Crosswalk
Which requirement sits where.
A theme-level map between the EU AI Act, the NIST AI RMF and ISO/IEC 42001, with optional United States, United Kingdom and India columns. Use it to reuse one piece of work across frameworks.
For reference purposes only. Not legal advice.
SimplifiedIllustrative theme-level mapping. It is not an official mapping from any standards body or regulator. References were not individually checked against the consolidated EU text or the ISO clause structure. The US, UK and India columns are short summaries written from the regional pages and were not individually checked against the primary texts; treat every entry in them as Verify.Source: EU AI Act, Regulation (EU) 2024/1689 · Checked 2 Oct 2026
| Theme | EU AI Act | NIST AI RMF | ISO/IEC 42001 | United States Verify | United Kingdom Verify | India Verify | Evidence |
|---|---|---|---|---|---|---|---|
| Governance and accountability Verify SimplifiedIllustrative theme-level mapping. It is not an official mapping from any standards body or regulator. References were not individually checked against the consolidated EU text or the ISO clause structure. The US, UK and India columns are short summaries written from the regional pages and were not individually checked against the primary texts; treat every entry in them as Verify. | Quality management system (Art. 17) | Govern | Leadership (clause 5) and roles | NIST AI RMF "Govern" (voluntary). Some state laws require a risk management programme for specified uses, for example Colorado. | Accountability and governance principle in the 2023 white paper. Existing regulators apply it; there is no AI statute. | Accountability principle in the India AI Governance Guidelines (MeitY). | AI policy and approvals |
| Risk management Verify SimplifiedIllustrative theme-level mapping. It is not an official mapping from any standards body or regulator. References were not individually checked against the consolidated EU text or the ISO clause structure. The US, UK and India columns are short summaries written from the regional pages and were not individually checked against the primary texts; treat every entry in them as Verify. | Risk management system (Art. 9) | Map, Measure, Manage | Planning (clause 6), AI risk assessment and treatment | NIST AI RMF "Map, Measure, Manage". State impact assessment duties for high-risk decisions, for example Colorado. | Safety, security and robustness principle. UK GDPR data protection impact assessments for high-risk processing. | Risk-based approach in the MeitY guidelines. DPDP Act duties for significant data fiduciaries. | Risk assessments |
| Data governance Verify SimplifiedIllustrative theme-level mapping. It is not an official mapping from any standards body or regulator. References were not individually checked against the consolidated EU text or the ISO clause structure. The US, UK and India columns are short summaries written from the regional pages and were not individually checked against the primary texts; treat every entry in them as Verify. | Data and data governance (Art. 10) | Map, Measure | Operation (clause 8) and data-related Annex A controls | State privacy laws and FTC action on unfair or deceptive data practices. | UK GDPR and Data Protection Act 2018: lawfulness, minimisation, accuracy. | DPDP Act 2023 and DPDP Rules 2025: consent and purpose limits. | Data governance records |
| Documentation and records Verify SimplifiedIllustrative theme-level mapping. It is not an official mapping from any standards body or regulator. References were not individually checked against the consolidated EU text or the ISO clause structure. The US, UK and India columns are short summaries written from the regional pages and were not individually checked against the primary texts; treat every entry in them as Verify. | Technical documentation (Art. 11), record-keeping (Art. 12) | Govern, Map | Documented information (clause 7.5) | Record duties vary by state law. NIST AI RMF documentation practices. | UK GDPR accountability and records of processing. | DPDP Act notice and record duties. Sector rules such as the RBI FREE-AI framework. | Technical documentationLogs and monitoring records |
| Transparency and information Verify SimplifiedIllustrative theme-level mapping. It is not an official mapping from any standards body or regulator. References were not individually checked against the consolidated EU text or the ISO clause structure. The US, UK and India columns are short summaries written from the regional pages and were not individually checked against the primary texts; treat every entry in them as Verify. | Information for deployers (Art. 13), transparency duties (Art. 50) | Map, Measure | Annex A controls on information for interested parties | State disclosure laws, for example Illinois employment notices and California frontier AI transparency for large developers. | Transparency and explainability principle. UK GDPR transparency duties. | IT Rules amendments on labelling synthetic content. ASCI draft guidelines on labelling AI advertising. | Notices and disclosures |
