Governing AI Risk with NIST and the EU AI Act