NIST AI RMF ↔ EU AI Act ↔ ISO/IEC 42001 Crosswalk
Using this in a product? Commercial use is allowed under CC BY 4.0, with attribution. Ask about an SLA-backed feed or a white-label licence.
On this page 7 sections
In brief
The NIST AI RMF ↔ EU AI Act ↔ ISO/IEC 42001 Crosswalk is a free XLSX crosswalk for NIST AI RMF, EU AI Act and ISO/IEC 42001. Every recorded legal duty against the NIST AI RMF and ISO/IEC 42001 references it maps to, with the confidence of each mapping, so what is done for one counts for the others.
- Format
- XLSX · Crosswalk
- Version
- v9, built 12 Nov 2026
- Duties cited
- 119 from 23 instruments
- Rows from the records
- 304
- Frameworks
- NIST AI RMF, EU AI Act, ISO/IEC 42001
- Written for
- Deployer / user organisation, Provider / developer, Public authority / government body
- Price and licence
- Free · CC BY 4.0
What's inside
- Crosswalk sheet: duty, instrument, jurisdiction, NIST reference, ISO reference, confidence, record link
- Coverage sheet: mappings per instrument and framework
- Editorial mappings with a stated confidence, not official crosswalks
Preview
The sheets and sections of version v9, as built. Columns marked ▾ have a dropdown; ƒ is a formula.
Sheet: Crosswalk
| Legal duty | Instrument | Jurisdiction | Source reference | NIST AI RMF | Confidence | ISO/IEC 42001 | Confidence | Mapping note | Record |
|---|---|---|---|---|---|---|---|---|---|
| Establish accountability processes and a risk-management process (guardrails 1 and 2) | Australian Voluntary AI Safety Standard | Australia | Guardrails 1 and 2 | GOVERN and MAP | high | Clauses 5 and 6 | high | The standard states it is aligned with ISO/IEC 42001 and the NIST AI RMF. | Original editorial mapping. | https://aipolicytracker.org/obligations/australia-vaiss-accountability-and-risk-management |
| Test and monitor systems, enable human control, and be transparent with users (guardrails 4 to 6) | Australian Voluntary AI Safety Standard | Australia | Guardrails 4, 5 and 6 | MEASURE and MANAGE functions | medium | Original editorial mapping. | https://aipolicytracker.org/obligations/australia-vaiss-testing-human-control-transparency | ||
| Provide contestability, supply-chain transparency and records (guardrails 7 to 9) | Australian Voluntary AI Safety Standard | Australia | Guardrails 7, 8 and 9 | GOVERN 6.x | medium | Third-party risk. | https://aipolicytracker.org/obligations/australia-vaiss-contestability-supply-chain-records | ||
| Large frontier developers must publish a frontier AI framework | California SB 53 | California (United States) | Business and Professions Code, Chapter 25.1 (as added by SB 53) | GOVERN 1.x; NIST AI 600-1 | medium | Original editorial mapping. | https://aipolicytracker.org/obligations/us-california-sb-53-frontier-ai-framework | ||
| Report critical safety incidents to the Office of Emergency Services | California SB 53 | California (United States) | Business and Professions Code, Chapter 25.1 (as added by SB 53) | MANAGE 4.3 | medium | Incident response. | https://aipolicytracker.org/obligations/us-california-sb-53-critical-safety-incident-reporting | ||
| Frontier developers must publish a transparency report before deploying a new frontier model | California SB 53 | California (United States) | Business and Professions Code Section 22757.12 (as added by SB 53) | GOVERN 4.2, MAP 5.1, MEASURE 2.6 | medium | Annex A.8.2, A.8.3 | medium | Public documentation of intended use and safety evaluation. | System documentation and external reporting. | https://aipolicytracker.org/obligations/us-california-sb-53-transparency-report |
Editorial crosswalks with a stated confidence; they cite clause numbers only and reproduce no standard text.
