Law / Frameworks / Crosswalk / NIST Privacy Framework to NIST AI 200-2

The NIST Privacy Framework, mapped to the NIST TEVV-Athlon Framework for Evaluating AI Systems

7 of NIST Privacy Framework's controls connect to 2 of NIST AI 200-2's through 15 laws in 10 jurisdictions. Two controls connect when the same duties, in at least 2 laws we track, reach both. The connections are our own reading of the law; no framework publisher has reviewed or endorsed them.

From: NIST Privacy Framework, version 1.0, January 2020, National Institute of Standards and Technology
To: NIST TEVV-Athlon Framework for Evaluating AI Systems, initial public draft, August 2026 (NIST AI 200-2 ipd), National Institute of Standards and Technology
See also: NIST AI 200-2 to NIST Privacy Framework, the other way · every pair in the crosswalk · law library as of 19 Oct 2026

Download this mapping, with every law behind each connection: nist-ai-200-2--nist-privacy-framework.csv · nist-ai-200-2--nist-privacy-framework.json

NIST Privacy Framework	NIST AI 200-2	Laws	Jurisdictions	Where the laws stand
ID.IM-P1Systems/products/services that process data are inventoried.	2.3Apply & Measure	3	2	2 in force, 1 not yet in force
	The 3 laws behind ID.IM-P1 and 2.3 OSFI Guideline E-23, Enterprise-Wide Model Risk Management for Deposit-Taking Institutions (2017), Canada OSFI Guideline E-23, Model Risk Management (2027), Canada from 1 May 2027, in 6 months Michigan DIFS Bulletin 2026-03-BT/CF/CU, Use of Artificial Intelligence Systems by Financial Service Providers, Michigan
	4.3Composing a TEVV Toolbox	3	2	2 in force, 1 not yet in force
	The 3 laws behind ID.IM-P1 and 4.3 OSFI Guideline E-23, Enterprise-Wide Model Risk Management for Deposit-Taking Institutions (2017), Canada OSFI Guideline E-23, Model Risk Management (2027), Canada from 1 May 2027, in 6 months Michigan DIFS Bulletin 2026-03-BT/CF/CU, Use of Artificial Intelligence Systems by Financial Service Providers, Michigan
ID.RA-P2Data analytic inputs and outputs are identified and evaluated for bias.	2.3Apply & Measure	3	3	2 in force, 1 not yet in force
	The 3 laws behind ID.RA-P2 and 2.3 AI Act, Article 10 (data and data governance), European Union from 2 Dec 2027, in 13 months Guidance Note on the Consumer Protection and Responsible Adoption and Use of Artificial Intelligence and Machine Learning by Licensed Financial Institutions in the U.A.E., United Arab Emirates Model risk management principles for banks, United Kingdom
	4.3Composing a TEVV Toolbox	3	3	2 in force, 1 not yet in force
	The 3 laws behind ID.RA-P2 and 4.3 AI Act, Article 10 (data and data governance), European Union from 2 Dec 2027, in 13 months Guidance Note on the Consumer Protection and Responsible Adoption and Use of Artificial Intelligence and Machine Learning by Licensed Financial Institutions in the U.A.E., United Arab Emirates Model risk management principles for banks, United Kingdom
GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.	2.3Apply & Measure	3	3	2 in force, 1 not yet in force
	The 3 laws behind GV.PO-P5 and 2.3 AI Act, Article 26(10) (post-remote biometric identification authorisation), European Union from 2 Dec 2027, in 13 months Central Bank of Jordan Artificial Intelligence Framework for the Banking Sector, Version 1.0, Jordan Artificial Intelligence (Designation of the Information and Data Protection Commissioner for the purposes of Regulation (EU) 2024/1689) Regulations, 2025 (L.N. 227 of 2025), Malta
	4.3Composing a TEVV Toolbox	3	3	2 in force, 1 not yet in force
	The 3 laws behind GV.PO-P5 and 4.3 AI Act, Article 26(10) (post-remote biometric identification authorisation), European Union from 2 Dec 2027, in 13 months Central Bank of Jordan Artificial Intelligence Framework for the Banking Sector, Version 1.0, Jordan Artificial Intelligence (Designation of the Information and Data Protection Commissioner for the purposes of Regulation (EU) 2024/1689) Regulations, 2025 (L.N. 227 of 2025), Malta
CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g.,...	2.3Apply & Measure	5	4	4 in force, 1 not yet in force
