Which statement best describes the EU AI Act's risk categorization compared to the NIST RMF?

• A. The EU AI Act uses detailed categories, while NIST RMF is flexible and industry-agnostic
• B. The EU AI Act uses a numeric score, while NIST RMF uses qualitative labels
• C. The EU AI Act is not concerned with risk, while NIST RMF focuses on risk
• D. The EU AI Act strictly requires uniform controls across all sectors

Answer: (A)

The statement reflects how risk is structured in these two frameworks. The EU AI Act defines distinct risk levels for AI systems—such as high risk, limited risk, minimal risk, and even unacceptable risk—with specific obligations that change based on which category the AI falls into. This creates a detailed, AI-specific mapping of risk to requirements.

NIST RMF, on the other hand, is a flexible, industry-agnostic process for managing risk across information systems. It uses impact levels and a broad set of controls that organizations tailor to their particular system and environment, rather than applying fixed AI-centered risk categories.

So the EU Act uses detailed categories with concrete obligations for each level, while NIST RMF remains adaptable across sectors, making the best fit for this comparison. The other choices don’t fit because the EU Act doesn’t rely on a numeric scoring approach, and the RMF does not impose uniform controls across all sectors.