EU AI Act, US RMF, and Sector Rules: What ML Practitioners Must Know Now

The EU AI Act, adopted in 2024, is the world's first comprehensive AI law, classifying systems into four risk tiers with fines for high-risk non-compliance reaching up to €35 million or 7% of global annual turnover. High-risk applications such as hiring tools, credit scoring, and healthcare diagnostics require conformity assessments, human oversight, and ongoing post-market monitoring registered in an EU database. In the United States, NIST's voluntary AI Risk Management Framework has become the de facto governance standard, structured around four functions: Govern, Map, Measure, and Manage. Beyond horizontal AI laws, sector-specific rules add additional obligations — including FDA oversight of medical AI, explainability requirements for credit decisions, and New York City's mandatory bias audits for automated hiring tools. Practitioners building AI in regulated domains must treat these legal frameworks as a compliance floor, not an optional checklist.