Governance mapping for AI systems

OWASP, NIST AI RMF, ISO/IEC 42001 and the EU AI Act

Published: 8 November 2026
Last reviewed: 8 November 2026
Re-checked every: 90 days
Reviewed by: Ales Analytics engineering

In one paragraph

Governance mapping links each control in an AI system to the clauses of the frameworks a client may be asked about: the OWASP Top 10 for LLM Applications, the NIST AI Risk Management Framework and its generative AI profile, ISO/IEC 42001, and the EU AI Act. The mapping is evidence for the client's own governance work. The language is "aligned with" or "designed to support", never "compliant".

How it works

Framework	What it is	What mapping produces
OWASP Top 10 for LLM Applications (2025)	Common security risks in LLM applications	A control per risk, with test evidence
NIST AI RMF and NIST AI 600-1	Voluntary framework: govern, map, measure, manage	The inventory, risk register and measurements organised by function
ISO/IEC 42001	AI management system standard; certified only by accredited bodies	Documentation a management system can reference
EU AI Act	Law, with high-risk obligations	Where a system may be high-risk, which obligations would apply and when

Dates for the EU AI Act's high-risk obligations, after the 2026 Digital Omnibus, are 2 December 2027 for Annex III systems and 2 August 2028 for Annex I (as of November 2026).

Design choices and trade-offs

Map early. Mapping at design time is cheaper than reconstructing evidence after launch.
One evidence store. Test results, decision records, logs and approvals kept where an auditor can be pointed to them.

When not to use it

A system with no regulatory exposure and internal-only use may need only the security mapping. The inventory is still worth keeping.

How we evaluate it

By whether each mapped control has current evidence: a test that ran, a log that exists, a record that was signed.

Sources

Should you have any questions regarding this page, please contact us at solutions@alesanalytics.com.