LexLint.ioBeta

Know the law your code answers to.

Law / Frameworks / Crosswalk / NIST AI 600-1 to NIST Privacy Framework

The NIST Generative AI Profile, mapped to the NIST Privacy Framework

7 of NIST AI 600-1's controls connect to 8 of NIST Privacy Framework's through 99 laws in 67 jurisdictions. Two controls connect when the same duties, in at least 2 laws we track, reach both. The connections are our own reading of the law; no framework publisher has reviewed or endorsed them.

From
NIST Generative AI Profile, July 2024 (NIST AI 600-1), National Institute of Standards and Technology
To
NIST Privacy Framework, version 1.0, January 2020, National Institute of Standards and Technology
See also
NIST Privacy Framework to NIST AI 600-1, the other way · every pair in the crosswalk · law library as of

Download this mapping, with every law behind each connection: nist-ai-600-1--nist-privacy-framework.csv · nist-ai-600-1--nist-privacy-framework.json

NIST AI 600-1NIST Privacy FrameworkLawsJurisdictionsWhere the laws stand
GAI-RISK-03Dangerous, Violent, or Hateful Content CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing... 3 3 1 in force, 2 not yet in force
The 3 laws behind GAI-RISK-03 and CT.PO-P3
GAI-RISK-04Data Privacy CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g.,... 7 5 6 in force, 1 not yet in force
The 7 laws behind GAI-RISK-04 and CT.PO-P1
CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data... 6 5 4 in force, 2 not yet in force
The 6 laws behind GAI-RISK-04 and CM.AW-P1
CT.DM-P10Stakeholder privacy preferences are included in algorithmic design objectives and... 3 3 1 in force, 2 not yet in force
The 3 laws behind GAI-RISK-04 and CT.DM-P10
GAI-RISK-07Human-AI Configuration CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data... 8 7 5 in force, 3 not yet in force
The 8 laws behind GAI-RISK-07 and CM.AW-P1
CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g.,... 6 5 5 in force, 1 not yet in force
The 6 laws behind GAI-RISK-07 and CT.PO-P1
ID.RA-P2Data analytic inputs and outputs are identified and evaluated for bias. 3 3 2 in force, 1 not yet in force
The 3 laws behind GAI-RISK-07 and ID.RA-P2
GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed. 3 3 2 in force, 1 not yet in force
The 3 laws behind GAI-RISK-07 and GV.PO-P5
CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing... 3 3 1 in force, 2 not yet in force
The 3 laws behind GAI-RISK-07 and CT.PO-P3
CT.DM-P10Stakeholder privacy preferences are included in algorithmic design objectives and... 3 3 2 in force, 1 not yet in force
The 3 laws behind GAI-RISK-07 and CT.DM-P10
ID.IM-P1Systems/products/services that process data are inventoried. 3 2 2 in force, 1 not yet in force
The 3 laws behind GAI-RISK-07 and ID.IM-P1
CT.DM-P8Audit/log records are determined, documented, implemented, and reviewed in accordance... 2 1 2 not yet in force
The 2 laws behind GAI-RISK-07 and CT.DM-P8
GAI-RISK-08Information Integrity CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g.,... 50 37 44 in force, 4 not yet in force, 2 proposed
The 50 laws behind GAI-RISK-08 and CT.PO-P1

and 40 more, every one in the free file.

CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data... 6 5 3 in force, 3 not yet in force
The 6 laws behind GAI-RISK-08 and CM.AW-P1
GAI-RISK-09Information Security CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g.,... 26 24 25 in force, 1 not yet in force
The 26 laws behind GAI-RISK-09 and CT.PO-P1

and 16 more, every one in the free file.

GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed. 2 2 1 in force, 1 not yet in force
The 2 laws behind GAI-RISK-09 and GV.PO-P5
GAI-RISK-11Obscene, Degrading, and/or Abusive Content CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g.,... 52 38 46 in force, 4 not yet in force, 2 proposed
The 52 laws behind GAI-RISK-11 and CT.PO-P1

and 42 more, every one in the free file.

CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data... 4 3 4 in force
The 4 laws behind GAI-RISK-11 and CM.AW-P1
CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing... 3 3 1 in force, 2 not yet in force
The 3 laws behind GAI-RISK-11 and CT.PO-P3
GAI-RISK-12Value Chain and Component Integration CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g.,... 26 25 26 in force
The 26 laws behind GAI-RISK-12 and CT.PO-P1

and 16 more, every one in the free file.
Not connected to the NIST Privacy Framework: 5 of NIST AI 600-1's controls

No NIST Privacy Framework control on the same duties

Laws reach these, but no duty that reaches one of them also reaches a NIST Privacy Framework control.

No law we track reaches these

No duty in the laws we track reaches these controls.

Lines of the news aggregation laws we track were not read against the NIST Privacy Framework, so none of them connects the two here (how each subject's lines were read).

How these connections are drawn

Each requirement line in the laws we track is read against the framework for its subject (the AI, scraping and news aggregation laws against the NIST AI RMF, the privacy, communications and age assurance laws against the NIST Privacy Framework, the cybersecurity laws against the NIST CSF 2.0); laws on liability and content moderation are not read against any framework yet. A line reaches the NIST AI 600-1 through a kind of duty its law carries, and only where that kind of duty also reaches, on that same line, the NIST framework for the line's own subject. Two controls connect when lines in at least 2 laws reach both. That says the same duties reach both; it does not say the two are alike, or that running either one does what a law asks.

A line placed on a control in the framework for its own subject, whose law carries a kind of duty that reaches another of the three frameworks read line by line, is read against that one as well: every such line, or only those whose wording reaches into it. For these two:

Laws onRead against the NIST Privacy Framework
AIsuch lines on personal data and privacy, biometrics, likeness and identity, profiling, surveillance and consent
scrapingsuch lines on interception, monitoring, personal data and privacy
news aggregationnot read

Every duty line in the AI and scraping laws we track has been read against the framework for its subject.