Start with a testable claim
A row should be a question that someone else can check.
The NIST AI Risk Management Framework is voluntary guidance organized around Govern, Map, Measure, and Manage. These functions offer a way to organize risk work. They are not a ready-made legal compliance certificate. The framework’s published core is the starting point for identifying a particular practice.
Suppose a team has a validation report. The first question is what the report contains. Does it identify the tested model version? Does it describe a sample, an outcome, and a limitation? Only then can the team ask whether those contents support a particular requirement. The report’s title is insufficient.
The same rule applies to an Article 11 documentation claim. It needs a defined system and a relevant part of the technical file. A broad reference to GOVERN or MAP does not establish that the required information exists. A correspondence becomes stronger when it identifies a passage and explains its contribution.
Consider a monitoring log. It records something about the operation of a system. Its relevance depends on what it records and why. A log may help with a monitoring question. It does not automatically establish accuracy, effective oversight, or access to an explanation. Each further conclusion needs its own reasoning.
NIST’s crosswalk catalogue makes a related limitation explicit: listing a crosswalk does not imply endorsement or comprehensive coverage. Its January 2023 illustration includes the proposed EU AI Act. That dated illustration must not be presented as an article-by-article mapping of the adopted 2024 Regulation.
This gives the comparison a practical starting point. Record the framework versions, the author of the mapping, and the level of detail. Then choose one row and try to reproduce it. Can a second reader reach the same conclusion from the same document? If not, the table needs a more precise claim or a more complete source.
Separate practices, duties and remedies
Similar vocabulary can conceal different legal actors and different conditions.
The AI Act’s official text distinguishes several duties. Article 13 addresses information for deployers; Article 14 addresses human oversight. Individual information or explanation provisions must be considered under their own provisions and conditions, including Articles 26 and 86 where applicable. These entries should not be merged into a single claim about transparency.
NIST MANAGE 4.1 includes appeal and override mechanisms. Omitting that entry makes the American column look artificially empty. Yet describing a practice in a voluntary framework does not itself give someone a statutory right. A comparison must identify both the mechanism and any independent source of legal enforceability.
Conformity assessment also has distinct routes. Article 43(2) refers Annex III point 2–8 systems to internal control under Annex VI, without a notified body. Other routes differ. The comparison cannot assume an outside verifier for every high-risk system. Nor can it infer that an internal route removes the legal duty to perform the required assessment.
The table can represent legal actors, conditions and review procedures. An ontology can make these distinctions explicit too. Neither artifact creates a right by representing it. The task is to show which legal source establishes the right and what evidence supports a claim about its operation.
What does this document establish, for which requirement, and with what remaining uncertainty?— The test for a crosswalk
This is also why a percentage needs a definition. It might measure reviewed requirements, available documents, or a researcher’s assessment of evidential support. Those measures are not interchangeable. A reader should not have to guess which denominator produced a reassuring number.
Make the uncertainty useful
An unresolved row is a research task when its missing evidence is named.
A blank cell can mean several things. The researcher may not have searched the right source. A document may be inaccessible. A requirement may not apply. Or the record may support a substantive difference between the frameworks. These situations call for different next steps. They should not share a label that says “no protection.”
For an inaccessible document, record the access limitation. For a disputed interpretation, identify the provisions and competing readings. For a claim about an individual remedy, find the procedure and relevant decisions. For an inapplicable requirement, explain the reason. Each entry should say what could confirm or change the conclusion.
PATTERN provides a concrete research setting: a risk score can matter to a person’s use of prison time credits. Its model reports, administrative rules and individual decisions belong in different evidence categories. An audit alone does not establish that review is absent. A review rule alone does not establish effective access to the model. The comparison must examine both.
This approach changes how a crosswalk is updated. A new source does not simply add another citation. It may strengthen a claim, narrow it, contradict it, or show that a question was poorly framed. Keep the previous interpretation and the reason for the change. That record makes revision inspectable.
The resulting table is less sweeping and more useful. It does not promise that adopting one framework satisfies another. It identifies evidence that may travel, conditions that must still be tested, and questions that remain open. Its value lies in making those judgments reproducible, one requirement and one source at a time.