What distinguishes risk classification in the EU AI Act from the NIST AI RMF?

• A. The EU AI Act has detailed categories; the NIST RMF follows a flexible, industry-agnostic approach
• B. The EU AI Act uses a single risk level; NIST RMF has four
• C. The EU AI Act is technology-specific; NIST RMF is technology-neutral
• D. The EU AI Act ignores risk categorization; NIST RMF emphasizes penalties

Answer: (A)

The main idea here is how risk is organized. The EU AI Act defines explicit, detailed risk categories and ties specific obligations to each level, with particular emphasis on high‑risk systems and the steps needed to demonstrate conformity. It uses a formal taxonomy that shapes what you must do depending on where a system falls in those categories.

The NIST AI RMF, on the other hand, provides a flexible, industry‑agnostic process for managing AI risk. It doesn’t prescribe fixed risk levels or a one‑size‑fits‑all set of categories. Instead, organizations assess risk in their own context and tailor governance, risk assessment, and mitigation activities to their particular use case, technology, and environment.

So, the best description is: the EU Act uses detailed categories with prescriptive requirements, while the NIST RMF is a flexible framework that adapts across industries.