Law / Frameworks / Crosswalk / FINOS AIGF to NIST AI 200-2
The FINOS AI Governance Framework, mapped to the NIST TEVV-Athlon Framework for Evaluating AI Systems
13 of FINOS AIGF's controls connect to 4 of NIST AI 200-2's through 88 laws in 40 jurisdictions. Two controls connect when the same duties, in at least 2 laws we track, reach both. The connections are our own reading of the law; no framework publisher has reviewed or endorsed them.
- From
- FINOS AI Governance Framework, version 2, as maintained on , FINOS
- To
- NIST TEVV-Athlon Framework for Evaluating AI Systems, initial public draft, August 2026 (NIST AI 200-2 ipd), National Institute of Standards and Technology
- See also
- NIST AI 200-2 to FINOS AIGF, the other way · every pair in the crosswalk · law library as of
Download this mapping, with every law behind each connection: nist-ai-200-2--finos-ai-governance-framework.csv · nist-ai-200-2--finos-ai-governance-framework.json
Not connected to the NIST AI 200-2: 12 of FINOS AIGF's controls
No NIST AI 200-2 step on the same duties
Laws reach these, but no duty that reaches one of them also reaches a NIST AI 200-2 step.
- AIR-PREV-018 Agent Authority Least Privilege Framework, 147 laws
- AIR-PREV-023 Agentic System Credential Protection Framework, 147 laws
- AIR-DET-013 Providing Citations and Source Traceability for AI-Generated Information, 33 laws
No law we track reaches these
No duty in the laws we track reaches these controls.
- AIR-PREV-002 Data Filtering From External Knowledge Bases
- AIR-PREV-003 User/App/Model Firewalling/Filtering
- AIR-PREV-010 AI Model Version Pinning
- AIR-PREV-019 Tool Chain Validation and Sanitization
- AIR-PREV-022 Multi-Agent Isolation and Segmentation
- AIR-PREV-025 Skill/Plugin Integrity and Governance
- AIR-DET-009 AI System Alerting and Denial of Wallet (DoW) / Spend Monitoring
- AIR-DET-015 Using Large Language Models for Automated Evaluation (LLM-as-a-Judge)
- AIR-DET-016 Preserving Source Data Access Controls in AI Systems
How these connections are drawn
Each requirement line in the laws we track is read against the framework for its subject (the AI, scraping and news aggregation laws against the NIST AI RMF, the privacy, communications and age assurance laws against the NIST Privacy Framework, the cybersecurity laws against the NIST CSF 2.0); laws on liability and content moderation are not read against any framework yet. A line reaches either framework through a kind of duty its law carries, and only where that kind of duty also reaches, on that same line, the NIST framework for the line's own subject. Two controls connect when lines in at least 2 laws reach both. That says the same duties reach both; it does not say the two are alike, or that running either one does what a law asks.
Every duty line in the AI, scraping and news aggregation laws we track has been read against the framework for its subject.
Sources and licenses
FINOS AI Governance Framework, copyright 2025 FINOS, licensed under CC BY 4.0. Titles and purpose text are quoted; markdown emphasis and links were removed.