AI frameworks crosswalk (v1.6)
Every AI framework CALIBRE maps to, its legal status, and which CALIBRE control satisfies which clause.
What it is
CALIBRE's 12 core controls and conditional control CNT-01 are pre-mapped to eleven instruments: NIST AI RMF, ISO/IEC 42001, the EU AI Act, MITRE ATLAS, OWASP LLM Top 10, ISO/IEC 27001 and, from v1.6, ISO/IEC 23894 (AI risk management guidance), the OECD AI Principles, the Council of Europe Framework Convention on AI (CETS 225), the UK principles-based approach (2023 white paper and successors) and the AICPA Trust Services Criteria applied to AI with COSO's generative-AI guidance. Evidence for one control therefore counts across all of them, and every attestation report includes a coverage section per framework.
When to use
- Answering 'which frameworks do we align to?' from a board, regulator, auditor or customer.
- Preparing for a SOC 2 examination that covers AI systems (AICPA Trust Services Criteria).
- Operating in the UK, where regulators apply five non-statutory AI principles through existing rules.
- Explaining alignment with the OECD AI Principles or the Council of Europe AI Convention in public-sector or multinational work.
Walk-through
- 1Open Regulatory > AI frameworks crosswalk.
- 2Read the status of each framework (law, treaty, voluntary standard, principles, assurance criteria).
- 3Use the crosswalk table: find a CALIBRE control row and read across to see the clause it evidences in each framework.
- 4Generate an Attestation Report: sections 11-15 show coverage against the five v1.6 frameworks.
Common pitfalls
- Treating the CoE Convention as directly binding on your company: it binds States Parties, which legislate.
- Saying the UK has an AI Act: as of September 2026 it does not; the principles are non-statutory.
- Claiming ISO/IEC 23894 certification: it is guidance; ISO/IEC 42001 is the certifiable standard.
- Citing an 'AICPA Trustworthy AI framework': no such AICPA publication was found; use the Trust Services Criteria.