AI governance framework crosswalk: ISO/IEC 42001, NIST AI RMF, EU AI Act, AI6 and NSW AIAF

An AI governance framework crosswalk shows where ISO/IEC 42001, the NIST AI RMF, the EU AI Act, AI6 and the NSW AIAF ask for the same work, so you can do that work once and reuse it for each. Most organisations answer to more than one AI framework. A multinational may need to meet the EU AI Act, align to the NIST AI RMF for its US operations and pursue ISO/IEC 42001 certification. An Australian state agency applies the NSW AIAF and draws on AI6. Doing the work separately for each wastes effort and produces records that disagree. This crosswalk maps where the frameworks overlap, discipline by discipline, so the work can be done once.

The frameworks at a glance

They differ first in force and reach.

• ISO/IEC 42001:2023 is an international standard for an AI management system. It is certifiable by accredited bodies. Its clauses set the management system, and Annex A lists reference controls.
• NIST AI Risk Management Framework (AI RMF 1.0) is voluntary US guidance organised into four functions, Govern, Map, Measure and Manage, with a Generative AI Profile.
• The EU AI Act (Regulation (EU) 2024/1689) is law. Its duties depend on your role, as a provider (who develops or supplies the system) or a deployer (who uses it), and on the system’s risk class. Following Regulation (EU) 2026/1744, the high-risk requirements apply from 2 December 2027 for Annex III systems and 2 August 2028 for Annex I systems.
• Guidance for AI Adoption (AI6), published by the National AI Centre in the Department of Industry, Science and Resources on 21 October 2025, sets out six essential practices for Australian organisations. It replaced the Voluntary AI Safety Standard.
• The NSW AI Assessment Framework is a risk self-assessment mandatory for NSW Government agencies, completed on the AIAF Platform since 30 September 2026.
• The Privacy Act automated decision-making (ADM) provisions (Australia, APP 1.7 to 1.9, from 10 December 2026) are law and narrow, covering what a privacy policy must say about automated decisions.

The crosswalk

Accountability and roles

• ISO/IEC 42001. Clause 5 on leadership, with roles and responsibilities assigned, and Annex A controls on internal organisation.
• NIST AI RMF. The Govern function, including accountability structures and defined roles.
• EU AI Act. Providers run a quality management system (Article 17). Deployers assign human oversight to competent people (Article 26) and support AI literacy (Article 4).
• AI6. Practice 1, decide who is accountable.
• NSW AIAF. A responsible officer for each use case, an accountable official in each agency, and AI Review Committee review for high or critical risk.
• Privacy Act ADM. The entity is accountable for an accurate privacy policy.

Knowing what you run

• ISO/IEC 42001. Clause 4 on the organisation’s context and the AI systems within scope, with Annex A controls on documenting AI system resources.
• NIST AI RMF. Govern 1.6 calls for mechanisms to inventory AI systems. Map establishes each system’s context.
• EU AI Act. Obligations attach system by system, so each system must be identified and classified. Certain high-risk systems are registered in the EU database (Article 49).
• AI6. An AI register is part of the practices.
• NSW AIAF. Every AI use case is registered on the AIAF Platform.
• Privacy Act ADM. You must identify the systems that make or substantially contribute to in-scope decisions.

Risk management

• ISO/IEC 42001. AI risk assessment and treatment in clause 6.1, carried out in operation under clause 8.
• NIST AI RMF. Map identifies risks, Measure analyses them, Manage prioritises and treats them.
• EU AI Act. Providers run a risk management system across the system’s life (Article 9).
• AI6. Practice 3, measure and manage risks.
• NSW AIAF. The assessment sets an overall risk level and mandatory assurance activities, the checks and reviews that risk level requires.
• Privacy Act ADM. Not risk-based.

Effect on people

• ISO/IEC 42001. AI system impact assessment (clause 6.1.4 and Annex A), with ISO/IEC 42005:2025 as guidance on how to do it.
• NIST AI RMF. Map 5 characterises impacts on individuals, groups, communities and society.
• EU AI Act. The fundamental rights impact assessment for certain deployers (Article 27).
• AI6. Practice 2, understand impacts and plan accordingly.
• NSW AIAF. Mandatory assurance activities can include privacy and human rights reviews.
• Privacy Act ADM. Turns on decisions that could significantly affect an individual’s rights or interests.

Transparency

• ISO/IEC 42001. Annex A controls on information for interested parties.
• NIST AI RMF. Accountable and transparent is one of the characteristics of trustworthy AI, with documentation across the functions.
• EU AI Act. Instructions for use from providers (Article 13), transparency duties (Article 50), informing affected people (Article 26(11)) and the right to an explanation (Article 86).
• AI6. Practice 4, share essential information.
• NSW AIAF. Transparency, explainability and contestability under Australia’s AI Ethics Principles.
• Privacy Act ADM. A specific privacy policy disclosure of the kinds of personal information used and the kinds of decisions made.