Sheet: Coverage
| Instrument | Jurisdiction | Mapped duties | With NIST reference | With ISO reference |
|---|---|---|---|---|
| Australian Voluntary AI Safety Standard | Australia | 3 | 3 | 1 |
| California SB 53 | California (United States) | 5 | 5 | 3 |
| EU AI Act | European Union | 44 | 43 | 42 |
| India DPDP Act | India | 2 | 0 | 2 |
| India AI Governance Guidelines | India | 1 | 1 | 0 |
| Nepal Privacy Act 2075 | Nepal | 1 | 0 | 1 |
Sheet: ISO references
| ISO/IEC 42001 reference | Duties | Controls | Duties | Controls |
|---|---|---|---|---|
| Annex A.5.2, A.7.3 | 1 | 0 | Governmental entities must not use AI for biometric identification from public data without consent where it infringes rights (Texas Responsible AI Governance A | |
| Annex A.6.1.2, A.9.4 | 1 | 0 | Developers and deployers must not use AI with the intent to unlawfully discriminate against a protected class (Texas Responsible AI Governance Act (TRAIGA)) | |
| Annex A.6.2.4 | 0 | 2 | Accuracy, robustness, fairness and security testing; Adversarial and red-team testing for generative AI | |
| Annex A.6.2.4; Clause 9.2 | 1 | 0 | Employers and employment agencies must obtain an independent bias audit before using an automated employment decision tool (NYC Local Law 144 (automated employm | |
| Annex A.6.2.5, A.9.2, A.9.3 | 0 | 1 | Human oversight design and override procedure | |
| Annex A.6.2.7, A.8.2, A.10.4 | 1 | 0 | Providers of GPAI models must maintain technical documentation and inform downstream providers (EU AI Act) |
Sheet: NIST references
| NIST AI RMF reference | Duties | Controls | Duties | Controls |
|---|---|---|---|---|
| GOVERN 1.1, 1.2, 1.3, 2.1, 3.1 | 0 | 1 | AI governance policy and accountability structure | |
| GOVERN 1.1, GOVERN 2.1 | 1 | 0 | Providers must meet the full set of provider duties for high-risk AI (EU AI Act) | |
| GOVERN 1.1, MANAGE 1.3 | 2 | 0 | Law-enforcement deployers must obtain authorisation for post-remote biometric identification and report annually (EU AI Act); Deployers must use reasonable care | |
| GOVERN 1.1, MAP 1.1 | 3 | 0 | Do not deploy or provide AI for prohibited practices (EU AI Act); Providers of GPAI models must notify the Commission within two weeks of meeting the systemic-r | |
| GOVERN 1.1, MAP 1.1, MEASURE 2.6 | 1 | 0 | Developers and deployers must not use AI to incite self-harm, harm to others or crime (Texas Responsible AI Governance Act (TRAIGA)) | |
| GOVERN 1.1, MEASURE 2.6, MANAGE 2.3 | 1 | 0 | Developers and distributors must not build AI intended to produce child sexual abuse material or unlawful sexual deepfakes (Texas Responsible AI Governance Act |
How to use it
- 1Request the files. Enter your name, company and work email in the form on this page. The XLSX download links arrive by email and work for 7 days.
- 2Read the README page. It states the version (v9), the dataset it was built from and the licence, so anyone reviewing your copy knows which records it reflects.
- 3Check the duties against your situation. The "Crosswalk", "Coverage", "ISO references" and "NIST references" sheets list the recorded duties with their source references. Mark which apply to you and follow each link to the official text.
- 4Keep the evidence and watch for new versions. Link each completed row to the evidence that supports it. When the law on record changes, this template gets a new version and a changelog on this page.
Duties this template covers (119)
Each is cited in the file with its source reference and a link back to the record.