| Human oversight Verify SimplifiedIllustrative theme-level mapping. It is not an official mapping from any standards body or regulator. References were not individually checked against the consolidated EU text or the ISO clause structure. The US, UK and India columns are short summaries written from the regional pages and were not individually checked against the primary texts; treat every entry in them as Verify. | Human oversight (Art. 14) | Govern, Manage | Annex A controls on responsible use of AI systems | State rules on review or appeal of automated decisions, for example Colorado. Scope needs checking. | UK GDPR safeguards for automated decisions as amended by the Data (Use and Access) Act 2025. Contestability and redress principle. | "People first" principle in the MeitY guidelines. | Human oversight procedures |
| Accuracy, robustness, security Verify SimplifiedIllustrative theme-level mapping. It is not an official mapping from any standards body or regulator. References were not individually checked against the consolidated EU text or the ISO clause structure. The US, UK and India columns are short summaries written from the regional pages and were not individually checked against the primary texts; treat every entry in them as Verify. | Accuracy, robustness and cybersecurity (Art. 15) | Measure | Operation (clause 8) | NIST AI RMF "Measure". California frontier AI safety duties for large developers. | Safety, security and robustness principle. AI Security Institute evaluations of advanced models. | Safety and resilience principle. RBI FREE-AI model risk expectations. | Testing and validation reports |
| Monitoring and incidents Verify SimplifiedIllustrative theme-level mapping. It is not an official mapping from any standards body or regulator. References were not individually checked against the consolidated EU text or the ISO clause structure. The US, UK and India columns are short summaries written from the regional pages and were not individually checked against the primary texts; treat every entry in them as Verify. | Post-market monitoring (Art. 72), serious-incident reporting (Art. 73) | Manage | Performance evaluation (clause 9), improvement (clause 10) | NIST AI RMF "Manage". Incident reporting duties for frontier developers under some state laws, for example California and New York. | UK GDPR personal data breach reporting to the ICO. Sector regulator expectations. | DPDP breach intimation duties. CERT-In incident reporting directions. | Logs and monitoring recordsIncident log and reports |
| Third parties and suppliers Verify SimplifiedIllustrative theme-level mapping. It is not an official mapping from any standards body or regulator. References were not individually checked against the consolidated EU text or the ISO clause structure. The US, UK and India columns are short summaries written from the regional pages and were not individually checked against the primary texts; treat every entry in them as Verify. | Responsibilities along the AI value chain (Art. 25) | Govern | Annex A controls on third-party and customer relationships | OMB memoranda for federal agency procurement. Contract allocation of duties under state law. | UK GDPR controller and processor contracts. | DPDP data processor arrangements. RBI outsourcing expectations for regulated entities. | Vendor due diligence |
| Competence and training Verify Not settledArticle 4 (AI literacy) is touched by the Digital Omnibus on AI. Check the current wording before relying on this reference. | AI literacy (Art. 4) | Govern | Competence (clause 7.2) | NIST AI RMF "Govern" (workforce). No general federal AI literacy duty. | No statutory AI literacy duty. Regulator guidance. | Capacity building recommended in the MeitY guidelines. | Staff training records |
Illustrative theme-level mapping. It is not an official mapping from any standards body or regulator. The United States, United Kingdom and India columns are short summaries that were not individually checked against primary texts, so each carries a Verify flag. ISO/IEC 42001 references use clause numbers and short descriptions only; use your licensed copy of the standard.
Reviewed 2 Oct 2026. Sources: EU AI Act, Regulation (EU) 2024/1689; NIST AI Risk Management Framework; ISO/IEC 42001 standard page.
Was this page useful? Tell us what is missing or wrong ↗ · Report a correction