AI Control Matrix: EU AI Act, ISO 42001, ISO 27001 & NIST

How to use it

Use the matrix as a control-design aid. Start with one concrete AI use case, identify legal obligations separately, then use the matrix to reuse evidence across governance and security frameworks. It is intentionally not a clause-by-clause legal equivalence map.

Control area	EU AI Act	ISO 42001	ISO 27001	NIST AI RMF
AI inventory	Strong relevance	Strong	Supporting	Strong
Roles & accountability	Explicit value-chain roles	Core	Core governance	GOVERN
Risk classification	Core legal relevance	Risk process	Supporting	MAP
Human oversight	Specific duties where relevant	Strong relevance	Indirect	MANAGE
Data governance	Strong relevance	Strong	Security relevance	MAP / MEASURE
Information security	Important in relevant regulated contexts	Integrated	Primary focus	MEASURE / MANAGE
Supplier risk	Value-chain relevance	Strong	Strong	MAP / GOVERN
Transparency	Article 50 + other duties	Strong	Supporting	Governance relevance
Logging & traceability	Specific regulated relevance	Strong	Strong	MEASURE
Testing & evaluation	Regulated-system relevance	Strong	Supporting	MEASURE
Incident management	Relevant duties	Strong	Primary control area	MANAGE
Change management	Ongoing relevance	Continual improvement	Core	GOVERN / MANAGE
AI literacy	Legal relevance	Strong	Security-awareness link	GOVERN

A reusable evidence model

Inventory evidence: purpose, owner, supplier, data, users, model, role and lifecycle status.
Risk evidence: classification rationale, impact, likelihood, affected people and treatment decision.
Security evidence: architecture, identity, permissions, logging, testing, incident and supplier controls.
Human evidence: oversight design, training, escalation and responsibility.
Lifecycle evidence: model/data changes, reviews, incidents, exceptions and corrective actions.

Important: the matrix does not claim legal equivalence between standards and the AI Act. A control theme can support multiple frameworks while still requiring framework-specific interpretation and evidence.

Recommended workflow

Choose one AI system or use case.
Determine the organisation’s role and legal scope.
Identify the relevant control areas.
Reuse existing ISMS, privacy and procurement evidence where appropriate.
Close AI-specific gaps such as model governance, transparency, evaluation and human oversight.
Assign an owner and review date to every material gap.

Framework sources

Version 1.1. Last reviewed 5 September 2026. Method: thematic mapping of recurring governance and security control areas using public primary-source descriptions and the AI Act text. The matrix is a practical SundAI resource, not legal advice, an official crosswalk or a clause-level conformity assessment.

Cite this resource

SundAI (2026), SundAI AI Control Matrix, version 1.1, reviewed 5 September 2026. https://sundaibot.com/resources/ai-control-matrix/

For legal or standards-specific claims, cite the relevant underlying EU, ISO or NIST source alongside this practical mapping aid.

Want to adapt the matrix to your organisation?

SundAI can turn the generic control map into a proportionate operating model with owners, evidence and implementation priorities.

Explore AI Governance →