- Establish accountability processes and a risk-management process (guardrails 1 and 2)
- Test and monitor systems, enable human control, and be transparent with users (guardrails 4 to 6)
- Provide contestability, supply-chain transparency and records (guardrails 7 to 9)
- Give consumers a Pre-use Notice before using automated decision-making technology for a significant decision
- Let consumers opt out of automated decision-making technology for significant decisions, or offer a qualifying human appeal
- Answer consumers' requests to access information about how automated decision-making technology was used about them
- Conduct and document a risk assessment before processing that presents significant risk, including ADMT for significant decisions
- Submit risk assessment information to the California Privacy Protection Agency each year
- Large frontier developers must publish a frontier AI framework
- Report critical safety incidents to the Office of Emergency Services
- Frontier developers must publish a transparency report before deploying a new frontier model
- Large frontier developers must send periodic summaries of catastrophic-risk assessments to the state
Legal basis
Version history
| Version | Built | Dataset | What changed |
|---|---|---|---|
| v9 | bdc9006d9119 | Dataset ef1018b7a6a2 → bdc9006d9119. | |
| v8 | ef1018b7a6a2 | Dataset 14dd39dadf29 → ef1018b7a6a2. | |
| v7 | 14dd39dadf29 | Dataset f122253065a8 → 14dd39dadf29. | |
| v6 | f122253065a8 | Dataset 035e6f5a98a5 → f122253065a8. | |
| v5 | 035e6f5a98a5 | Dataset 4f72cc4c1954 → 035e6f5a98a5. | |
| v4 | 4f72cc4c1954 | Dataset 1e8ea28a8a93 → 4f72cc4c1954. | |
| v3 | 1e8ea28a8a93 | Dataset 3335c39da4b7 → 1e8ea28a8a93. | |
| v2 | 3335c39da4b7 | Dataset 7c0835db52c1 → 3335c39da4b7. Sheet "Crosswalk": 108 → 98 rows (-10). Sheet "Coverage": 17 → 16 rows (-1). Record citations: 108 → 98. | |
| v1 | 7c0835db52c1 | First version, built from dataset 7c0835db52c1. |
Only the latest version is served. A rebuild that changes the content adds a version; a rebuild that does not is skipped.
Frequently asked questions
What is in the NIST AI RMF ↔ EU AI Act ↔ ISO/IEC 42001 Crosswalk?
Crosswalk sheet: duty, instrument, jurisdiction, NIST reference, ISO reference, confidence, record link. Coverage sheet: mappings per instrument and framework. Editorial mappings with a stated confidence, not official crosswalks.
Which duties does it cite?
119 recorded duties from Australian Voluntary AI Safety Standard, California CPPA automated decision-making rules, California SB 53 and Colorado ADMT law (SB 26-189), including Guardrails 1 and 2, Guardrails 4, 5 and 6, Guardrails 7, 8 and 9, Cal. Code Regs. tit. 11, § 7220, Cal. Code Regs. tit. 11, § 7221 and Cal. Code Regs. tit. 11, § 7222. Each row links to the record, and the record to the official source.
Who is it for?
The duties it cites fall on deployer / user organisation, provider / developer and public authority / government body. Whoever owns AI governance for those roles usually completes it, with the system owner supplying the facts.
Is it free?
Yes. Request the XLSX with your work email on this page; the download links arrive by email, valid for 7 days. No account and no charge. Licensed CC BY 4.0. You may use, adapt and share this template, including commercially, with attribution to aipolicytracker.org.
How will I know when it changes?
Version v9 was built on 12 November 2026. The library is rebuilt daily; when a change to the records reaches this template it gets the next version, a changelog below and an entry in the templates feed.
Is there a self-assessment that goes with it?
Yes: the ISO/IEC 42001 Readiness Assessment (23 questions, about 6 minutes) and the NIST AI Risk Management Framework Assessment (22 questions, about 6 minutes). They are free and run on Certifyi, a related product. A score is a self-check, not an audit; this template is where the work it points to gets written down.
Does completing it make us compliant?
No. It is an informational resource, not legal advice; it helps produce the evidence a regulator, customer or auditor asks for. Whether a duty applies to you is a judgement the template cannot make.
Disclaimer: informational only, not legal advice. Verify every claim against the linked official sources and consult a qualified lawyer before acting.