Law / Frameworks / Crosswalk
One framework to another, through the law
Pick a framework to map from and one to map to. Two controls connect when the same duties, in at least 2 laws we track, reach both, and every connection lists its laws.
Every pair, from the row's framework to the column's
| Map from | NIST AI RMF | NIST AI 600-1 | NIST AI 200-2 | OWASP LLM Top 10 | OWASP Agentic Top 10 | MIT mitigations | NIST Privacy Framework | NIST CSF 2.0 | FINOS AIGF | ENISA NIS2 guidance | ETSI EN 304 223 |
|---|---|---|---|---|---|---|---|---|---|---|---|
| NIST AI RMF | 65 | 39 | 28 | 29 | 143 | 28 | 2 | 144 | nothing mapped yet | 115 | |
| NIST AI 600-1 | 65 | 13 | 14 | 15 | 76 | 20 | 3 | 60 | nothing mapped yet | 63 | |
| NIST AI 200-2 | 39 | 13 | 10 | 8 | 34 | 14 | 4 | 28 | nothing mapped yet | 29 | |
| OWASP LLM Top 10 | 28 | 14 | 10 | 14 | 29 | 7 | 5 | 38 | nothing mapped yet | 28 | |
| OWASP Agentic Top 10 | 29 | 15 | 8 | 14 | 28 | 9 | 4 | 31 | nothing mapped yet | 24 | |
| MIT mitigations | 143 | 76 | 34 | 29 | 28 | 45 | 8 | 120 | nothing mapped yet | 129 | |
| NIST Privacy Framework | 28 | 20 | 14 | 7 | 9 | 45 | 98 | 340 | 113 | 37 | |
| NIST CSF 2.0 | 2 | 3 | 4 | 5 | 4 | 8 | 98 | 300 | 294 | 8 | |
| FINOS AIGF | 144 | 60 | 28 | 38 | 31 | 120 | 340 | 300 | 226 | 104 | |
| ENISA NIS2 guidance | nothing mapped yet | nothing mapped yet | nothing mapped yet | nothing mapped yet | nothing mapped yet | nothing mapped yet | 113 | 294 | 226 | nothing mapped yet | |
| ETSI EN 304 223 | 115 | 63 | 29 | 28 | 24 | 129 | 37 | 8 | 104 | nothing mapped yet |
A number is how many pairs of controls connect; it opens that direction's page. Each requirement line is read against the framework for its subject (the AI, scraping and news aggregation laws against the NIST AI RMF, the privacy, communications and age assurance laws against the NIST Privacy Framework, the cybersecurity laws against the NIST CSF 2.0), and laws on liability and content moderation against none yet. A line placed there is read against another of the three as well where its subject reaches into it (privacy lines against the NIST AI RMF; AI, scraping and cybersecurity lines against the NIST Privacy Framework; AI, privacy and age assurance lines against the NIST CSF 2.0), so one line can connect two of them. A pair with nothing mapped yet has no line read as reaching both.
The frameworks' text, and our reading
The connections are our own reading of the law; no framework publisher has reviewed or endorsed them.
OWASP GenAI Security Project, OWASP Top 10 for LLM Applications 2026, licensed CC BY-SA 4.0. Excerpted: only the first paragraph of each entry's Description is reproduced, verbatim.
OWASP GenAI Security Project, Agentic Security Initiative, OWASP Top 10 for Agentic Applications 2026, licensed CC BY-SA 4.0. Excerpted: only the first paragraph of each entry's Description is reproduced, verbatim.
MIT AI Risk Initiative (MIT FutureTech), AI Risk Mitigation Taxonomy. Data from the MIT AI Risk Initiative is licensed under CC BY 4.0. Cite as: Mapping AI Risk Mitigations: Evidence Scan & Draft Mitigation Taxonomy
FINOS AI Governance Framework, copyright 2025 FINOS, licensed under CC BY 4.0. Titles and purpose text are quoted; markdown emphasis and links were removed.
ENISA Technical Implementation Guidance on Commission Implementing Regulation (EU) 2024/2690, version 1.0 (June 2025), © European Union Agency for Cybersecurity (ENISA), 2025, licensed under CC BY 4.0. The section titles and requirement text are the Annex to Implementing Regulation (EU) 2024/2690 as ENISA prints it (© European Union); each section carries its first point as its text, and ENISA's guidance, examples of evidence and tips are not reproduced.
Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI.