Law / Frameworks / Crosswalk / NIST AI 600-1 to NIST AI 200-2

The NIST Generative AI Profile, mapped to the NIST TEVV-Athlon Framework for Evaluating AI Systems

5 of NIST AI 600-1's controls connect to 4 of NIST AI 200-2's through 88 laws in 40 jurisdictions. Two controls connect when the same duties, in at least 2 laws we track, reach both. The connections are our own reading of the law; no framework publisher has reviewed or endorsed them.

From: NIST Generative AI Profile, July 2024 (NIST AI 600-1), National Institute of Standards and Technology
To: NIST TEVV-Athlon Framework for Evaluating AI Systems, initial public draft, August 2026 (NIST AI 200-2 ipd), National Institute of Standards and Technology
See also: NIST AI 200-2 to NIST AI 600-1, the other way · every pair in the crosswalk · law library as of 19 Oct 2026

Download this mapping, with every law behind each connection: nist-ai-600-1--nist-ai-200-2.csv · nist-ai-600-1--nist-ai-200-2.json

NIST AI 600-1	NIST AI 200-2	Laws	Jurisdictions	Where the laws stand
GAI-RISK-04Data Privacy	2.4Synthesize & Interrogate	13	11	6 in force, 2 not yet in force, 5 proposed
	The 13 laws behind GAI-RISK-04 and 2.4 Council of Europe Framework Convention on Artificial Intelligence, signed by Andorra, Andorra proposed Council of Europe Framework Convention on Artificial Intelligence, signed by Armenia, Armenia proposed Council of Europe Framework Convention on Artificial Intelligence, signed by Canada, Canada proposed Ley de Fomento a la Inteligencia Artificial y Tecnologías, marco institucional, registro y evaluación de riesgos, El Salvador AI Act, Article 26(9) (using Article 13 information for a data protection impact assessment), European Union from 2 Dec 2027, in 13 months AI Act, Article 27 (fundamental rights impact assessment), European Union from 2 Dec 2027, in 13 months Act XLVII of 1997 on Health Data, Section 35/A(4) to (8), Conditions for AI Development on Electronic Health Service Space Data, Hungary Decreto Legislativo 160/2026, After-the-Fact Facial Recognition Integrated in Video Surveillance (Art. 10), Italy Decreto Legislativo 160/2026, Police Biometric AI: Dataset Labelling and Real-Time Remote Identification (Artt. 7-9, 13), Italy Digital Code, Chapter 23: AI system design and risk-management obligations, Kyrgyzstan and 3 more, every one in the free file.
	4.3Composing a TEVV Toolbox	8	3	5 in force, 3 not yet in force
	The 8 laws behind GAI-RISK-04 and 4.3 AI Act, Article 14 (human oversight), European Union from 2 Dec 2027, in 13 months AI Act, Article 15 (accuracy, robustness and cybersecurity), European Union from 2 Dec 2027, in 13 months AI Act, Article 26(10) (post-remote biometric identification authorisation), European Union from 2 Dec 2027, in 13 months MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union Codice Penale Art. 437-bis, Omitted Safety Measures in High-Risk AI Systems and Unlawful Alteration of Them, Italy Decreto Legislativo 160/2026, After-the-Fact Facial Recognition Integrated in Video Surveillance (Art. 10), Italy Decreto Legislativo 160/2026, Police Biometric AI: Dataset Labelling and Real-Time Remote Identification (Artt. 7-9, 13), Italy Use of artificial intelligence in therapy or psychotherapy services, Maine
	2.3Apply & Measure	6	3	4 in force, 2 not yet in force
	The 6 laws behind GAI-RISK-04 and 2.3 AI Act, Article 14 (human oversight), European Union from 2 Dec 2027, in 13 months AI Act, Article 26(10) (post-remote biometric identification authorisation), European Union from 2 Dec 2027, in 13 months Codice Penale Art. 437-bis, Omitted Safety Measures in High-Risk AI Systems and Unlawful Alteration of Them, Italy Decreto Legislativo 160/2026, After-the-Fact Facial Recognition Integrated in Video Surveillance (Art. 10), Italy Decreto Legislativo 160/2026, Police Biometric AI: Dataset Labelling and Real-Time Remote Identification (Artt. 7-9, 13), Italy Use of artificial intelligence in therapy or psychotherapy services, Maine
	2.2Define & Construct	3	2	2 in force, 1 not yet in force
	The 3 laws behind GAI-RISK-04 and 2.2 AI Act, Article 15 (accuracy, robustness and cybersecurity), European Union from 2 Dec 2027, in 13 months MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union Codice Penale Art. 437-bis, Omitted Safety Measures in High-Risk AI Systems and Unlawful Alteration of Them, Italy
GAI-RISK-07Human-AI Configuration	2.3Apply & Measure	78	37	50 in force, 27 not yet in force, 1 proposed
	The 78 laws behind GAI-RISK-07 and 2.3 SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama Clinical Decision Support Systems Bias Mitigation Act (SB 503), California from 1 Jan 2027, in 2 months Employment Automated Decision Systems Act (SB 947), California from 1 Jul 2027, in 8 months Health Care Services Artificial Intelligence Act (AB 1979), California from 1 Jan 2027, in 2 months Transparency in Frontier Artificial Intelligence Act (SB 53), California CSA Staff Notice 31-342, guidance for portfolio managers regarding online advice, Canada OSFI Guideline E-23, Enterprise-Wide Model Risk Management for Deposit-Taking Institutions (2017), Canada OSFI Guideline E-23, Model Risk Management (2027), Canada from 1 May 2027, in 6 months Amended Regulation 10-1-1 (2025), Governance and Risk Management Framework for Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models, Colorado HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months and 68 more, every one in the free file.
	4.3Composing a TEVV Toolbox	78	37	50 in force, 27 not yet in force, 1 proposed
