LexLint framework crosswalk, law library as of 2026-10-19

Each row names two controls in two different governance frameworks and the laws in the
LexLint law library whose duties reach both. The same duties reach both; that says nothing
about whether the two controls are alike, or whether running either one does what a law asks.
The mapping is our own reading of the law; no framework publisher has reviewed or endorsed it.

A row is listed when at least two laws share it. evidence is "line" when the same
requirement line was read against both frameworks and placed on each control, and "class"
when a control was reached through a kind of duty its law carries, confirmed against the
NIST control the same line reaches in the framework for its own subject. publisher_maps names
a publisher whose own crosswalk maps the same two controls.

Files: index.json; one <a>--<b>.json and <a>--<b>.csv per pair of frameworks; all-pairs.csv.
These files: 2026-10-19 edition, offered under CC BY 4.0 by LexLint (UnGovr).

The frameworks' ids are their publishers':
- OWASP GenAI Security Project, OWASP Top 10 for LLM Applications 2026, https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/, licensed CC BY-SA 4.0 (https://creativecommons.org/licenses/by-sa/4.0/). Excerpted: only the first paragraph of each entry's Description is reproduced, verbatim.
- OWASP GenAI Security Project, Agentic Security Initiative, OWASP Top 10 for Agentic Applications 2026, https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/, licensed CC BY-SA 4.0 (https://creativecommons.org/licenses/by-sa/4.0/). Excerpted: only the first paragraph of each entry's Description is reproduced, verbatim.
- MIT AI Risk Initiative (MIT FutureTech), AI Risk Mitigation Taxonomy, https://airisk.mit.edu/ai-risk-mitigations. Data from the MIT AI Risk Initiative is licensed under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Cite as: Mapping AI Risk Mitigations: Evidence Scan & Draft Mitigation Taxonomy, https://airisk.mit.edu/blog/mapping-ai-risk-mitigations
- FINOS AI Governance Framework, https://air-governance-framework.finos.org/, copyright 2025 FINOS, licensed under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Titles and purpose text are quoted; markdown emphasis and links were removed.
- ENISA Technical Implementation Guidance on Commission Implementing Regulation (EU) 2024/2690, version 1.0 (June 2025), © European Union Agency for Cybersecurity (ENISA), 2025, licensed under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). The section titles and requirement text are the Annex to Implementing Regulation (EU) 2024/2690 as ENISA prints it (© European Union, https://eur-lex.europa.eu); each section carries its first point as its text, and ENISA's guidance, examples of evidence and tips are not reproduced.
- Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI (https://www.etsi.org/deliver/etsi_en/304200_304299/304223/02.01.01_60/en_304223v020101p.pdf).