# NIST AI RMF โ†” EU AI Act โ†” ISO/IEC 42001 Crosswalk - **Type**: Template (Crosswalk) - **Page**: https://aipolicytracker.org/templates/nist-eu-iso-crosswalk - **Formats**: XLSX - **Current version**: v9, built 2026-11-12 Every recorded legal duty against the NIST AI RMF and ISO/IEC 42001 references it maps to, with the confidence of each mapping, so what is done for one counts for the others. ## What is inside - Crosswalk sheet: duty, instrument, jurisdiction, NIST reference, ISO reference, confidence, record link - Coverage sheet: mappings per instrument and framework - Editorial mappings with a stated confidence, not official crosswalks ## Laws and frameworks it is built from - EU AI Act (European Union), Pending review ยท source-linked, checked 26 Sep 2026: https://aipolicytracker.org/policies/eu-ai-act - NIST AI RMF (United States), Verified against the official source 26 Sep 2026: https://aipolicytracker.org/policies/us-nist-ai-rmf ## Recorded duties it covers - Establish accountability processes and a risk-management process (guardrails 1 and 2) (Australian Voluntary AI Safety Standard): https://aipolicytracker.org/obligations/australia-vaiss-accountability-and-risk-management - Test and monitor systems, enable human control, and be transparent with users (guardrails 4 to 6) (Australian Voluntary AI Safety Standard): https://aipolicytracker.org/obligations/australia-vaiss-testing-human-control-transparency - Provide contestability, supply-chain transparency and records (guardrails 7 to 9) (Australian Voluntary AI Safety Standard): https://aipolicytracker.org/obligations/australia-vaiss-contestability-supply-chain-records - Give consumers a Pre-use Notice before using automated decision-making technology for a significant decision (California CPPA automated decision-making rules): https://aipolicytracker.org/obligations/us-california-ccpa-admt-pre-use-notice - Let consumers opt out of automated decision-making technology for significant decisions, or offer a qualifying human appeal (California CPPA automated decision-making rules): https://aipolicytracker.org/obligations/us-california-ccpa-admt-opt-out - Answer consumers' requests to access information about how automated decision-making technology was used about them (California CPPA automated decision-making rules): https://aipolicytracker.org/obligations/us-california-ccpa-admt-access - Conduct and document a risk assessment before processing that presents significant risk, including ADMT for significant decisions (California CPPA automated decision-making rules): https://aipolicytracker.org/obligations/us-california-ccpa-risk-assessment - Submit risk assessment information to the California Privacy Protection Agency each year (California CPPA automated decision-making rules): https://aipolicytracker.org/obligations/us-california-ccpa-risk-assessment-submission - Large frontier developers must publish a frontier AI framework (California SB 53): https://aipolicytracker.org/obligations/us-california-sb-53-frontier-ai-framework - Report critical safety incidents to the Office of Emergency Services (California SB 53): https://aipolicytracker.org/obligations/us-california-sb-53-critical-safety-incident-reporting - Frontier developers must publish a transparency report before deploying a new frontier model (California SB 53): https://aipolicytracker.org/obligations/us-california-sb-53-transparency-report - Large frontier developers must send periodic summaries of catastrophic-risk assessments to the state (California SB 53): https://aipolicytracker.org/obligations/us-california-sb-53-catastrophic-risk-assessment-summaries - Frontier developers must protect employees who report catastrophic-risk concerns (California SB 53): https://aipolicytracker.org/obligations/us-california-sb-53-whistleblower-protections - Notify consumers before automated decision-making technology influences a consequential decision (Colorado ADMT law (SB 26-189)): https://aipolicytracker.org/obligations/us-colorado-admt-advance-notice - Disclose the use of the technology and the principal reasons after an adverse consequential decision (Colorado ADMT law (SB 26-189)): https://aipolicytracker.org/obligations/us-colorado-admt-adverse-decision-disclosure - Offer