title: “Cross-Framework Mapping” description: “How AIGO relates to the EU AI Act, ISO/IEC 42001, and NIST AI RMF.”
Cross-Framework Mapping
The AIGO cross-framework mapping provides a structured view of relationships among AIGO and selected external AI governance, regulatory, and risk-management frameworks. It is intended to help organizations maintain a coherent internal governance operating model while preserving traceability to framework-specific requirements and expectations.Purpose
Organizations may need to operate against multiple frameworks simultaneously. The cross-framework mapping can help organizations: * identify related governance concepts * align internal controls * connect requirements to evidence * support implementation planning * reduce duplicated governance activity * support assurance planning * perform gap analysis * maintain cross-framework traceability * identify differences between external requirements The mapping is an analytical and implementation aid. It does not replace the underlying authoritative sources.Current frameworks
The AIGO v0.1 cross-framework model considers: * AIGO Framework * European Union Artificial Intelligence Act * ISO/IEC 42001 * NIST AI Risk Management Framework Each framework has a different purpose and authority. AIGO provides the internal governance model. The EU AI Act provides applicable legal requirements where relevant. ISO/IEC 42001 provides requirements for an AI management system. NIST AI RMF provides a risk-management framework. These distinctions should be preserved throughout implementation.Why cross-framework mapping matters
An organization may otherwise create separate governance processes for each framework. For example, the same AI system might be subject to: * internal AI governance requirements * EU AI Act obligations * an AI management system * NIST AI RMF practices * contractual requirements * organizational policies Without a common governance model, this can lead to duplicated assessments, controls, evidence, approvals, and assurance activities. AIGO can provide an operational governance layer while maintaining relationships to the different external frameworks. A simplified model is: external requirements → mappings → AIGO governance → controls → evidence → assessment → assuranceShared concepts
Cross-framework relationships may involve areas such as: * governance * accountability * risk management * AI system lifecycle * controls * documentation * evidence * monitoring * transparency * assurance * incident management * change management * continual improvement These concepts may appear across multiple frameworks, but their meaning and requirements may differ. The presence of a relationship therefore indicates an analytical connection rather than identical requirements.Framework-specific authority
The underlying sources retain their own authority. For example: EU AI Act The applicable legal requirements are determined by the AI Act and relevant authoritative interpretation. ISO/IEC 42001 The applicable management-system requirements are determined by the standard and the organization’s defined management-system scope. NIST AI RMF The applicable risk-management practices are determined by the organization’s intended use of the framework and relevant NIST materials. AIGO The AIGO Framework defines its own governance model, controls, schemas, guidance, and implementation architecture. A mapping connects these models without merging their authority.Anti-equivalence principle
A shared mapping relationship does not mean that two requirements are interchangeable. AIGO intentionally preserves differences in: * authority * scope * terminology * applicability * obligation type * implementation expectations * control expectations * evidence requirements * assurance requirements * interpretation Therefore: mapped ≠ equivalent and: AIGO control ≠ automatic satisfaction of external requirement Organizations must evaluate each applicable external requirement independently.Using AIGO as an internal operating layer
A practical multi-framework architecture can use AIGO as the internal governance operating layer. For example: External frameworks → EU AI Act → ISO/IEC 42001 → NIST AI RMF Mapping layer → AIGO cross-framework mappings Internal governance layer → AIGO governance → AIGO lifecycle → AIGO controls → AIGO records → AIGO evidence → AIGO assessment → AIGO approval → AIGO monitoring → AIGO assurance Organization → policies → procedures → decisions → remediation → continual improvement This approach allows one internal governance process to support multiple external relationships without treating the external frameworks as interchangeable.Example governance relationship
A single AI system may have several applicable governance relationships. For example: AI system → AIGO classification → AIGO risk assessment → AIGO controls → evidence → assessment → approval → monitoring → assurance At the same time, those governance records may be mapped to: * relevant EU AI Act requirements * relevant ISO/IEC 42001 requirements * relevant NIST AI RMF categories * internal organizational requirements This creates multiple traceability paths from a common governance record.Requirements traceability
