Law / Frameworks / Crosswalk / NIST Privacy Framework to NIST AI RMF
The NIST Privacy Framework, mapped to the NIST AI Risk Management Framework
12 of NIST Privacy Framework's controls connect to 15 of NIST AI RMF's through 177 laws in 117 jurisdictions. Two controls connect when the same duties, in at least 2 laws we track, reach both. The connections are our own reading of the law; no framework publisher has reviewed or endorsed them.
- From
- NIST Privacy Framework, version 1.0, January 2020, National Institute of Standards and Technology
- To
- NIST AI Risk Management Framework, version 1.0, January 2023 (NIST AI 100-1), National Institute of Standards and Technology
- See also
- NIST AI RMF to NIST Privacy Framework, the other way · every pair in the crosswalk · law library as of
Download this mapping, with every law behind each connection: nist-ai-rmf--nist-privacy-framework.csv · nist-ai-rmf--nist-privacy-framework.json
Not connected to the NIST AI RMF: 88 of NIST Privacy Framework's controls
Short of 2 laws
The same duties reach these and a NIST AI RMF control, in fewer than 2 of the laws we track.
- ID.IM-P4 Data actions of the systems/products/services are inventoried.: with MEASURE 2.4 through SPDP Norma General guaranteeing personal-data protection in the use of AI systems, Ecuador
- ID.IM-P6 Data elements within the data actions are inventoried.: with MAP 2.3 through Generative AI Training Data Transparency Act (AB 2013), California
- ID.RA-P3 Potential problematic data actions and associated problems are identified.: with MEASURE 2.9 and MEASURE 2.11 through OSFI Guideline E-23, Model Risk Management (2027), Canada
- ID.RA-P5 Risk responses are identified, prioritized, and implemented.: with MANAGE 1.3 through Superintendencia Circular on AI and Personal Data, Colombia; with MANAGE 2.4 through Platform Work Directive, Transparency, Human Oversight and Human Review of Automated Systems (Articles 9 to 11), European Union
- ID.DE-P3 Contracts with data processing ecosystem parties are used to implement appropriate...: with GOVERN 6.1 through Central Bank of Jordan Artificial Intelligence Framework for the Banking Sector, Version 1.0, Jordan
- GV.PO-P1 Organizational privacy values and policies (e.g., conditions on data processing such...: with MAP 4.1 through Cyber and Data Protection Act [Chapter 12:07], Zimbabwe
- GV.PO-P2 Processes to instill organizational privacy values within system/product/service...: with GOVERN 1.2 through Council of Europe Framework Convention on AI, Georgia's signature, Georgia; with MAP 1.6 through Nigeria Data Protection Act, 2023, sensitive personal data and a child's data, Nigeria
- GV.PO-P3 Roles and responsibilities for the workforce are established with respect to privacy.: with GOVERN 3.2 through Platform Work Directive, Transparency, Human Oversight and Human Review of Automated Systems (Articles 9 to 11), European Union
- GV.RM-P1 Risk management processes are established, managed, and agreed to by organizational...: with MANAGE 1.3 through Superintendencia Circular on AI and Personal Data, Colombia
- GV.MT-P3 Policies, processes, and procedures for assessing compliance with legal requirements...: with MEASURE 2.4 through SPDP Norma General guaranteeing personal-data protection in the use of AI systems, Ecuador
- CT.PO-P2 Policies, processes, and procedures for enabling data review, transfer, sharing or...: with MAP 1.6 through Marco Civil da Internet, Protection of Records and Personal Data, Brazil; with MAP 2.3 through Superintendencia Circular on AI and Personal Data, Colombia; with MEASURE 2.10 through Attorney, Court Filing and Arbitrator Generative AI Duties (SB 574), California
- CT.DM-P1 Data elements can be accessed for review.: with MEASURE 2.9 through Loi n° 24.001 portant protection des données à caractère personnel, droits liés au traitement, Central African Republic
- CT.DP-P2 Data are processed to limit the identification of individuals (e.g., de-identification...: with MAP 1.6 through Superintendencia Circular on AI and Personal Data, Colombia
- CT.DP-P4 System or device configurations permit selective collection or disclosure of data elements.: with MEASURE 2.10 through California AI Transparency Act (SB 942, as amended by AB 853, SB 1000 and AB 2713), California
- PR.PO-P2 Configuration change control processes are established and in place.: with MEASURE 1.2 through Counter-Fraud Framework: fraud detection systems, machine learning and artificial intelligence, Saudi Arabia
- PR.DS-P5 Protections against data leaks are implemented.: with MEASURE 2.7 through Superintendencia Circular on AI and Personal Data, Colombia
No NIST AI RMF control on the same duties
Laws reach these, but no duty that reaches one of them also reaches a NIST AI RMF control.