	The 5 laws behind CT.PO-P1 and 2.3 AI Act, Article 26(10) (post-remote biometric identification authorisation), European Union from 2 Dec 2027, in 13 months Decreto Legislativo 160/2026, After-the-Fact Facial Recognition Integrated in Video Surveillance (Art. 10), Italy Decreto Legislativo 160/2026, Police Biometric AI: Dataset Labelling and Real-Time Remote Identification (Artt. 7-9, 13), Italy Use of artificial intelligence in therapy or psychotherapy services, Maine Artificial Intelligence (Designation of the Information and Data Protection Commissioner for the purposes of Regulation (EU) 2024/1689) Regulations, 2025 (L.N. 227 of 2025), Malta
	4.3Composing a TEVV Toolbox	5	4	4 in force, 1 not yet in force
	The 5 laws behind CT.PO-P1 and 4.3 AI Act, Article 26(10) (post-remote biometric identification authorisation), European Union from 2 Dec 2027, in 13 months Decreto Legislativo 160/2026, After-the-Fact Facial Recognition Integrated in Video Surveillance (Art. 10), Italy Decreto Legislativo 160/2026, Police Biometric AI: Dataset Labelling and Real-Time Remote Identification (Artt. 7-9, 13), Italy Use of artificial intelligence in therapy or psychotherapy services, Maine Artificial Intelligence (Designation of the Information and Data Protection Commissioner for the purposes of Regulation (EU) 2024/1689) Regulations, 2025 (L.N. 227 of 2025), Malta
CT.DM-P8Audit/log records are determined, documented, implemented, and reviewed in accordance...	2.3Apply & Measure	2	1	2 not yet in force
	The 2 laws behind CT.DM-P8 and 2.3 AI Act, Article 12 (record-keeping), European Union from 2 Dec 2027, in 13 months AI Act, Article 26(10) (post-remote biometric identification authorisation), European Union from 2 Dec 2027, in 13 months
	4.3Composing a TEVV Toolbox	2	1	2 not yet in force
	The 2 laws behind CT.DM-P8 and 4.3 AI Act, Article 12 (record-keeping), European Union from 2 Dec 2027, in 13 months AI Act, Article 26(10) (post-remote biometric identification authorisation), European Union from 2 Dec 2027, in 13 months
CT.DM-P10Stakeholder privacy preferences are included in algorithmic design objectives and...	2.3Apply & Measure	3	3	2 in force, 1 not yet in force
	The 3 laws behind CT.DM-P10 and 2.3 AI Act, Article 14 (human oversight), European Union from 2 Dec 2027, in 13 months Decreto Legislativo 160/2026, After-the-Fact Facial Recognition Integrated in Video Surveillance (Art. 10), Italy FSC Fintech Series Guidance Notes 4, responsible use of artificial intelligence in financial services, Mauritius
	4.3Composing a TEVV Toolbox	3	3	2 in force, 1 not yet in force
	The 3 laws behind CT.DM-P10 and 4.3 AI Act, Article 14 (human oversight), European Union from 2 Dec 2027, in 13 months Decreto Legislativo 160/2026, After-the-Fact Facial Recognition Integrated in Video Surveillance (Art. 10), Italy FSC Fintech Series Guidance Notes 4, responsible use of artificial intelligence in financial services, Mauritius
CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data...	2.3Apply & Measure	2	2	2 in force
	The 2 laws behind CM.AW-P1 and 2.3 Use of artificial intelligence in therapy or psychotherapy services, Maine FSC Fintech Series Guidance Notes 4, responsible use of artificial intelligence in financial services, Mauritius
	4.3Composing a TEVV Toolbox	2	2	2 in force
	The 2 laws behind CM.AW-P1 and 4.3 Use of artificial intelligence in therapy or psychotherapy services, Maine FSC Fintech Series Guidance Notes 4, responsible use of artificial intelligence in financial services, Mauritius

Not connected to the NIST AI 200-2: 93 of NIST Privacy Framework's controls

Short of 2 laws

The same duties reach these and a NIST AI 200-2 step, in fewer than 2 of the laws we track.

ID.RA-P4 Problematic data actions, likelihoods, and impacts are used to determine and prioritize risk.: with 2.4 through FSC Fintech Series Guidance Notes 4, responsible use of artificial intelligence in financial services, Mauritius

No NIST AI 200-2 step on the same duties

Laws reach these, but no duty that reaches one of them also reaches a NIST AI 200-2 step.