	The 78 laws behind GAI-RISK-07 and 4.3 SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama Clinical Decision Support Systems Bias Mitigation Act (SB 503), California from 1 Jan 2027, in 2 months Employment Automated Decision Systems Act (SB 947), California from 1 Jul 2027, in 8 months Health Care Services Artificial Intelligence Act (AB 1979), California from 1 Jan 2027, in 2 months Transparency in Frontier Artificial Intelligence Act (SB 53), California CSA Staff Notice 31-342, guidance for portfolio managers regarding online advice, Canada OSFI Guideline E-23, Enterprise-Wide Model Risk Management for Deposit-Taking Institutions (2017), Canada OSFI Guideline E-23, Model Risk Management (2027), Canada from 1 May 2027, in 6 months Amended Regulation 10-1-1 (2025), Governance and Risk Management Framework for Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models, Colorado HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months and 68 more, every one in the free file.
GAI-RISK-08Information Integrity	2.3Apply & Measure	2	2	2 in force
	The 2 laws behind GAI-RISK-08 and 2.3 Practice Direction No. 1 of 2025, Use of Generative Artificial Intelligence in Court Proceedings, Jamaica Central Bank of Jordan Artificial Intelligence Framework for the Banking Sector, Version 1.0, Jordan
	4.3Composing a TEVV Toolbox	2	2	2 in force
	The 2 laws behind GAI-RISK-08 and 4.3 Practice Direction No. 1 of 2025, Use of Generative Artificial Intelligence in Court Proceedings, Jamaica Central Bank of Jordan Artificial Intelligence Framework for the Banking Sector, Version 1.0, Jordan
GAI-RISK-09Information Security	4.3Composing a TEVV Toolbox	14	10	10 in force, 3 not yet in force, 1 proposed
	The 14 laws behind GAI-RISK-09 and 4.3 SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama Amended Regulation 10-1-1 (2025), Governance and Risk Management Framework for Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models, Colorado HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months AI Act, Article 15 (accuracy, robustness and cybersecurity), European Union from 2 Dec 2027, in 13 months AI Act, Article 26(10) (post-remote biometric identification authorisation), European Union from 2 Dec 2027, in 13 months AI Act, Articles 60 and 61 (testing in real world conditions outside AI regulatory sandboxes, with informed consent), European Union MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union Gesetz zur Marktüberwachung und Innovationsförderung von künstlicher Intelligenz (KI-MIG), AI Market Surveillance and Innovation Promotion Act, Germany Government Decree 344/2025 Implementing the Hungarian AI Act: Designated Authorities, Notified-Body Reports and Fine Ceilings, Hungary Codice Penale Art. 437-bis, Omitted Safety Measures in High-Risk AI Systems and Unlawful Alteration of Them, Italy and 4 more, every one in the free file.
	2.3Apply & Measure	13	10	10 in force, 2 not yet in force, 1 proposed
	The 13 laws behind GAI-RISK-09 and 2.3 SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama Amended Regulation 10-1-1 (2025), Governance and Risk Management Framework for Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models, Colorado HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months AI Act, Article 26(10) (post-remote biometric identification authorisation), European Union from 2 Dec 2027, in 13 months AI Act, Articles 60 and 61 (testing in real world conditions outside AI regulatory sandboxes, with informed consent), European Union MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union Gesetz zur Marktüberwachung und Innovationsförderung von künstlicher Intelligenz (KI-MIG), AI Market Surveillance and Innovation Promotion Act, Germany Government Decree 344/2025 Implementing the Hungarian AI Act: Designated Authorities, Notified-Body Reports and Fine Ceilings, Hungary Codice Penale Art. 437-bis, Omitted Safety Measures in High-Risk AI Systems and Unlawful Alteration of Them, Italy Central Bank of Jordan Artificial Intelligence Framework for the Banking Sector, Version 1.0, Jordan and 3 more, every one in the free file.
	2.2Define & Construct	3	2	2 in force, 1 not yet in force
	The 3 laws behind GAI-RISK-09 and 2.2 AI Act, Article 15 (accuracy, robustness and cybersecurity), European Union from 2 Dec 2027, in 13 months MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union Codice Penale Art. 437-bis, Omitted Safety Measures in High-Risk AI Systems and Unlawful Alteration of Them, Italy
GAI-RISK-10Intellectual Property	2.3Apply & Measure	4	3	3 in force, 1 not yet in force
	The 4 laws behind GAI-RISK-10 and 2.3 AI Act, Article 16 (obligations of providers of high-risk AI systems), European Union from 2 Dec 2027, in 13 months Commission Guidelines on the scope of the obligations for providers of general-purpose AI models under the AI Act, European Union Financial Services (Robotic and Artificial Intelligence Enabled Advisory Services) Rules 2021, Mauritius Digital Transformation Act 2025, ICT service permit for AI and AI-related data services, Vanuatu
	4.3Composing a TEVV Toolbox	4	3	3 in force, 1 not yet in force
	The 4 laws behind GAI-RISK-10 and 4.3 AI Act, Article 16 (obligations of providers of high-risk AI systems), European Union from 2 Dec 2027, in 13 months Commission Guidelines on the scope of the obligations for providers of general-purpose AI models under the AI Act, European Union Financial Services (Robotic and Artificial Intelligence Enabled Advisory Services) Rules 2021, Mauritius Digital Transformation Act 2025, ICT service permit for AI and AI-related data services, Vanuatu

