Law / Frameworks / Crosswalk / FINOS AIGF to OWASP LLM Top 10
The FINOS AI Governance Framework, mapped to the OWASP Top 10 for LLM Applications
16 of FINOS AIGF's controls connect to 5 of OWASP LLM Top 10's through 224 laws in 125 jurisdictions. Two controls connect when the same duties, in at least 2 laws we track, reach both. The connections are our own reading of the law; no framework publisher has reviewed or endorsed them.
- From
- FINOS AI Governance Framework, version 2, as maintained on , FINOS
- To
- OWASP Top 10 for LLM Applications, 2026 edition, August 2026, OWASP GenAI Security Project
- See also
- OWASP LLM Top 10 to FINOS AIGF, the other way · every pair in the crosswalk · law library as of
Download this mapping, with every law behind each connection: owasp-llm-top-10--finos-ai-governance-framework.csv · owasp-llm-top-10--finos-ai-governance-framework.json
Not connected to the OWASP LLM Top 10: 9 of FINOS AIGF's controls
No law we track reaches these
No duty in the laws we track reaches these controls.
- AIR-PREV-002 Data Filtering From External Knowledge Bases
- AIR-PREV-003 User/App/Model Firewalling/Filtering
- AIR-PREV-010 AI Model Version Pinning
- AIR-PREV-019 Tool Chain Validation and Sanitization
- AIR-PREV-022 Multi-Agent Isolation and Segmentation
- AIR-PREV-025 Skill/Plugin Integrity and Governance
- AIR-DET-009 AI System Alerting and Denial of Wallet (DoW) / Spend Monitoring
- AIR-DET-015 Using Large Language Models for Automated Evaluation (LLM-as-a-Judge)
- AIR-DET-016 Preserving Source Data Access Controls in AI Systems
How these connections are drawn
Each requirement line in the laws we track is read against the framework for its subject (the AI, scraping and news aggregation laws against the NIST AI RMF, the privacy, communications and age assurance laws against the NIST Privacy Framework, the cybersecurity laws against the NIST CSF 2.0); laws on liability and content moderation are not read against any framework yet. A line reaches either framework through a kind of duty its law carries, and only where that kind of duty also reaches, on that same line, the NIST framework for the line's own subject. Two controls connect when lines in at least 2 laws reach both. That says the same duties reach both; it does not say the two are alike, or that running either one does what a law asks.
Every duty line in the AI, scraping and news aggregation laws we track has been read against the framework for its subject.
Sources and licenses
FINOS AI Governance Framework, copyright 2025 FINOS, licensed under CC BY 4.0. Titles and purpose text are quoted; markdown emphasis and links were removed.
OWASP GenAI Security Project, OWASP Top 10 for LLM Applications 2026, licensed CC BY-SA 4.0. Excerpted: only the first paragraph of each entry's Description is reproduced, verbatim.