Frameworks crosswalk

Cl. 4 Principles of AI risk managementCl. 5.2 Framework: leadership and commitmentCl. 5.3 Framework: integration into organisational processesCl. 5.4 Framework: design (context, roles, resources)Cl. 5.5 Framework: implementationCl. 5.6 Framework: evaluationCl. 5.7 Framework: improvementCl. 6.2 Process: communication and consultationCl. 6.3 Process: scope, context and criteriaCl. 6.4 Process: risk assessment (identification, analysis, evaluation)Cl. 6.5 Process: risk treatmentCl. 6.6 Process: monitoring and reviewCl. 6.7 Process: recording and reportingAnnex B AI-specific risk sourcesAnnex C Risk management across the AI system life cycle

Official source

OECD AI Principles v1.6 Intergovernmental recommendation (not legally binding on companies)

OECD Recommendation of the Council on Artificial Intelligence (OECD/LEGAL/0449)

Version: Adopted 22 May 2019; updated 3 May 2024 · Authority: OECD (adherents include OECD members and partner countries; basis of the G20 AI Principles)

1.1 Inclusive growth, sustainable development and well-being1.2 Respect for the rule of law, human rights and democratic values, including fairness and privacy1.3 Transparency and explainability1.4 Robustness, security and safety1.5 Accountability

Official source

Council of Europe Framework Convention on AI (CETS No. 225) v1.6 International treaty binding States Parties (implemented through national law); entry into force per Art. 30

Framework Convention on Artificial Intelligence and Human Rights, Democracy and the Rule of Law

Version: Adopted 17 May 2024; opened for signature 5 September 2024; EU ratified 15 May 2026 · Authority: Council of Europe

Art. 4 Protection of human rightsArt. 5 Integrity of democratic processes and respect for the rule of lawArt. 7 Human dignity and individual autonomyArt. 8 Transparency and oversightArt. 9 Accountability and responsibilityArt. 10 Equality and non-discriminationArt. 11 Privacy and personal data protectionArt. 12 ReliabilityArt. 13 Safe innovationArt. 14 RemediesArt. 15 Procedural safeguardsArt. 16 Risk and impact management framework

Official source

UK principles-based AI regulation v1.6 Non-statutory cross-sector principles, applied through existing regulators' rules and guidance

A pro-innovation approach to AI regulation (white paper, March 2023) and successors

Version: White paper March 2023; government response February 2024; AI Opportunities Action Plan January 2025; Data (Use and Access) Act 2025. No AI-specific statute as of September 2026 · Authority: UK Government (DSIT); applied by sector regulators (FCA, PRA, ICO, CMA, Ofcom, MHRA)

P1 Safety, security and robustnessP2 Appropriate transparency and explainabilityP3 FairnessP4 Accountability and governanceP5 Contestability and redress

Official source

AICPA Trust Services Criteria (SOC 2) applied to AI v1.6 Voluntary assurance criteria; often contractually required by customers

AICPA 2017 Trust Services Criteria for Security, Availability, Processing Integrity, Confidentiality and Privacy (March 2020 update), as applied to AI systems in SOC 2 examinations

Version: TSC 2017 (March 2020 update) · Authority: AICPA

CC1 Control environmentCC2 Communication and informationCC3 Risk assessmentCC4 Monitoring activitiesCC5 Control activitiesCC6 Logical and physical access controlsCC7 System operations (incl. incident detection and response)CC8 Change management (incl. model changes)CC9 Risk mitigation (incl. vendor and business-partner risk)A1 AvailabilityPI1 Processing integrity (complete, valid, accurate, timely outputs)C1 ConfidentialityP Privacy

