AI governance
Three AI governance regimes, judged against each other control by control. If you have done ISO/IEC 42001, some of the EU AI Act is already answered. It is not most of it, and this page says which parts and how many.
Read a row as: holding the first, this much of the second is already evidenced. The reverse direction is a different number, usually very different, and both are shown because that difference is the useful part.
ISO/IEC 42001 has 38 requirements. Holding NIST AI RMF already evidences 30 of them, leaving 8 to do.
See every control and the reasoning behind each claim
NIST AI RMF has 72 requirements. Holding EU AI Act already evidences 48 of them, leaving 24 to do. 72 candidate mappings were examined and 10 were rejected in review.
See every control and the reasoning behind each claim
ISO/IEC 42001 has 38 requirements. Holding EU AI Act already evidences 22 of them, leaving 16 to do.
See every control and the reasoning behind each claim
NIST AI RMF has 72 requirements. Holding ISO/IEC 42001 already evidences 34 of them, leaving 38 to do.
See every control and the reasoning behind each claim
EU AI Act has 43 requirements. Holding ISO/IEC 42001 already evidences 17 of them, leaving 26 to do.
See every control and the reasoning behind each claim
EU AI Act has 43 requirements. Holding NIST AI RMF already evidences 11 of them, leaving 32 to do. 41 candidate mappings were examined and 9 were rejected in review.
See every control and the reasoning behind each claim
Look at the bottom of that list rather than the top. A management-system standard tells you to govern AI; the EU AI Act tells you what to do about a specific high-risk system. The first does not buy much of the second, and any tool claiming otherwise has not read both.
A mapping is a judgement, so it shows what grounds it: the control text on both sides, who judged it, when, and whether it survived a pass that argued against it.
42,246 claims across the graph were argued against, rejected, and kept with the reason on each. When a standard moves, what we withdrew is as informative as what we kept.
Each of these three frameworks carries a control count checked against the issued document, so a percentage is over a real total rather than an editorial grouping.
A crosswalk narrows the work. It is not an assessment, it does not make an organisation compliant, and no tool can.
Every number on this page is queryable without an account. An agent can call agent_coverage_crosswalk for the headline, agent_crosswalk_provenance for the reasoning, and agent_crosswalk_refuted for what was rejected.