventory first, because you cannot classify what you have not found. Include shadow use: ask teams which AI tools they use, and check browser and procurement records. Then classify, assign owners, write a short acceptable use policy and review contracts with AI providers for data use and incident duties.
Evidence follows naturally from this work. Records of what you decided and why are what an auditor, regulator or large customer will ask to see. Safeguard's compliance automation can help collect and organise evidence against frameworks, and its policies and guardrails can enforce rules on AI agents. It does not certify anyone, and legal interpretation stays with your counsel.
How to check or apply this
- Build an inventory of AI systems you build, buy or let staff use, including shadow use.
- Classify each by the risk categories in the EU AI Act and note your role: provider or deployer.
- Name an accountable owner for each system.
- Adopt the NIST AI RMF structure for your internal risk process.
- Write an acceptable use policy and train staff on it.
- Review provider contracts for data handling, logging and incident notice.
- Verify current dates and obligations against official texts every quarter.
Quick check
Does the EU AI Act apply to a company outside the EU?
It can. The summary says providers of high-risk systems placed on the EU market are covered wherever they are located, as are third country providers whose output is used in the EU.
Is the NIST AI RMF mandatory?
No. NIST describes it as intended for voluntary use.
Sources
- AI Act information site, High-level summary of the AI Act
- NIST, AI Risk Management Framework
- ISO/IEC 42001 (catalogue page; could not be opened for this review)
Last reviewed: 18 October 2026.
