Same engine, EU AI Act today, NIST RMF tomorrow

Description and use

Opencomplai’s risk engine separates core logic from regulation‑specific mapping, enabling reuse across EU AI Act, NIST RMF, ISO 42001, and future frameworks.

Problem

Integrating new regulatory frameworks into a risk engine without rewriting core logic.

Outcome

Risk assessment logic remains unchanged across regulations; only mapping layer changes, reducing maintenance and rewrite effort.

Workflow

• 1. Build core engine to evaluate controls and policy mappings without regulation names.
• 2. Create a mapping layer that translates framework‑specific terms to core primitives.
• 3. Load appropriate mapping in CLI/services for desired regulation.
• 4. Run risk assessment using core engine and selected mapping.

Evidence

I built the risk engine (packages/core) so it doesn't know what "EU AI Act" means. It knows controls, evidence, and policy mappings. The regulation-specific part is a mapping layer on top, not baked into the primitives.

Source

That split matters because the alternative, hardcoding "Annex III" and "Article 5" into the core assessment logic, turns every new framework into a rewrite.

Source

Concretely: core has no HTTP dependency and no regulation-specific naming in its primitives. It evaluates controls and policy mappings, full stop. The CLI and services consume that engine and apply whichever mapping is loaded.

Source