Policy, provenance and guardrails an auditor can follow.

A control-by-control gap list against the standard, an evidence index naming the artifact that satisfies each control and the person who maintains it, and a remediation sequence ordered by what an external auditor will ask for first. It is readiness work: $8,900, 2 to 3 weeks. Certification against ISO/IEC 42001 comes from an accredited certification body, not from us.

Certification against ISO/IEC 42001 comes from an accredited certification body, and a SOC 2 report from a licensed CPA firm, each after its own audit that you commission and pay for directly. What MetaMinds does is gap assessment, readiness, control design and evidence preparation, which is the work that happens before either of them and largely determines how either goes.

The gap assessment itself is 2 to 3 weeks. How long remediation takes after it depends on how many controls have no evidence behind them, which is what the gap list counts, so it is quoted once that list exists rather than before. The certification audit is scheduled by an accredited certification body, so we do not quote a date for it.

No instrument substitutes for another. ISO/IEC 42001:2023 is a voluntary standard; the EU AI Act is law. They overlap rather than coincide: clause 8.2 is titled AI risk assessment and Article 9(1) requires a risk management system for high-risk systems, and the two ask for different contents. A management system built to ISO/IEC 42001 is evidence toward the Act, not compliance with it. Anything with legal effect belongs with counsel qualified in the relevant jurisdiction.

A provision-by-provision map of where two instruments ask for the same artifact, so one piece of evidence can answer both. The crosswalk published on this page covers two artifacts, a risk assessment and a designated role, across six instruments: the EU AI Act, ISO/IEC 42001, the NIST AI RMF, GDPR, the DPDP Act 2023 and HIPAA. Each cell names the provision, and says whether we read its text or only its clause title.

2 December 2027 for systems classified as high-risk under Annex III, and 2 August 2028 for those classified as high-risk under Annex I, as set by Regulation (EU) 2026/1744, the Digital Omnibus on AI, in force since 27 July 2026. Article 50 transparency obligations have applied since 2 August 2026, with 2 December 2026 for synthetic-content systems already on the market. Much indexed guidance still states the pre-Omnibus schedule.

Scoping when the decision is still open, the gap assessment when it is made. Attestation readiness scoping answers what SOC 2 or ISO/IEC 42001 will cost you in weeks and in money before you commit to either: $3,900, 1 week. The ISO/IEC 42001 gap assessment answers where you stand control by control against the standard: $8,900, 2 to 3 weeks.

Govern, Map, Measure and Manage, scored against the systems you run rather than the ones described in your policy: $7,500, 2 weeks. The NIST AI RMF is intended for voluntary use, so it supplies a risk method rather than an obligation. Two of its subcategories, GOVERN 2.1 and MAP 5.1, are the ones this page's crosswalk cites.

Under GDPR, Article 37(1) requires the controller and the processor to designate a data protection officer in three listed cases, and Article 38(3) has them ensure that officer receives no instructions about how to carry out the role, which makes it an independent monitor rather than a risk owner. Under the DPDP Act 2023, section 10(2)(a) requires a Significant Data Fiduciary to appoint one, and binds nobody else. The two are different appointments with different triggers, so a single named person satisfies both only if you have written down that they do.

Not in full. The Act was enacted in 2023 and commences in stages. G.S.R. 843(E) of 13 November 2025 brings sections 7 to 10 into force eighteen months from its publication, which falls in May 2027; the notification sets a period rather than printing a date, so the month is the honest way to state it and we do not publish a day. Section 10, the Significant Data Fiduciary duties including the Data Protection Officer and the periodic Data Protection Impact Assessment, sits inside that set.

For high-risk systems it requires the oversight to be assigned to people. Article 26(2) has deployers assign human oversight to natural persons who have the necessary competence, training and authority, as well as the necessary support, which is a higher bar than nominating whoever is on shift. Those obligations apply from 2 December 2027 for systems classified as high-risk under Annex III and 2 August 2028 for those under Annex I. Anything with legal effect belongs with counsel qualified in the relevant jurisdiction.

45 CFR 164.308(a)(1)(ii)(A) makes a risk analysis Required, not Addressable, and defines it as an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity and availability of electronic protected health information held by the covered entity or business associate. Where an AI system touches that data, prompts, retrieved context, embeddings, caches, logs and evaluation sets are all places it is held. 164.308(a)(2) separately requires an identified security official.

That we read the clause title and not the clause text, and that we will not pretend otherwise. It applies to the two ISO/IEC 42001 cells and nowhere else: the standard is paid, its public part stops at a two-level contents list, and that list is where clause 8.2 AI risk assessment and clause 5.3 Roles, responsibilities and authorities come from. Those two cells are drawn in their own state and are never counted toward the crosswalk's read-at-provision-text line, which is why that line says five of six rather than six.

The system it describes and its version, what it was trained or tuned on and what it was not, the intended use and the uses ruled out, the evaluation results with the method attached rather than a score alone, the known failure modes, and the named owner who is accountable for it. The signature is the part people skip and the part an auditor checks: a card nobody owns is documentation, not a control. Cards, a risk register with named owners and evaluation results with a method are three of the artifacts a compliance evidence request asks for.

Four are law and two are voluntary. The EU AI Act, GDPR, the DPDP Act 2023 and HIPAA are binding instruments. ISO/IEC 42001:2023 is a voluntary standard, which its own Foreword establishes by pointing readers to an explanation of the voluntary nature of standards, and the NIST AI RMF is described by NIST as intended for voluntary use. Voluntary is a statement about the instrument, not about your obligations: a customer can require either one by contract, and then the contract binds you rather than the standard.

No, and this page does not advise building one artifact for all six. Every one of the six names some form of risk assessment, which is what the crosswalk shows, but they ask for different contents. An Article 9(1) risk management system established, implemented, documented and maintained for high-risk AI systems, a GDPR Article 35(1) assessment of the impact of the processing on the protection of personal data, a DPDP periodic Data Protection Impact Assessment and a HIPAA risk analysis of the risks and vulnerabilities to electronic protected health information are four different documents. Evidence can be shared between them. The assessments cannot be collapsed into one.

Not under GDPR. Article 38(3) has the controller and the processor ensure that the data protection officer does not receive any instructions regarding the exercise of those tasks, which makes the role an independent monitor. A risk register needs a named owner per row, and an owner is someone who can be instructed. The two are different jobs, so naming one person in both places is worth a second look before it reaches an auditor.

Yes. 45 CFR 164.308(a)(2) requires a covered entity or business associate to identify the security official responsible for the development and implementation of the policies and procedures required by that subpart. It is an identified person, not a committee and not a vendor. Where an AI system touches electronic protected health information, that official's remit reaches it the way it reaches any other system holding that data, including the prompts, retrieved context, embeddings, caches, logs and evaluation sets it is held in.

It means we opened the instrument's own text and read the provision there, rather than reading a summary of it. Five of the six were read that way. The sixth is ISO/IEC 42001:2023, whose clause text is paid and not public: its public part stops at a two-level contents list, so clause 8.2 AI risk assessment and clause 5.3 Roles, responsibilities and authorities were read as titles and the cells say so. The figure therefore carries two counts that are never merged: six of six instruments name the artifact, and five were read at provision text.

On this page, under the figure. The evidence record names, per instrument, the surface the text was read at, the exact URL and how it was fetched, including the status the host returned. The method is part of the record because three of the six refuse a plain request: the EU AI Act and ISO/IEC 42001 were read in a headless browser, HIPAA through the eCFR versioner API because its web page redirects a headless browser to a bot check, and both Indian Gazette documents from their PDF streams. Every provision was read on 15 September 2026.