# Governance mapping for AI systems

> How controls in an AI system map to OWASP, the NIST AI RMF, ISO/IEC 42001 and the EU AI Act, with current dates, without claiming compliance.

- Web page: https://www.alesanalytics.com/docs/governance-mapping-for-ai-systems
- Markdown: https://www.alesanalytics.com/docs/governance-mapping-for-ai-systems.md
- Last updated: 2026-11-08
- Publisher: Ales Analytics

Technical page. OWASP, NIST AI RMF, ISO/IEC 42001 and the EU AI Act. Published 2026-11-08. Last reviewed 2026-11-08. Reviewed by Ales Analytics engineering.

## In one paragraph

Governance mapping links each control in an AI system to the clauses of the frameworks a client may be asked about: the OWASP Top 10 for LLM Applications, the NIST AI Risk Management Framework and its generative AI profile, ISO/IEC 42001, and the EU AI Act. The mapping is evidence for the client's own governance work. The language is "aligned with" or "designed to support", never "compliant".

## How it works

| Framework                                | What it is                                                         | What mapping produces                                                   |
| ---------------------------------------- | ------------------------------------------------------------------ | ----------------------------------------------------------------------- |
| OWASP Top 10 for LLM Applications (2025) | Common security risks in LLM applications                          | A control per risk, with test evidence                                  |
| NIST AI RMF and NIST AI 600-1            | Voluntary framework: govern, map, measure, manage                  | The inventory, risk register and measurements organised by function     |
| ISO/IEC 42001                            | AI management system standard; certified only by accredited bodies | Documentation a management system can reference                         |
| EU AI Act                                | Law, with high-risk obligations                                    | Where a system may be high-risk, which obligations would apply and when |

Dates for the EU AI Act's high-risk obligations, after the 2026 Digital Omnibus, are 2 December 2027 for Annex III systems and 2 August 2028 for Annex I (as of November 2026).

## Design choices and trade-offs

- **Map early.** Mapping at design time is cheaper than reconstructing evidence after launch.
- **One evidence store.** Test results, decision records, logs and approvals kept where an auditor can be pointed to them.

## When not to use it

A system with no regulatory exposure and internal-only use may need only the security mapping. The inventory is still worth keeping.

## How we evaluate it

By whether each mapped control has current evidence: a test that ran, a log that exists, a record that was signed.

## Sources

- [OWASP Top 10 for LLM Applications](https://genai.owasp.org/llm-top-10/)
- [NIST AI Risk Management Framework](https://www.nist.gov/itl/ai-risk-management-framework)
- [White & Case: EU AI Omnibus enters into force](https://www.whitecase.com/insight-alert/eu-ai-omnibus-enters-force-amending-ai-act)
- Explainers: [EU AI Act](https://www.alesanalytics.com/explainers/eu-ai-act), [ISO/IEC 42001](https://www.alesanalytics.com/explainers/iso-42001), [NIST AI RMF](https://www.alesanalytics.com/explainers/nist-ai-rmf), [AI inventory](https://www.alesanalytics.com/explainers/ai-inventory)

## Contact

solutions@alesanalytics.com, or https://www.alesanalytics.com/contact.

- Every page as Markdown: https://www.alesanalytics.com/llms.txt