Framework to framework
Rows are the Deployer Baseline controls. Columns are the instruments they map to. Mappings are editorial judgments maintained by the Commons; verify against the primary text before relying on them.
| Control | ISO/IEC 42001 | NIST AI RMF | EU AI Act | US state laws | Other |
|---|---|---|---|---|---|
| B1 Accountability and governance structure | Clause 5; A.2; A.3 | Govern | Art. 4; Art. 26 | TRAIGA safe harbor | Thai draft deployer duties |
| B2 AI inventory | A.4; A.6.2.7 | Map | Art. 26; Art. 50 | Colorado SB 26-189 | Korea operator duties |
| B3 Acceptable use and AI literacy | Clause 7.2, 7.3; A.4.6 | Govern | Art. 4 | Thai draft oversight-staff duty | |
| B4 Use-case screening and risk classification | Clause 6.1; A.5 | Map; Govern | Art. 5; Art. 6; Annex III | TRAIGA prohibited uses; Colorado high-risk definition; NYC LL144 | |
| B5 Third-party and vendor AI management | A.10 | Govern 6; Map 4 | Art. 25; Art. 26 | HAIP 2.0 deployer questions | |
| B6 Data governance for AI use | A.7 | Map; Measure | GDPR; Art. 26 | CPPA ADMT rules | Korea |
| B7 Human oversight of consequential decisions | A.9; A.6.2.6 | Manage | Art. 14; Art. 26(2) | Colorado; Illinois HB 3773; NYC LL144; CPPA ADMT; TRAIGA | |
| B8 Transparency to people | A.8 | Govern; Map | Art. 50 | California bot and transparency laws; TRAIGA government disclosure; Colorado | Korea labelling |
| B9 Monitoring, logging, and performance review | A.6.2.6; A.6.2.8 | Measure; Manage | Art. 26(5), (6); Art. 12 | Thai draft six-month logs | |
| B10 Incident management and reporting | A.8.4 | Manage | Art. 73; Art. 26(5) | TRAIGA cure process | Insurer remediation record |
| B11 Security of AI systems | A.6.2.4; ISO 27001 controls | Cyber AI Profile | Art. 15; Art. 26 | OWASP LLM Top 10; CSA AICM | |
| B12 Fairness and impact assessment for higher-risk uses | A.5; ISO 42005 | Map 5; Measure 2 | Art. 27; Annex III | NYC LL144; Colorado; Illinois | |
| B13 Records and evidence | Clause 7.5; A.6.2.7 | Govern | Art. 26; Art. 12 | AB 1405 record expectations | Insurer documentation requests |
| B14 Periodic review and improvement | Clauses 9, 10 | Govern 1.5; Manage | HAIP annual update | ||
| B15 Synthetic content provenance | Art. 50(4); transparency Code | California AI Transparency Act (providers); platform duties | Korea and China labelling; C2PA; India IT Rules |
Download: JSON · CSV. Suggest a mapping change from the correction form.