ID.IM-P2 Owners or operators (e.g., the organization or third parties such as service..., 2 laws
ID.IM-P4 Data actions of the systems/products/services are inventoried., 37 laws
ID.IM-P5 The purposes for the data actions are inventoried., 1 law
ID.IM-P6 Data elements within the data actions are inventoried., 7 laws
ID.IM-P7 The data processing environment is identified (e.g., geographic location, internal,..., 17 laws
ID.BE-P1 The organization’s role(s) in the data processing ecosystem are identified and communicated., 3 laws
ID.BE-P3 Systems/products/services that support organizational priorities are identified and..., 1 law
ID.RA-P3 Potential problematic data actions and associated problems are identified., 5 laws
ID.RA-P5 Risk responses are identified, prioritized, and implemented., 15 laws
ID.DE-P1 Data processing ecosystem risk management policies, processes, and procedures are..., 1 law
ID.DE-P2 Data processing ecosystem parties (e.g., service providers, customers, partners,..., 29 laws
ID.DE-P3 Contracts with data processing ecosystem parties are used to implement appropriate..., 77 laws
ID.DE-P5 Data processing ecosystem parties are routinely assessed using audits, test results,..., 7 laws
GV.PO-P1 Organizational privacy values and policies (e.g., conditions on data processing such..., 98 laws
GV.PO-P2 Processes to instill organizational privacy values within system/product/service..., 50 laws
GV.PO-P3 Roles and responsibilities for the workforce are established with respect to privacy., 54 laws
GV.PO-P4 Privacy roles and responsibilities are coordinated and aligned with third-party..., 10 laws
GV.RM-P1 Risk management processes are established, managed, and agreed to by organizational..., 1 law
GV.AT-P1 The workforce is informed and trained on its roles and responsibilities., 9 laws
GV.AT-P3 Privacy personnel understand their roles and responsibilities., 1 law
GV.MT-P1 Privacy risk is re-evaluated on an ongoing basis and as key factors, including the..., 2 laws
GV.MT-P3 Policies, processes, and procedures for assessing compliance with legal requirements..., 16 laws
GV.MT-P4 Policies, processes, and procedures for communicating progress on managing privacy..., 7 laws
GV.MT-P5 Policies, processes, and procedures are established and in place to receive, analyze,..., 3 laws
GV.MT-P6 Policies, processes, and procedures incorporate lessons learned from problematic data actions., 1 law
GV.MT-P7 Policies, processes, and procedures for receiving, tracking, and responding to..., 32 laws
CT.PO-P2 Policies, processes, and procedures for enabling data review, transfer, sharing or..., 233 laws
CT.PO-P3 Policies, processes, and procedures for enabling individuals’ data processing..., 371 laws
CT.DM-P1 Data elements can be accessed for review., 69 laws
CT.DM-P2 Data elements can be accessed for transmission or disclosure., 22 laws
CT.DM-P3 Data elements can be accessed for alteration., 23 laws
CT.DM-P4 Data elements can be accessed for deletion., 22 laws
CT.DM-P5 Data are destroyed according to policy., 104 laws
CT.DM-P6 Data are transmitted using standardized formats., 8 laws
CT.DM-P7 Mechanisms for transmitting processing permissions and related data values with data..., 1 law
CT.DM-P9 Technical measures implemented to manage data processing are tested and assessed., 2 laws
CT.DP-P1 Data are processed to limit observability and linkability (e.g., data actions take..., 8 laws
CT.DP-P2 Data are processed to limit the identification of individuals (e.g., de-identification..., 10 laws
CT.DP-P4 System or device configurations permit selective collection or disclosure of data elements., 10 laws
CT.DP-P5 Attribute references are substituted for attribute values., 1 law
CM.PO-P1 Transparency policies, processes, and procedures for communicating data processing..., 2 laws
CM.AW-P2 Mechanisms for obtaining feedback from individuals (e.g., surveys or focus groups)..., 1 law
CM.AW-P3 System/product/service design enables data processing visibility., 13 laws
CM.AW-P4 Records of data disclosures and sharing are maintained and can be accessed for review..., 12 laws
CM.AW-P5 Data corrections or deletions can be communicated to individuals or organizations..., 54 laws
CM.AW-P6 Data provenance and lineage are maintained and can be accessed for review or..., 2 laws
CM.AW-P7 Impacted individuals and organizations are notified about a privacy breach or event., 243 laws
CM.AW-P8 Individuals are provided with mitigation mechanisms (e.g., credit monitoring, consent..., 5 laws
PR.PO-P1 A baseline configuration of information technology is created and maintained..., 1 law
PR.PO-P2 Configuration change control processes are established and in place., 2 laws
PR.PO-P3 Backups of information are conducted, maintained, and tested., 10 laws
PR.PO-P5 Protection processes are improved., 7 laws
PR.PO-P7 Response plans (Incident Response and Business Continuity) and recovery plans..., 131 laws
PR.PO-P8 Response and recovery plans are tested., 9 laws
PR.PO-P9 Privacy procedures are included in human resources practices (e.g., deprovisioning,..., 14 laws
PR.PO-P10 A vulnerability management plan is developed and implemented., 25 laws
PR.AC-P1 Identities and credentials are issued, managed, verified, revoked, and audited for..., 6 laws
PR.AC-P2 Physical access to data and devices is managed., 6 laws
PR.AC-P4 Access permissions and authorizations are managed, incorporating the principles of..., 34 laws
PR.AC-P5 Network integrity is protected (e.g., network segregation, network segmentation)., 2 laws
PR.AC-P6 Individuals and devices are proofed and bound to credentials, and authenticated..., 11 laws
PR.DS-P1 Data-at-rest are protected., 14 laws
PR.DS-P2 Data-in-transit are protected., 21 laws
PR.DS-P3 Systems/products/services and associated data are formally managed throughout removal,..., 3 laws
PR.DS-P4 Adequate capacity to ensure availability is maintained., 1 law
PR.DS-P5 Protections against data leaks are implemented., 153 laws
PR.MA-P1 Maintenance and repair of organizational assets are performed and logged, with..., 1 law
PR.PT-P1 Removable media is protected and its use restricted according to policy., 2 laws
PR.PT-P2 The principle of least functionality is incorporated by configuring systems to provide..., 2 laws
PR.PT-P3 Communications and control networks are protected., 1 law
PR.PT-P4 Mechanisms (e.g., failsafe, load balancing, hot swap) are implemented to achieve..., 6 laws