Not connected to the NIST AI 200-2: 7 of NIST AI 600-1's controls

Short of 2 laws

The same duties reach these and a NIST AI 200-2 step, in fewer than 2 of the laws we track.

GAI-RISK-11 Obscene, Degrading, and/or Abusive Content: with 2.3 and 4.3 through Use of artificial intelligence in therapy or psychotherapy services, Maine
GAI-RISK-12 Value Chain and Component Integration: with 2.3 and 4.3 through Commission Guidelines on the scope of the obligations for providers of general-purpose AI models under the AI Act, European Union

No NIST AI 200-2 step on the same duties

Laws reach these, but no duty that reaches one of them also reaches a NIST AI 200-2 step.

GAI-RISK-03 Dangerous, Violent, or Hateful Content, 4 laws

No law we track reaches these

No duty in the laws we track reaches these controls.

GAI-RISK-01 CBRN Information or Capabilities
GAI-RISK-02 Confabulation
GAI-RISK-05 Environmental Impacts
GAI-RISK-06 Harmful Bias or Homogenization

How these connections are drawn

Each requirement line in the laws we track is read against the framework for its subject (the AI, scraping and news aggregation laws against the NIST AI RMF, the privacy, communications and age assurance laws against the NIST Privacy Framework, the cybersecurity laws against the NIST CSF 2.0); laws on liability and content moderation are not read against any framework yet. A line reaches either framework through a kind of duty its law carries, and only where that kind of duty also reaches, on that same line, the NIST framework for the line's own subject. Two controls connect when lines in at least 2 laws reach both. That says the same duties reach both; it does not say the two are alike, or that running either one does what a law asks.

Every duty line in the AI, scraping and news aggregation laws we track has been read against the framework for its subject.