- ID.IM-P2 Owners or operators (e.g., the organization or third parties such as service..., 2 laws
- ID.IM-P5 The purposes for the data actions are inventoried., 1 law
- ID.IM-P7 The data processing environment is identified (e.g., geographic location, internal,..., 17 laws
- ID.BE-P1 The organization’s role(s) in the data processing ecosystem are identified and communicated., 3 laws
- ID.BE-P3 Systems/products/services that support organizational priorities are identified and..., 1 law
- ID.DE-P1 Data processing ecosystem risk management policies, processes, and procedures are..., 1 law
- ID.DE-P2 Data processing ecosystem parties (e.g., service providers, customers, partners,..., 29 laws
- ID.DE-P5 Data processing ecosystem parties are routinely assessed using audits, test results,..., 7 laws
- GV.PO-P4 Privacy roles and responsibilities are coordinated and aligned with third-party..., 10 laws
- GV.AT-P1 The workforce is informed and trained on its roles and responsibilities., 9 laws
- GV.AT-P3 Privacy personnel understand their roles and responsibilities., 1 law
- GV.MT-P1 Privacy risk is re-evaluated on an ongoing basis and as key factors, including the..., 2 laws
- GV.MT-P4 Policies, processes, and procedures for communicating progress on managing privacy..., 7 laws
- GV.MT-P5 Policies, processes, and procedures are established and in place to receive, analyze,..., 3 laws
- GV.MT-P6 Policies, processes, and procedures incorporate lessons learned from problematic data actions., 1 law
- GV.MT-P7 Policies, processes, and procedures for receiving, tracking, and responding to..., 32 laws
- CT.DM-P2 Data elements can be accessed for transmission or disclosure., 22 laws
- CT.DM-P3 Data elements can be accessed for alteration., 23 laws
- CT.DM-P4 Data elements can be accessed for deletion., 22 laws
- CT.DM-P6 Data are transmitted using standardized formats., 8 laws
- CT.DM-P7 Mechanisms for transmitting processing permissions and related data values with data..., 1 law
- CT.DM-P9 Technical measures implemented to manage data processing are tested and assessed., 2 laws
- CT.DP-P1 Data are processed to limit observability and linkability (e.g., data actions take..., 8 laws
- CT.DP-P5 Attribute references are substituted for attribute values., 1 law
- CM.PO-P1 Transparency policies, processes, and procedures for communicating data processing..., 2 laws
- CM.AW-P2 Mechanisms for obtaining feedback from individuals (e.g., surveys or focus groups)..., 1 law
- CM.AW-P4 Records of data disclosures and sharing are maintained and can be accessed for review..., 12 laws
- CM.AW-P5 Data corrections or deletions can be communicated to individuals or organizations..., 54 laws
- CM.AW-P6 Data provenance and lineage are maintained and can be accessed for review or..., 2 laws
- CM.AW-P7 Impacted individuals and organizations are notified about a privacy breach or event., 243 laws
- PR.PO-P1 A baseline configuration of information technology is created and maintained..., 1 law
- PR.PO-P3 Backups of information are conducted, maintained, and tested., 10 laws
- PR.PO-P5 Protection processes are improved., 7 laws
- PR.PO-P7 Response plans (Incident Response and Business Continuity) and recovery plans..., 131 laws
- PR.PO-P8 Response and recovery plans are tested., 9 laws
- PR.PO-P9 Privacy procedures are included in human resources practices (e.g., deprovisioning,..., 14 laws
- PR.PO-P10 A vulnerability management plan is developed and implemented., 25 laws
- PR.AC-P1 Identities and credentials are issued, managed, verified, revoked, and audited for..., 6 laws
- PR.AC-P2 Physical access to data and devices is managed., 6 laws
- PR.AC-P4 Access permissions and authorizations are managed, incorporating the principles of..., 34 laws
- PR.AC-P5 Network integrity is protected (e.g., network segregation, network segmentation)., 2 laws
- PR.AC-P6 Individuals and devices are proofed and bound to credentials, and authenticated..., 11 laws
- PR.DS-P1 Data-at-rest are protected., 14 laws
- PR.DS-P2 Data-in-transit are protected., 21 laws
- PR.DS-P3 Systems/products/services and associated data are formally managed throughout removal,..., 3 laws
- PR.DS-P4 Adequate capacity to ensure availability is maintained., 1 law
- PR.MA-P1 Maintenance and repair of organizational assets are performed and logged, with..., 1 law
- PR.PT-P1 Removable media is protected and its use restricted according to policy., 2 laws
- PR.PT-P2 The principle of least functionality is incorporated by configuring systems to provide..., 2 laws
- PR.PT-P3 Communications and control networks are protected., 1 law
- PR.PT-P4 Mechanisms (e.g., failsafe, load balancing, hot swap) are implemented to achieve..., 6 laws
No law we track reaches these
No duty in the laws we track reaches these controls.
