Law / Frameworks / Crosswalk / NIST AI RMF to NIST Privacy Framework
The NIST AI Risk Management Framework, mapped to the NIST Privacy Framework
15 of NIST AI RMF's controls connect to 12 of NIST Privacy Framework's through 177 laws in 117 jurisdictions. Two controls connect when the same duties, in at least 2 laws we track, reach both. The connections are our own reading of the law; no framework publisher has reviewed or endorsed them.
- From
- NIST AI Risk Management Framework, version 1.0, January 2023 (NIST AI 100-1), National Institute of Standards and Technology
- To
- NIST Privacy Framework, version 1.0, January 2020, National Institute of Standards and Technology
- See also
- NIST Privacy Framework to NIST AI RMF, the other way · every pair in the crosswalk · law library as of
Download this mapping, with every law behind each connection: nist-ai-rmf--nist-privacy-framework.csv · nist-ai-rmf--nist-privacy-framework.json
Not connected to the NIST Privacy Framework: 57 of NIST AI RMF's controls
Short of 2 laws
The same duties reach these and a NIST Privacy Framework control, in fewer than 2 of the laws we track.
- GOVERN 1.2 The characteristics of trustworthy AI are integrated into organizational policies,...: with GV.PO-P2 through Council of Europe Framework Convention on AI, Georgia's signature, Georgia
- GOVERN 1.4 The risk management process and its outcomes are established through transparent...: with ID.IM-P1 through Michigan DIFS Bulletin 2026-03-BT/CF/CU, Use of Artificial Intelligence Systems by Financial Service Providers, Michigan
- GOVERN 3.2 Policies and procedures are in place to define and differentiate roles and...: with GV.PO-P3 through Platform Work Directive, Transparency, Human Oversight and Human Review of Automated Systems (Articles 9 to 11), European Union
- GOVERN 6.1 Policies and procedures are in place that address AI risks associated with third-party...: with ID.DE-P3 through Central Bank of Jordan Artificial Intelligence Framework for the Banking Sector, Version 1.0, Jordan; with CT.PO-P1 through Reform to the Federal Labor Law and the Federal Copyright Law, AI Voice and Image Consent Regime for Performing Artists, Mexico
- MEASURE 1.2 Appropriateness of AI metrics and effectiveness of existing controls are regularly...: with PR.PO-P2 through Counter-Fraud Framework: fraud detection systems, machine learning and artificial intelligence, Saudi Arabia
- MEASURE 2.2 Evaluations involving human subjects meet applicable requirements (including human...: with CT.PO-P3 and CT.DM-P5 through AI Act, Articles 60 and 61 (testing in real world conditions outside AI regulatory sandboxes, with informed consent), European Union
- MEASURE 2.7 AI system security and resilience – as identified in the MAP function – are evaluated...: with PR.DS-P5 through Superintendencia Circular on AI and Personal Data, Colombia
- MEASURE 3.1 Approaches, personnel, and documentation are in place to regularly identify and track...: with CT.DM-P10 through Platform Work Directive, Transparency, Human Oversight and Human Review of Automated Systems (Articles 9 to 11), European Union
- MANAGE 1.3 Responses to the AI risks deemed high priority, as identified by the MAP function, are...: with ID.RA-P5 and GV.RM-P1 through Superintendencia Circular on AI and Personal Data, Colombia
- MANAGE 4.1 Post-deployment AI system monitoring plans are implemented, including mechanisms for...: with CT.PO-P3 through Central Bank of Jordan Artificial Intelligence Framework for the Banking Sector, Version 1.0, Jordan; with CM.AW-P8 through Digital Voyeurism Prevention Act (HB 276, 2026 General Session), Utah Code Title 13 Chapter 72b, Utah
No NIST Privacy Framework control on the same duties
Laws reach these, but no duty that reaches one of them also reaches a NIST Privacy Framework control.