Cross-framework mapping can provide a relationship such as: external requirement → mapping → AIGO control → evidence → assessment → assurance Where multiple frameworks relate to the same governance activity, several requirements may point to the same AIGO control or evidence source. This can reduce unnecessary duplication while preserving the individual framework relationships. However, organizations should verify that shared evidence actually satisfies the specific scope and quality requirements of each applicable framework.Control alignment
AIGO controls can act as an internal governance control layer. A cross-framework mapping may identify: * controls that support multiple frameworks * controls that support only one framework * controls requiring additional implementation * gaps where no AIGO control currently provides sufficient coverage * requirements requiring organization-specific procedures or evidence The purpose is not to force every external requirement into an AIGO control. Where an external requirement requires additional organizational measures, those measures should be maintained explicitly.Evidence alignment
Evidence can often support multiple governance purposes. For example, one governance record may provide evidence relevant to: * an AIGO control assessment * an ISO/IEC 42001 management-system activity * a NIST AI RMF practice * an EU AI Act implementation activity However, shared evidence should be evaluated against each applicable requirement. The existence of one evidence artifact does not automatically establish that all mapped requirements have been satisfied. A useful relationship is: requirement → control → evidence → assessment with multiple requirements potentially referencing the same underlying evidence.Gap analysis
Cross-framework mapping can support structured gap analysis. A gap analysis may identify: 1. external requirement 2. applicable scope 3. mapped AIGO activity or control 4. current implementation status 5. available evidence 6. identified gap 7. remediation action 8. responsible owner 9. target date 10. verification or assurance This provides a practical bridge between framework mapping and implementation management.Assurance across frameworks
Cross-framework mapping can also support assurance planning. Assurance activities may examine whether: * applicable requirements have been identified * mapped controls are implemented * evidence is sufficient * governance activities operate as intended * gaps have been addressed * framework-specific obligations remain traceable * changes have affected previous conclusions Assurance should preserve the distinction between: internal governance effectiveness and: external conformity or legal compliance The first can be supported by AIGO assurance activities. The second depends on the applicable external framework and assessment process.Evaluation and automation
AIGO’s machine-readable evaluation layer can provide an additional technical layer for cross-framework governance. A conceptual architecture is: external requirement → mapping → governance condition → AIGO rule → evaluation → result This can support automated or semi-automated checks of defined governance conditions. Evaluation results should remain distinguishable from legal or formal conformity determinations. Where interpretation or professional judgment is required, human review remains part of the governance process.Mapping architecture
The repository separates cross-framework mapping concerns into dedicated materials. The cross-framework package includes perspectives such as: * mapping architecture * requirements relationships * control relationships * evidence relationships * assurance relationships * gap and coverage analysis This allows users to examine mappings at different levels rather than relying on a single high-level mapping table.Maintenance
External frameworks and regulatory requirements can change independently of AIGO. Cross-framework mappings should therefore be reviewed when: * an external framework changes * AIGO requirements change * AIGO controls change * regulatory applicability changes * organizational AI use changes * mapping assumptions change * new evidence requirements emerge * assurance findings identify mapping deficiencies Mapping updates should preserve appropriate version and source traceability.Important limitation
Cross-framework mappings are analytical and implementation-oriented materials. They do not: * establish legal compliance * provide legal advice * establish certification * establish accreditation * establish conformity assessment * guarantee achievement of an external framework outcome * imply endorsement by an external standards organization or regulator * make different frameworks legally or operationally equivalent Organizations remain responsible for determining their applicable legal, regulatory, contractual, standards, and certification obligations. The authoritative external source should always be consulted when making decisions based on an external requirement.Canonical source
The complete cross-framework package is maintained in:mappings/cross-framework/
The repository is the canonical source for the AIGO-controlled cross-framework mapping artifacts.
The mapping should be interpreted together with the current authoritative sources for each external framework.