No law we track reaches these

No duty in the laws we track reaches these controls.

ID.IM-P3 Categories of individuals (e.g., customers, employees or prospective employees,...
ID.IM-P8 Data processing is mapped, illustrating the data actions and associated data elements...
ID.BE-P2 Priorities for organizational mission, objectives, and activities are established and...
ID.RA-P1 Contextual factors related to the systems/products/services and the data actions are...
ID.DE-P4 Interoperability frameworks or similar multi-party approaches are used to manage data...
GV.PO-P6 Governance and risk management policies, processes, and procedures address privacy risks.
GV.RM-P2 Organizational risk tolerance is determined and clearly expressed.
GV.RM-P3 The organization’s determination of risk tolerance is informed by its role(s) in the...
GV.AT-P2 Senior executives understand their roles and responsibilities.
GV.AT-P4 Third parties (e.g., service providers, customers, partners) understand their roles...
GV.MT-P2 Privacy values, policies, and training are reviewed and any updates are communicated.
CT.PO-P4 A data life cycle to manage data is aligned and implemented with the system...
CT.DP-P3 Data are processed to limit the formulation of inferences about individuals’ behavior...
CM.PO-P2 Roles and responsibilities (e.g., public relations) for communicating data processing...
PR.PO-P4 Policy and regulations regarding the physical operating environment for organizational...
PR.PO-P6 Effectiveness of protection technologies is shared.
PR.AC-P3 Remote access is managed.
PR.DS-P6 Integrity checking mechanisms are used to verify software, firmware, and information integrity.
PR.DS-P7 The development and testing environment(s) are separate from the production environment.
PR.DS-P8 Integrity checking mechanisms are used to verify hardware integrity.
PR.MA-P2 Remote maintenance of organizational assets is approved, logged, and performed in a...

Lines of the news aggregation laws we track were not read against the NIST Privacy Framework, so none of them connects the two here (how each subject's lines were read).

How these connections are drawn

Each requirement line in the laws we track is read against the framework for its subject (the AI, scraping and news aggregation laws against the NIST AI RMF, the privacy, communications and age assurance laws against the NIST Privacy Framework, the cybersecurity laws against the NIST CSF 2.0); laws on liability and content moderation are not read against any framework yet. A line reaches the NIST AI 200-2 through a kind of duty its law carries, and only where that kind of duty also reaches, on that same line, the NIST framework for the line's own subject. Two controls connect when lines in at least 2 laws reach both. That says the same duties reach both; it does not say the two are alike, or that running either one does what a law asks.

A line placed on a control in the framework for its own subject, whose law carries a kind of duty that reaches another of the three frameworks read line by line, is read against that one as well: every such line, or only those whose wording reaches into it. For these two:

Laws on	Read against the NIST Privacy Framework
AI	such lines on personal data and privacy, biometrics, likeness and identity, profiling, surveillance and consent
scraping	such lines on interception, monitoring, personal data and privacy
news aggregation	not read

Every duty line in the AI and scraping laws we track has been read against the framework for its subject.