Bridging AI Risk Frameworks: Reconciling ISO/IEC 42001, the NIST AI Risk Management Framework, and the EU AI Act into a Uni ed Governance Taxonomy

Three major AI governance frameworks are now in use globally but operate under fundamentally different legal structures: ISO/IEC 42001 is a certifiable standard, NIST's framework is voluntary, and the EU AI Act is binding law. The paper demonstrates these are "structurally heterogeneous" rather than simply different versions of the same approach, meaning organizations cannot simply map controls between them without losing important nuances.

Current "crosswalks" (control mappings) between these frameworks are incomplete and sometimes misleading. The paper identifies that practitioners commonly try to align controls across the three instruments at a surface level, but this approach fails to account for fundamental differences in how each framework defines risk, governance responsibilities, and what counts as evidence—potentially creating false confidence in compliance.

The paper proposes a unified taxonomy organized around five analytical layers (normative purpose, governance subject, risk logic, control architecture, and evidence/assurance) that allows organizations to maintain a single control library and evidence base rather than managing three separate compliance systems. This could significantly reduce compliance burden while improving actual risk management.

Real-world examples demonstrate practical application: The paper includes worked examples for an AI clinical decision-support system and an AI credit-scoring system, showing how the unified taxonomy helps organizations address high-risk AI applications across different regulatory jurisdictions simultaneously.

The taxonomy incorporates recent updates including the EU AI Act's May 2026 Digital Omnibus amendments and NIST's 2024 Generative AI Profile, making it current for organizations implementing governance in 2024-2025.