Regulatory crosswalkSample mappings

Control areas mapped to external frameworks

Each control area carries named clause linkage. Coverage counts state how many of the 5 domains hold evidence that is missing, stale, or overdue for that control area today.

Framework

Control area	EU AI Act Regulation (EU) 2024/1689, high-risk obligations	NIST AI RMF AI RMF 1.0 functions and subcategories	ISO/IEC 42001 AI management system requirements and Annex A	US supervisory Sector rules applied by the entity	Evidence gap
Policy Column mean 48	Art. 17 · Quality management system	GOVERN 1.1 · Policies and procedures	§5.2 · AI policy	SR 11-7 §III · Governance ECOA · Reg B §1002.9	1 of 5 Domains without current evidence
Access Column mean 36	Art. 15 · Accuracy, robustness, cybersecurity	GOVERN 6.1 · Access and role definition	§A.4.3 · Resource documentation	GLBA Safeguards §314.4(c)	0 of 5 Domains without current evidence
Testing Column mean 71	Art. 9 · Risk management system Art. 10 · Data and data governance	MEASURE 2.11 · Fairness and bias evaluation	§A.6.2.4 · Verification and validation	ECOA · Reg B §1002.6 EEOC UGESP §1607.4(D)	1 of 5 Domains without current evidence
Monitoring Column mean 62	Art. 72 · Post-market monitoring Art. 12 · Record keeping	MEASURE 2.12 · Ongoing monitoring	§A.6.2.6 · Operation and monitoring	SR 11-7 §V · Ongoing monitoring	2 of 5 Domains without current evidence
Human Oversight Column mean 57	Art. 14 · Human oversight	GOVERN 3.2 · Human and AI configuration	§A.9.2 · Responsible use and oversight	ECOA · Reg B §1002.9 · Adverse action review	2 of 5 Domains without current evidence
Documentation Column mean 62	Art. 11 · Technical documentation	MAP 1.1 · Context and system documentation	§A.6.2.7 · System documentation	SR 11-7 §V · Model validation	3 of 5 Domains without current evidence
Third Party Column mean 59	Art. 25 · Value chain responsibilities	GOVERN 6.2 · Third party risk	§A.10.2 · Supplier responsibilities	OCC 2023-17 §III · Third party	2 of 5 Domains without current evidence
Incident Response Column mean 46	Art. 73 · Serious incident reporting	MANAGE 4.3 · Incident response and recovery	§A.6.2.8 · Event and incident handling	ECOA · Consumer dispute handling	0 of 5 Domains without current evidence

Clause references are sample mappings for demonstration. Owner and evidence context for each domain and control area is available in the heat map and the evidence vault.