- GOVERN 1.3 Processes, procedures, and practices are in place to determine the needed level of..., 6 laws
- GOVERN 1.5 Ongoing monitoring and periodic review of the risk management process and its outcomes..., 7 laws
- GOVERN 1.7 Processes and procedures are in place for decommissioning and phasing out AI systems..., 1 law
- GOVERN 2.1 Roles and responsibilities and lines of communication related to mapping, measuring,..., 9 laws
- GOVERN 2.2 The organization’s personnel and partners receive AI risk management training to..., 3 laws
- GOVERN 2.3 Executive leadership of the organization takes responsibility for decisions about..., 9 laws
- GOVERN 4.1 Organizational policies and practices are in place to foster a critical thinking and..., 3 laws
- GOVERN 4.2 Organizational teams document the risks and potential impacts of the AI technology..., 19 laws
- GOVERN 4.3 Organizational practices are in place to enable AI testing, identification of..., 3 laws
- GOVERN 5.1 Organizational policies and practices are in place to collect, consider, prioritize,..., 1 law
- GOVERN 6.2 Contingency processes are in place to handle failures or incidents in third-party data..., 1 law
- MAP 1.1 Intended purposes, potentially beneficial uses, context-specific laws, norms and..., 3 laws
- MAP 1.5 Organizational risk tolerances are determined and documented., 1 law
- MAP 2.2 Information about the AI system’s knowledge limits and how system output may be..., 12 laws
- MAP 3.4 Processes for operator and practitioner proficiency with AI system performance and..., 3 laws
- MEASURE 1.3 Internal experts who did not serve as front-line developers for the system and/or..., 10 laws
- MEASURE 2.1 Test sets, metrics, and details about the tools used during TEVV are documented., 1 law
- MEASURE 2.3 AI system performance or assurance criteria are measured qualitatively or..., 6 laws
- MEASURE 2.5 The AI system to be deployed is demonstrated to be valid and reliable. Limitations of..., 7 laws
- MEASURE 2.6 The AI system is evaluated regularly for safety risks – as identified in the MAP..., 23 laws
- MANAGE 1.1 A determination is made as to whether the AI system achieves its intended purposes and..., 6 laws
- MANAGE 2.1 Resources required to manage AI risks are taken into account – along with viable..., 1 law
- MANAGE 2.3 Procedures are followed to respond to and recover from a previously unknown risk when..., 1 law
- MANAGE 3.1 AI risks and benefits from third-party resources are regularly monitored, and risk..., 3 laws
- MANAGE 4.3 Incidents and errors are communicated to relevant AI actors, including affected..., 17 laws
No law we track reaches these
No duty in the laws we track reaches these controls.
- GOVERN 3.1 Decision-making related to mapping, measuring, and managing AI risks throughout the...
- GOVERN 5.2 Mechanisms are established to enable the team that developed or deployed AI systems to...
- MAP 1.2 Interdisciplinary AI actors, competencies, skills, and capacities for establishing...
- MAP 1.3 The organization’s mission and relevant goals for AI technology are understood and documented.
- MAP 1.4 The business value or context of business use has been clearly defined or – in the...
- MAP 2.1 The specific tasks and methods used to implement the tasks that the AI system will...
- MAP 3.1 Potential benefits of intended AI system functionality and performance are examined...
- MAP 3.2 Potential costs, including non-monetary costs, which result from expected or realized...
- MAP 4.2 Internal risk controls for components of the AI system, including third-party AI...
- MAP 5.2 Practices and personnel for supporting regular engagement with relevant AI actors and...
- MEASURE 1.1 Approaches and metrics for measurement of AI risks enumerated during the MAP function...
- MEASURE 2.12 Environmental impact and sustainability of AI model training and management activities...
- MEASURE 2.13 Effectiveness of the employed TEVV metrics and processes in the MEASURE function are...
- MEASURE 3.2 Risk tracking approaches are considered for settings where AI risks are difficult to...
- MEASURE 4.1 Measurement approaches for identifying AI risks are connected to deployment context(s)...
- MEASURE 4.2 Measurement results regarding AI system trustworthiness in deployment context(s) and...
- MEASURE 4.3 Measurable performance improvements or declines based on consultations with relevant...
- MANAGE 1.2 Treatment of documented AI risks is prioritized based on impact, likelihood, and...
- MANAGE 1.4 Negative residual risks (defined as the sum of all unmitigated risks) to both...
- MANAGE 2.2 Mechanisms are in place and applied to sustain the value of deployed AI systems.
- MANAGE 3.2 Pre-trained models which are used for development are monitored as part of AI system...
- MANAGE 4.2 Measurable activities for continual improvements are integrated into AI system updates...
Lines of the news aggregation laws we track were not read against the NIST Privacy Framework, so none of them connects the two here (how each subject's lines were read).
Lines of the communications, age assurance and cybersecurity laws we track were not read against the NIST AI RMF, so none of them connects the two here (how each subject's lines were read).
How these connections are drawn
Each requirement line in the laws we track is read against the framework for its subject (the AI, scraping and news aggregation laws against the NIST AI RMF, the privacy, communications and age assurance laws against the NIST Privacy Framework, the cybersecurity laws against the NIST CSF 2.0); laws on liability and content moderation are not read against any framework yet. Both are read line by line, so a line connects them only where it was read against both and placed on each. Two controls connect when lines in at least 2 laws reach both. That says the same duties reach both; it does not say the two are alike, or that running either one does what a law asks.
A line placed on a control in the framework for its own subject, whose law carries a kind of duty that reaches another of the three frameworks read line by line, is read against that one as well: every such line, or only those whose wording reaches into it. For these two:
| Laws on | Read against the NIST AI RMF | Read against the NIST Privacy Framework |
|---|---|---|
| AI | every line (their own framework) | such lines on personal data and privacy, biometrics, likeness and identity, profiling, surveillance and consent |
| scraping | every line (their own framework) | such lines on interception, monitoring, personal data and privacy |
| news aggregation | every line (their own framework) | not read |
| privacy | such lines on automated decisions, profiling and AI | every line (their own framework) |
| communications | not read | every line (their own framework) |
| age assurance | not read | every line (their own framework) |
| cybersecurity | not read | every such line |
Every duty line in the AI, scraping and privacy laws we track has been read against the framework for its subject.