meaningful human review of an adverse consequential decision (Colorado ADMT law (SB 26-189)): https://aipolicytracker.org/obligations/us-colorado-admt-human-review - Keep records of consequential decisions influenced by the technology for three years (Colorado ADMT law (SB 26-189)): https://aipolicytracker.org/obligations/us-colorado-admt-record-keeping - Developers must supply deployers with documentation of the technology (Colorado ADMT law (SB 26-189)): https://aipolicytracker.org/obligations/us-colorado-admt-developer-documentation - Do not deploy or provide AI for prohibited practices (EU AI Act): https://aipolicytracker.org/obligations/eu-ai-act-prohibited-practices - Ensure AI literacy of staff operating AI systems (EU AI Act): https://aipolicytracker.org/obligations/eu-ai-act-ai-literacy - Establish a risk management system for high-risk AI (EU AI Act): https://aipolicytracker.org/obligations/eu-ai-act-risk-management-system - Apply data governance and quality criteria to training, validation and testing data (EU AI Act): https://aipolicytracker.org/obligations/eu-ai-act-data-governance - Draw up technical documentation before placing a high-risk system on the market (EU AI Act): https://aipolicytracker.org/obligations/eu-ai-act-technical-documentation - Design high-risk systems to log events automatically (EU AI Act): https://aipolicytracker.org/obligations/eu-ai-act-record-keeping - Provide deployers with clear instructions for use (EU AI Act): https://aipolicytracker.org/obligations/eu-ai-act-transparency-to-deployers - Enable and assign effective human oversight (EU AI Act): https://aipolicytracker.org/obligations/eu-ai-act-human-oversight - Achieve appropriate accuracy, robustness and cybersecurity (EU AI Act): https://aipolicytracker.org/obligations/eu-ai-act-accuracy-robustness-cybersecurity - Operate a quality management system (EU AI Act): https://aipolicytracker.org/obligations/eu-ai-act-quality-management-system - Complete conformity assessment, CE marking and EU database registration (EU AI Act): https://aipolicytracker.org/obligations/eu-ai-act-conformity-assessment-registration - Use high-risk AI as instructed, monitor it and inform affected people (EU AI Act): https://aipolicytracker.org/obligations/eu-ai-act-deployer-obligations - Carry out a fundamental rights impact assessment before deployment (EU AI Act): https://aipolicytracker.org/obligations/eu-ai-act-fundamental-rights-impact-assessment - Disclose AI interaction and label synthetic content (EU AI Act): https://aipolicytracker.org/obligations/eu-ai-act-transparency-article-50 - Meet general-purpose AI model provider obligations (EU AI Act): https://aipolicytracker.org/obligations/eu-ai-act-gpai-provider-obligations - Manage systemic risk for high-impact general-purpose models (EU AI Act): https://aipolicytracker.org/obligations/eu-ai-act-gpai-systemic-risk - Operate a post-market monitoring system (EU AI Act): https://aipolicytracker.org/obligations/eu-ai-act-post-market-monitoring - Report serious incidents to market surveillance authorities (EU AI Act): https://aipolicytracker.org/obligations/eu-ai-act-serious-incident-reporting - Verify conformity before importing or distributing high-risk AI (EU AI Act): https://aipolicytracker.org/obligations/eu-ai-act-importer-distributor-obligations - Providers must meet the full set of provider duties for high-risk AI (EU AI Act): https://aipolicytracker.org/obligations/eu-ai-act-art-16-provider-obligations - Providers must keep high-risk AI documentation for ten years (EU AI Act): https://aipolicytracker.org/obligations/eu-ai-act-art-18-documentation-keeping - Providers must retain automatically generated logs under their control (EU AI Act): https://aipolicytracker.org/obligations/eu-ai-act-art-19-provider-log-retention ## Latest changes Dataset ef1018b7a6a2 โ†’ bdc9006d9119. - **Retrieved**: 2026-11-12 - **Licence**: https://creativecommons.org/licenses/by/4.0/ > Built from structured summaries of official texts. Not legal advice. A record whose review status is not "verified" has not been confirmed against its official source by a named reviewer; open the official source before relying on any date or duty. How records are verified: https://aipolicytracker.org/verification.