Annexwright / Free crosswalk
Free reference · Annexwright
ISO/IEC 42001 × NIST AI RMF × EU AI Act × ISO/IEC 27001 crosswalk
A control-by-control mapping of ISO/IEC 42001:2023 clauses and Annex A controls against NIST AI RMF 1.0, the EU AI Act, and ISO/IEC 27001:2022 — so you can see how much of an existing information security programme already carries over, and where it genuinely does not.
Built September 2026, after the Digital Omnibus (Regulation (EU) 2026/1744) came into force on 27 July 2026 and moved the dates: Article 50 transparency applicable from 2 August 2026, machine-readable marking grace to 2 December 2026, Annex III high-risk deferred to 2 December 2027, Annex I to 2 August 2028. Material written before August 2026 states superseded deadlines.
The mapping
| ISO/IEC 42001 | Title | NIST AI RMF 1.0 | EU AI Act | ISO/IEC 27001:2022 | Notes |
|---|---|---|---|---|---|
| Clause 4 | Context of the organization | GOVERN 1.1–1.2, MAP 1.1 | Art. 2 (scope), Art. 3 (definitions) | Clause 4 | Determining your role (provider/deployer) is the highest-value step |
| Clause 5.2 | AI policy | GOVERN 1.1, 1.2 | Art. 4 (literacy culture), Art. 26 (deployer duties) | Clause 5.2 / A.5.1 | One policy set can cover both AI and information security if cross-referenced |
| Clause 5.3 / A.3.2 | Roles and responsibilities | GOVERN 2.1–2.3 | Art. 26(2) (human oversight assignment) | Clause 5.3 / A.5.2 | Name individuals, not departments |
| A.3.3 | Reporting of concerns | GOVERN 4.3 | Art. 87 (reporting of infringements) | A.6.8 | Reuse an existing whistleblowing channel |
| Clause 6.1.2 / 8.2 | AI risk assessment | MAP 1–5, MEASURE 2 | Art. 9 (risk management for high-risk) | Clause 6.1.2 / 8.2 | Article 9 is a lifecycle risk management system, broader than a register |
| Clause 6.1.3 | Risk treatment and SoA | MANAGE 1–2 | Art. 9(5) (residual risk acceptability) | Clause 6.1.3 / A.5.x | SoA format is directly transferable from ISO 27001 practice |
| Clause 6.1.4 / A.5.2–A.5.5 | AI system impact assessment | MAP 5.1–5.2, MEASURE 2.11 | Art. 27 (FRIA), Art. 9 | A.5.34 (privacy) — partial | A DPIA is not an AI impact assessment; run both where personal data is processed |
| Clause 7.2 / A.4.6 | Competence | GOVERN 3.2, 4.1 | Art. 4 (AI literacy), Art. 26(2) | Clause 7.2 / A.6.3 | Article 4 duty applies now and is frequently overlooked |
| Clause 7.4 / A.8.x | Communication and information | GOVERN 4.2, MAP 3.4 | Art. 50 (transparency), Art. 13 (instructions for use) | A.5.14 | Art. 50 is in force since 2 Aug 2026 — see AW-E11 |
| Clause 7.5 | Documented information | GOVERN 1.4, MAP 4.1 | Art. 11 + Annex IV (technical documentation), Art. 18 | Clause 7.5 / A.5.37 | Annex IV is far more prescriptive than Clause 7.5 |
| A.6.1.2–A.6.1.3 | Responsible development objectives and processes | GOVERN 1.3, MAP 2.3 | Art. 9, Art. 17 (quality management system) | A.8.25 (secure development) | Extend your SDLC rather than creating a second one |
| A.6.2.2–A.6.2.3 | Requirements, specification and design documentation | MAP 2.1–2.3 | Art. 11, Annex IV(1)–(2) | A.8.27 | |
| A.6.2.4 | Verification and validation | MEASURE 1–2, 2.5–2.9 | Art. 15 (accuracy, robustness, cybersecurity) | A.8.29 (security testing) | Set thresholds before testing or the evidence is worthless |
| A.6.2.5 | Deployment | MANAGE 1.3, 4.1 | Art. 16, Art. 26 | A.8.31–A.8.32 | |
| A.6.2.6 | Operation and monitoring | MEASURE 3–4, MANAGE 4.1 | Art. 26(5) (deployer monitoring), Art. 72 (post-market monitoring) | A.8.16 (monitoring) | |