Official source

CALIBRE control	NIST AI RMF 1.0	ISO/IEC 42001	EU AI Act	MITRE ATLAS	OWASP LLM 2025	ISO/IEC 27001	ISO/IEC 23894:2023	OECD AI Principles	Council of Europe Framework Convention on AI (CETS No. 225)	UK principles-based AI regulation	AICPA Trust Services Criteria (SOC 2) applied to AI
LIT-01 AI literacy and competence	GV-2.2	7.2	Article 4	AML.M0018	-	A.6.3	-	-	-	-	CC1
GOV-01 AI use-case registration	GV-1.6	A.4.2	Article 49	-	-	A.5.9	Cl. 6.3, Cl. 6.7	1.5	Art. 9	P4	CC3
GOV-02 AI impact and risk assessment	MP-5.1	A.5.2, A.5.4	Article 9, Article 27	-	LLM06	-	Cl. 6.4, Annex B, Annex C	1.1, 1.2	Art. 16, Art. 4, Art. 10	P1, P3	CC3
DATA-01 Data governance and PII protection	MS-2.10	A.7.2, A.7.3, A.7.4, A.7.5	Article 10	AML.M0007, AML.M0025	LLM02, LLM04, LLM08	A.5.12, A.5.34, A.8.10, A.8.11, A.8.12	Annex B	1.2	Art. 11	P3	P
SEC-01 AI security controls	MS-2.7	A.6.2.3	Article 15	AML.M0005, AML.M0014, AML.M0016, AML.M0035	LLM01, LLM02, LLM05, LLM07, LLM08	A.5.7, A.8.8, A.8.25, A.8.26, A.8.29	Cl. 6.5	1.4	Art. 12	P1	CC6, CC7
SUP-01 AI supply-chain and third-party assurance	GV-6.1, MG-3.1	A.10.2, A.10.3	Article 25	AML.M0013, AML.M0014, AML.M0023, AML.M0025	LLM03	A.5.19, A.5.20, A.5.21, A.5.22, A.5.23	Cl. 5.4.1	-	-	-	CC9
CNT-01 Generative content safety evaluation	MS-2.6	A.5.5, A.6.2.4	Article 50	AML.M0020, AML.M0021, AML.M0022, AML.M0034	LLM09	-	-	-	-	-	-
XAI-01 Explainability and transparency	MS-2.9	A.8.2	Article 13, Article 50, Article 86	-	LLM09	-	Cl. 6.2	1.3	Art. 8	P2	CC2
HITL-01 Human oversight (human-in-the-loop)	MP-3.5	A.9.3	Article 14, Article 26	AML.M0029	LLM06, LLM09	-	Cl. 6.5	1.2	Art. 7, Art. 8	P4	-
MON-01 Runtime monitoring and drift detection	MS-2.4, MG-4.1	A.6.2.6, A.6.2.8	Article 72, Article 26	AML.M0024	LLM10	A.8.15, A.8.16	Cl. 6.6	1.4	Art. 12, Art. 16	P1	CC7
ASR-01 Independent pre-deployment assurance	MS-1.3	A.6.2.4, A.6.2.5	Article 17, Article 43	AML.M0008, AML.M0035	LLM01, LLM04	A.5.35, A.8.29	Cl. 5.6	1.4, 1.5	Art. 12, Art. 16	P1	CC4, CC8
GOV-03 Executive and board risk sign-off	GV-2.3	5.1, 6.1.3	Article 17	-	-	-	Cl. 5.2	1.5	Art. 9	P4	CC1
RES-01 Redress and incident response	MG-4.3, MS-3.3	A.8.3, A.8.4	Article 73	-	-	A.5.24, A.5.26, A.5.27	Cl. 6.5, Cl. 5.7	1.3, 1.4	Art. 14, Art. 15	P5	CC7

Notes on legal status

As of 25 September 2026. Check each source for later changes.

Council of Europe Convention (CETS 225): Binds States Parties, not companies directly. Enters into force after five ratifications including three CoE member states (Art. 30). The EU ratified on 15 May 2026. Check the CoE Treaty Office for current status.
United Kingdom: No AI-specific statute. The five principles (March 2023 white paper, February 2024 response) are applied by sector regulators such as the FCA, ICO and CMA. Later: AI Opportunities Action Plan (January 2025) and the Data (Use and Access) Act 2025 changes to automated decision-making.
AICPA: No AICPA publication titled "Trustworthy AI" was found. The authoritative instrument is the Trust Services Criteria used in SOC 2, which auditors apply to AI systems, supported by COSO's February 2026 generative-AI internal control guidance.
ISO/IEC 23894: Guidance, not certifiable. Complements ISO/IEC 42001. Clause references only; the standard text is copyright.
OECD AI Principles: 2019, updated 2024. An intergovernmental recommendation that underpins the G20 AI Principles and many national frameworks.

No controls match

Notes on legal status