Human oversight

• ISO/IEC 42001. Annex A controls on the responsible use of AI systems, including human oversight.
• NIST AI RMF. Govern and Map call for defined human roles and processes for human oversight.
• EU AI Act. Systems designed for effective oversight (Article 14), and deployers assigning it (Article 26).
• AI6. Practice 6, maintain human control.
• NSW AIAF. Human oversight under the accountability and human-centred principles.
• Privacy Act ADM. Distinguishes solely automated decisions from those a person substantially makes.

Testing and monitoring

• ISO/IEC 42001. Clause 9 on performance evaluation, and Annex A controls on operation and monitoring.
• NIST AI RMF. Measure covers testing and evaluation. Manage 4 covers post-deployment monitoring.
• EU AI Act. Accuracy, robustness and cybersecurity (Article 15), post-market monitoring by providers (Article 72) and monitoring by deployers (Article 26).
• AI6. Practice 5, test and monitor.
• NSW AIAF. Reassessment when features, datasets, purpose or decision context change significantly.
• Privacy Act ADM. Not addressed directly.

Incidents

• ISO/IEC 42001. Clause 10 on nonconformity and corrective action, and Annex A controls on communicating incidents.
• NIST AI RMF. Manage 4 covers incidents and errors being communicated and tracked.
• EU AI Act. Serious incident reporting by providers (Article 73) and by deployers to providers and authorities (Article 26).
• AI6. Within practices 3 and 5, with incidents feeding back into risk management.
• NSW AIAF. Reassessment after material change, alongside agency incident processes.
• Privacy Act ADM. Not addressed. In Australia, the Notifiable Data Breaches scheme covers breaches involving personal information.

Records

• ISO/IEC 42001. Clause 7.5 on documented information, which certification audits examine.
• NIST AI RMF. Documentation throughout, so decisions can be reviewed.
• EU AI Act. Technical documentation (Article 11), logging (Article 12) and deployer log retention of at least six months (Article 26).
• AI6. Records of decisions, testing and monitoring as part of the practices.
• NSW AIAF. Decisions recorded and evidence retained under agency records requirements.
• Privacy Act ADM. The privacy policy kept reconciled to the systems in use.

Reading the overlaps

Knowing what you run is the foundation. Every framework depends on it and none can substitute for it. NIST names the inventory directly. The EU AI Act cannot be applied without knowing which systems are high-risk. The NSW AIAF registers every use case. If you invest in one thing first, an accurate register pays back against all of them.

Risk and impact converge. ISO/IEC 42001, NIST, AI6 and the NSW AIAF all ask for risk and impact assessment, and the artefacts are largely reusable. The EU AI Act adds specific required content, such as the six elements of the fundamental rights impact assessment. A shared assessment with framework-specific additions is the efficient pattern.

Transparency runs at different depths. The EU AI Act and the Privacy Act set specific legal disclosures. The others ask for transparency in general terms. Meeting a general expectation does not deliver the specific wording a law requires, and the reverse is also true.

Force differs. Doing the shared work well positions you for every framework, but the consequences differ. EU AI Act breaches carry fines. NSW agencies answer to their circular. ISO/IEC 42001 conformity is something only an accredited certification body can confirm. NIST and AI6 are voluntary.

Two limits

First, crosswalks simplify. A cell that says “Article 9” or “Practice 3” points to where a framework treats a discipline, not to a statement that the requirements are identical. Read the primary sources for anything you rely on.

Second, frameworks move. The EU AI Act’s high-risk dates changed in 2026, AI6 replaced the Voluntary AI Safety Standard in 2025, and the NSW AIAF moved to a mandatory platform in 2026. Date your crosswalk and review it when a framework changes.

Where Aicura fits

A crosswalk pays off when the shared work lives in one record. In Aicura you choose in Settings which frameworks apply, and each risk assessment, impact assessment and governance policy review then draws on all of them at once, rather than one exercise per framework. The controls those assessments suggest land in one versioned set in Risks and Controls, each tracked as applicable, implemented and tested.

Which frameworks are available depends on the plan and on your country. ISO/IEC 42001 and the NIST AI RMF are in Pro everywhere. Each country adds its own, such as the EU AI Act in Essentials for organisations in the EU, and AI6 and the NSW AIAF in Essentials in Australia. Your country’s pricing page lists them by plan. Aicura gives guidance against the frameworks you enable. It does not certify you, attest conformity or give legal advice, and ISO/IEC 42001 certification belongs to your certification body.

A note on this page

This crosswalk is a plain-language guide, not legal advice. Each framework’s primary source is linked from its framework page. Read those sources in full and take your own advice on how the frameworks apply to your organisation.