AskAjay → NIST AI RMF Crosswalk Matrix

A Practitioner’s Reference: Every AskAjay Framework Mapped to Specific NIST Subcategories

Version 1.2 · Updated 6 October 2026 · askajay.ai/thinking/nist-ai-rmf-practitioners-guide-crosswalk

This crosswalk matrix is a companion to the full article. For implementation guidance, maturity paths, and the practitioner’s starting point, read the complete guide at askajay.ai.

1. Master Crosswalk: AskAjay Frameworks × NIST Functions

Framework	GOVERN	MAP	MEASURE	MANAGE
MVG	GV-1.4 GV-1.6 GV-2.1	MAP-1.1 MAP-5.1	MS-1.1 MS-2.4	MG-1.1 MG-1.2 MG-2.4 MG-4.1 MG-4.3
5-Pillar Readiness	GV-1 GV-2 GV-3 GV-4	MAP-1 MAP-2 MAP-3 MAP-4	None	None
Trust Premium	GV-1.5	None	MS-1 MS-2 MS-4	None
Liability Ledger	GV-1.4	MAP-1 MAP-5	MS-3	MG-1 MG-2
A7 Framework	GV-1 GV-2 GV-3 GV-4 GV-5 GV-6	MAP-1 MAP-3 MAP-4	MS-1 MS-2 MS-3	MG-1 MG-2 MG-4

Framework

GOVERN

MAP

MEASURE

MANAGE

MVG

GV-1.4 GV-1.6 GV-2.1

MAP-1.1 MAP-5.1

MS-1.1 MS-2.4

MG-1.1 MG-1.2 MG-2.4 MG-4.1 MG-4.3

5-Pillar Readiness

GV-1 GV-2 GV-3 GV-4

MAP-1 MAP-2 MAP-3 MAP-4

None

Trust Premium

GV-1.5

None

MS-1 MS-2 MS-4

None

Liability Ledger

GV-1.4

MAP-1 MAP-5

MS-3

MG-1 MG-2

A7 Framework

GV-1 GV-2 GV-3 GV-4 GV-5 GV-6

MAP-1 MAP-3 MAP-4

MS-1 MS-2 MS-3

MG-1 MG-2 MG-4

2. MVG Artifacts → NIST Subcategory Mapping (Detailed)

Each MVG artifact answers a named NIST subcategory: 12 of the 72. In the Align stage each one becomes the first entry in a layer of the Governance Playbook, whose five layers map the other 60.

MVG Artifact	NIST Subcategories	What It Produces	Grows Into (Align)
AI System Inventory	GV-1.6	List of all AI systems in production or pilot, who uses them and which decisions they touch	Policy layer
Governance Charter	GV-1.4	One page on who may approve, pause and retire an AI system	Policy layer
Accountability Matrix	GV-2.1	One named owner per system with the authority to pause it	People layer
Context & Impact Record	MAP-1.1	Who the outputs affect, what data the system uses, and which rules apply	Process layer
Risk Register	MAP-5.1 MG-1.2	The three most harmful failures per system, each with its likelihood and severity, and a High, Medium or Low tier	Process layer
Baselines & Thresholds	MS-1.1	A metric, its baseline, an alert threshold and a pause threshold per system	Tooling layer
Production Monitoring	MS-2.4	Monitoring of each system in production	Tooling layer
Deployment Gate	MG-1.1	A checklist that decides whether a system may go live, and its next review date	Process layer
Authority to Pause	MG-2.4	The named person who can supersede, disengage or deactivate the system	People layer
Escalation & Incident Procedure	MG-4.1 MG-4.3	Appeal, override, incident response and incident tracking	Process layer

MVG Artifact

NIST Subcategories

What It Produces

Grows Into (Align)

AI System Inventory

GV-1.6

List of all AI systems in production or pilot, who uses them and which decisions they touch

Policy layer

Governance Charter

GV-1.4

One page on who may approve, pause and retire an AI system

Policy layer

Accountability Matrix

GV-2.1

One named owner per system with the authority to pause it

People layer

Context & Impact Record

MAP-1.1

Who the outputs affect, what data the system uses, and which rules apply

Process layer

Risk Register

MAP-5.1 MG-1.2

The three most harmful failures per system, each with its likelihood and severity, and a High, Medium or Low tier

Process layer

Baselines & Thresholds

MS-1.1

A metric, its baseline, an alert threshold and a pause threshold per system

Tooling layer

Production Monitoring

MS-2.4

Monitoring of each system in production

Tooling layer

Deployment Gate

MG-1.1

A checklist that decides whether a system may go live, and its next review date

Process layer

Authority to Pause

MG-2.4

The named person who can supersede, disengage or deactivate the system

People layer

Escalation & Incident Procedure

MG-4.1 MG-4.3

Appeal, override, incident response and incident tracking

Process layer

3. Seven Trustworthy AI Characteristics: AskAjay Coverage

NIST defines seven characteristics of trustworthy AI. Below shows which AskAjay frameworks provide coverage for each.