| A.6.2.7 | Technical documentation | MAP 4.1, GOVERN 1.4 | Art. 11 + Annex IV, Art. 53 (GPAI) | A.5.37 | |
| A.6.2.8 | Event logs | MEASURE 2.6, MANAGE 4.1 | Art. 12 (record-keeping), Art. 19 (log retention) | A.8.15 (logging) | Log retention duties under the Act can exceed your default policy |
| A.7.2–A.7.6 | Data governance for AI | MAP 2.3, MEASURE 2.2 | Art. 10 (data and data governance) | A.5.12–A.5.14, A.8.10–A.8.11 | Art. 10 requires representativeness and bias examination for high-risk |
| A.8.2 | Information for users | GOVERN 5.1, MAP 3.4 | Art. 13 (instructions for use), Art. 50(1) | A.5.14 | |
| A.8.3 | External reporting | GOVERN 4.3, 5.2 | Art. 85 (right to lodge complaint), Art. 87 | A.6.8 | |
| A.8.4 | Communication of incidents | MANAGE 4.3 | Art. 73 (serious incident reporting) | A.5.24–A.5.26 | Art. 73 timelines are short — build them into the incident procedure |
| A.9.2–A.9.4 | Responsible use and intended purpose | GOVERN 5, MANAGE 2.2 | Art. 5 (prohibited), Art. 26(1) (use per instructions) | A.5.10 (acceptable use) | Using a system outside its intended purpose can make you the provider |
| A.10.2–A.10.4 | Third parties, suppliers and customers | GOVERN 6.1–6.2, MAP 4.1 | Art. 25 (value chain), Art. 28, Art. 53 | A.5.19–A.5.23 | Contract clauses do most of the work here |
| Clause 9.1 | Monitoring and measurement | MEASURE 1–4 | Art. 72 (post-market monitoring plan) | Clause 9.1 | |
| Clause 9.2 | Internal audit | GOVERN 4.1 | No direct equivalent (but supports Art. 17 QMS) | Clause 9.2 | |
| Clause 9.3 | Management review | GOVERN 1.5 | No direct equivalent | Clause 9.3 | |
| Clause 10 | Improvement and corrective action | MANAGE 4.2–4.3 | Art. 20 (corrective actions), Art. 73 | Clause 10 | |
| — | Human oversight (spread across A.6, A.9) | MEASURE 2.8, MANAGE 2.3–2.4 | Art. 14 (human oversight), Art. 26(2) | No direct equivalent | The Act is far more prescriptive than the standard here — see AW-E12 |
| — | Transparency to individuals | GOVERN 5.1, MAP 3.4 | Art. 50(1)–(4) | No direct equivalent | Legal duty with fixed dates; no standard substitutes for it |
| — | Prohibited practices | MAP 1.1, GOVERN 1.1 | Art. 5 | No direct equivalent | Absolute prohibition — screening belongs in every impact assessment |
Want this as a working file?
The same crosswalk as an Excel workbook, with reference tabs for the EU AI Act articles and the NIST functions, is free — no email required. It is a complete document from the paid set, not a teaser.
The crosswalk maps requirements across frameworks; it does not include the documents themselves. If you need those documents — AI governance policy, system inventory, risk register, impact assessment, human oversight procedure, transparency notices and an enterprise questionnaire answer bank — that is Annexwright Essentials, 20 documents for $149.
How to use it
Start from the ISO/IEC 42001 column. For each clause or Annex A control, check what you already hold under ISO/IEC 27001 — for many organisations a substantial part of clauses 4 to 10 maps across, because the management-system structure is shared. What does not map across is usually the AI-specific substance: impact assessment, data governance for training data, human oversight, and the transparency duties under Article 50.
The EU AI Act column tells you which obligations attach, but your role matters more than the mapping: a provider and a deployer of the same system carry different duties. Determine that first.