title: “Framework Mappings” description: “How the AIGO Framework maps to external AI governance and regulatory frameworks.”
Framework Mappings
AIGO provides structured mappings that help organizations understand how the AIGO Framework relates to external AI governance frameworks, standards, and regulatory requirements. Mappings are an implementation and traceability capability. They provide relationships between AIGO governance concepts and external sources without changing the normative AIGO Framework itself.Purpose
Mappings can help organizations: * understand relationships between AIGO and external frameworks * identify potentially relevant requirements * support gap analysis * plan implementation activities * identify control relationships * support evidence planning * support assurance activities * maintain cross-framework traceability * reduce duplicate governance work where appropriate Mappings should be interpreted within the scope and authority of the external source being mapped.Current mappings
The AIGO repository currently provides mapping material for: * European Union AI Act * ISO/IEC 42001 * NIST AI Risk Management Framework * cross-framework relationships The mapping collection may evolve independently from the AIGO Framework baseline as external frameworks, standards, regulations, and interpretations change.Mapping principles
AIGO mappings should be understood according to several principles.Relationship, not equivalence
A mapping identifies a relationship between AIGO and an external source. It does not mean that: * two requirements are legally identical * two controls have identical scope * satisfying one requirement automatically satisfies another * an AIGO control automatically establishes regulatory compliance * an external framework is fully implemented merely because a mapping exists The organization remains responsible for determining how applicable external requirements apply to its specific circumstances.Interpretive nature
Mappings may require interpretation because external frameworks can differ in: * scope * terminology * structure * authority * applicability * implementation expectations * jurisdiction * regulatory status * certification requirements A mapping should therefore be treated as an implementation aid rather than as a legal interpretation.Source authority
Where a mapping relates to legislation, regulation, standards, or other authoritative requirements, the authoritative external source takes precedence over the AIGO mapping. Organizations should verify applicable requirements against the current authoritative source before making: * legal decisions * regulatory decisions * contractual commitments * certification decisions * compliance claimsMapping layers
Mappings can relate AIGO information to external sources at different levels. These may include:Framework concepts
Relationships between high-level governance concepts. For example: AIGO governance → external governance requirementLifecycle activities
Relationships between AIGO lifecycle activities and external lifecycle expectations. For example: AIGO risk assessment → external risk-management expectationControls
Relationships between AIGO controls and external requirements or control objectives. For example: AIGO control → external control requirementEvidence
Relationships between AIGO evidence expectations and external evidence or documentation requirements.Assurance
Relationships between AIGO assurance activities and external assurance, review, or conformity expectations. The appropriate mapping level depends on the external source and the purpose of the mapping.Mapping and implementation
Mappings can be used as an input to implementation planning. A typical implementation relationship is: external requirement → AIGO mapping → applicable AIGO governance activity → control → evidence → assessment → assurance This allows an organization to use AIGO as an operational governance structure while maintaining traceability to relevant external sources. The mapping itself should not be treated as evidence that the mapped requirement has been satisfied.Mapping and controls
Mappings can help identify which AIGO controls may contribute to addressing an external requirement. A mapped control may: * directly address part of a requirement * contribute to a requirement * support implementation of a requirement * provide evidence relevant to a requirement * require additional organization-specific measures The exact relationship should be interpreted according to the mapping content and the authoritative external source.Mapping and evidence
Mappings can support evidence planning by identifying where existing AIGO governance records may provide information relevant to external requirements. Potential evidence relationships include: * AI system records * risk assessments * control assessments * approvals * monitoring records * incident records * change records * assurance records * improvement records * governance decisions However, the existence of an AIGO record does not automatically demonstrate satisfaction of an external requirement. Evidence sufficiency must be assessed against the applicable external requirement and organizational context.Mapping and evaluation
AIGO’s machine-readable evaluation architecture can potentially use mapping information as governance context. The conceptual relationship is: external requirement → mapping → AIGO requirement / control → rule → evaluation → result Where such evaluation is implemented, the resulting evaluation should be understood as an assessment against defined machine-readable conditions. It should not automatically be interpreted as a legal conclusion or certification of compliance.Cross-framework mappings
Organizations may need to operate against multiple frameworks simultaneously. Cross-framework relationships can help identify areas where frameworks have overlapping governance objectives. For example: EU AI Act ↔ AIGO ↔ ISO/IEC 42001 ↔ NIST AI RMF These relationships can help organizations identify common governance activities and reduce unnecessary duplication. However, overlapping concepts do not necessarily have identical scope or legal effect.Maintaining mappings
External requirements can change independently from AIGO. Mapping maintenance should therefore consider: * new external requirements * amendments * revised standards * updated guidance * changes in terminology * changes in applicability * changes in regulatory interpretation * withdrawn or superseded requirements Mapping updates should preserve version and source traceability where applicable. A mapping should identify or otherwise make clear the external source against which the relationship was established.Mapping governance
Mappings should themselves be governed. Organizations maintaining or relying on mappings should consider: * mapping ownership * review frequency * source verification * change management * version control * approval * evidence supporting mapping decisions * treatment of ambiguous relationships This helps prevent outdated or unsupported mappings from becoming embedded in governance decisions.Limitations
AIGO mappings do not by themselves provide: * legal advice * regulatory interpretation * certification * accreditation * conformity assessment * a guarantee of compliance * a guarantee that all external requirements are covered The organization using AIGO remains responsible for determining the requirements applicable to its AI systems and governance activities.Canonical source
The complete mapping packages are maintained in:mappings/
The mapping repository content provides the detailed relationships between AIGO and the applicable external frameworks and regulatory sources.
This documentation is the authoritative user-facing source for the complete version-controlled mapping content.
Before using a mapping for a legal, regulatory, contractual, or certification decision, verify the relevant external source and its current version.