1. Valid & Reliable

Consistent, accurate results as intended

5-Pillar Trust Premium MVG

2. Safe

Minimized risks of harm from outputs and operations

MVG A7 Liability Ledger

3. Secure & Resilient

Protected against cyber threats, maintains functionality

A7 MVG

4. Accountable & Transparent

Clear responsibility and visibility into operations

MVG Liability Ledger A7

5. Explainable & Interpretable

Decisions understandable to stakeholders

Trust Premium 5-Pillar

6. Privacy-Enhanced

Individual privacy protected throughout lifecycle

MVG A7

7. Fair, with Harmful Bias Managed

Equitable treatment, mitigated discriminatory outcomes

Trust Premium Liability Ledger MVG

4. Implementation Timeline: Assess → Align → Assure

Phase	Timeline	Deliverables	NIST Coverage	Notes
Assess (MVG)	Days 0–90	AI inventory, charter, accountability matrix, context record, risk register, baselines, monitoring, deployment gate, authority to pause, escalation procedure	12 named subcategories across all four functions	A team of three: governance owner, business stakeholder, technical lead
Align	Months 3–6	Each MVG artifact built out into its layer of the Governance Playbook: Policy, Process, Tooling, People, Assurance	The other 60 subcategories mapped to the five layers	Add ISO/IEC 42001 and EU AI Act duties where they apply
Assure	Ongoing	Reviews on each risk tier's cadence (High monthly, Medium quarterly, Low yearly), starting at each MVG review date, findings fed back into policy	Reviews against the mapped subcategories	Built into the review cycle

Phase

Timeline

Deliverables

NIST Coverage

Notes

Assess (MVG)

Days 0–90

AI inventory, charter, accountability matrix, context record, risk register, baselines, monitoring, deployment gate, authority to pause, escalation procedure

12 named subcategories across all four functions

A team of three: governance owner, business stakeholder, technical lead

Align

Months 3–6

Each MVG artifact built out into its layer of the Governance Playbook: Policy, Process, Tooling, People, Assurance

The other 60 subcategories mapped to the five layers

Add ISO/IEC 42001 and EU AI Act duties where they apply

Assure

Ongoing

Reviews on each risk tier's cadence (High monthly, Medium quarterly, Low yearly), starting at each MVG review date, findings fed back into policy

Reviews against the mapped subcategories

Built into the review cycle

5. Where NIST Alignment Counts in Law

The NIST AI RMF is voluntary and no federal law makes it a safe harbor. Version 1.0 is being revised under America’s AI Action Plan (July 2025); map to the 1.0 identifiers and check them again when the revision is published.

Standard / Regulation	Role of NIST	What it means	Source
EU AI Act	Not mentioned	High-risk duties for Annex III uses apply from 2 December 2027, among them a risk management system (Art. 9) and human oversight (Art. 14). A NIST mapping is evidence for them but has to be re-cut to the Act’s own articles.	Regulation (EU) 2024/1689; Regulation (EU) 2026/1744 (Digital Omnibus)
ISO/IEC 42001	NIST crosswalk	Each AI RMF subcategory mapped to clauses of the standard’s final draft. The shorter step when customers ask for certification.	NIST AI RMF to ISO/IEC FDIS 42001 crosswalk (NIST)
Texas HB 149 (TRAIGA)	Defense	In force 1 January 2026. A defendant may not be found liable for a violation it discovers through an internal review process while it substantially complies with NIST’s Generative AI Profile or another recognized AI risk framework.	Texas Business and Commerce Code, sec. 552.105
Colorado SB 26-189	Safe harbor removed	Signed 14 May 2026; replaces the 2024 AI Act (SB 24-205) from 1 January 2027 with transparency and human review for automated decisions, and drops the NIST and ISO/IEC 42001 safe harbor.	Colorado SB 26-189

Standard / Regulation

Role of NIST

What it means

Source

EU AI Act

Not mentioned

High-risk duties for Annex III uses apply from 2 December 2027, among them a risk management system (Art. 9) and human oversight (Art. 14). A NIST mapping is evidence for them but has to be re-cut to the Act’s own articles.

Regulation (EU) 2024/1689; Regulation (EU) 2026/1744 (Digital Omnibus)

ISO/IEC 42001

NIST crosswalk

Each AI RMF subcategory mapped to clauses of the standard’s final draft. The shorter step when customers ask for certification.

NIST AI RMF to ISO/IEC FDIS 42001 crosswalk (NIST)

Texas HB 149 (TRAIGA)

Defense

In force 1 January 2026. A defendant may not be found liable for a violation it discovers through an internal review process while it substantially complies with NIST’s Generative AI Profile or another recognized AI risk framework.

Texas Business and Commerce Code, sec. 552.105

Colorado SB 26-189

Safe harbor removed

Signed 14 May 2026; replaces the 2024 AI Act (SB 24-205) from 1 January 2027 with transparency and human review for automated decisions, and drops the NIST and ISO/IEC 42001 safe harbor.

Colorado SB 26-189