- ID.IM-P3 Categories of individuals (e.g., customers, employees or prospective employees,...
- ID.IM-P8 Data processing is mapped, illustrating the data actions and associated data elements...
- ID.BE-P2 Priorities for organizational mission, objectives, and activities are established and...
- ID.RA-P1 Contextual factors related to the systems/products/services and the data actions are...
- ID.DE-P4 Interoperability frameworks or similar multi-party approaches are used to manage data...
- GV.PO-P6 Governance and risk management policies, processes, and procedures address privacy risks.
- GV.RM-P2 Organizational risk tolerance is determined and clearly expressed.
- GV.RM-P3 The organization’s determination of risk tolerance is informed by its role(s) in the...
- GV.AT-P2 Senior executives understand their roles and responsibilities.
- GV.AT-P4 Third parties (e.g., service providers, customers, partners) understand their roles...
- GV.MT-P2 Privacy values, policies, and training are reviewed and any updates are communicated.
- CT.PO-P4 A data life cycle to manage data is aligned and implemented with the system...
- CT.DP-P3 Data are processed to limit the formulation of inferences about individuals’ behavior...
- CM.PO-P2 Roles and responsibilities (e.g., public relations) for communicating data processing...
- PR.PO-P4 Policy and regulations regarding the physical operating environment for organizational...
- PR.PO-P6 Effectiveness of protection technologies is shared.
- PR.AC-P3 Remote access is managed.
- PR.DS-P6 Integrity checking mechanisms are used to verify software, firmware, and information integrity.
- PR.DS-P7 The development and testing environment(s) are separate from the production environment.
- PR.DS-P8 Integrity checking mechanisms are used to verify hardware integrity.
- PR.MA-P2 Remote maintenance of organizational assets is approved, logged, and performed in a...
Lines of the news aggregation laws we track were not read against the NIST Privacy Framework, so none of them connects the two here (how each subject's lines were read).
Lines of the communications, age assurance and cybersecurity laws we track were not read against the NIST AI RMF, so none of them connects the two here (how each subject's lines were read).
How these connections are drawn
Each requirement line in the laws we track is read against the framework for its subject (the AI, scraping and news aggregation laws against the NIST AI RMF, the privacy, communications and age assurance laws against the NIST Privacy Framework, the cybersecurity laws against the NIST CSF 2.0); laws on liability and content moderation are not read against any framework yet. Both are read line by line, so a line connects them only where it was read against both and placed on each. Two controls connect when lines in at least 2 laws reach both. That says the same duties reach both; it does not say the two are alike, or that running either one does what a law asks.
A line placed on a control in the framework for its own subject, whose law carries a kind of duty that reaches another of the three frameworks read line by line, is read against that one as well: every such line, or only those whose wording reaches into it. For these two:
| Laws on | Read against the NIST Privacy Framework | Read against the NIST AI RMF |
|---|---|---|
| AI | such lines on personal data and privacy, biometrics, likeness and identity, profiling, surveillance and consent | every line (their own framework) |
| scraping | such lines on interception, monitoring, personal data and privacy | every line (their own framework) |
| news aggregation | not read | every line (their own framework) |
| privacy | every line (their own framework) | such lines on automated decisions, profiling and AI |
| communications | every line (their own framework) | not read |
| age assurance | every line (their own framework) | not read |
| cybersecurity | every such line | not read |
Every duty line in the AI, scraping and privacy laws we track has been read against the framework for its subject.