OCC
Back to F-ACT
Framework crosswalk

How F-ACT relates to the frameworks you already answer to

The frameworks below tell an organisation what good AI governance must achieve. F-ACT is narrower and operational: it fixes the five questions every autonomous agent must answer, and grades how provably each answer is enforced. An agent that earns a high F-ACT tier produces exactly the kind of traceable authority, bounded scope, governed data path, tamper-evident record and provable revocation that these regimes ask for — which is why F-ACT reads as an implementation layer beneath them, not a rival to them.

Read the mappings as informative, not normative

These mappings are informative, not normative. F-ACT is a complementary operational conformance layer — it makes the five governance answers verifiable — not a substitute for any framework below. Self-declaring an F-ACT tier is not, by itself, a claim of compliance with the EU AI Act, NIST AI RMF, ISO/IEC 42001 or the OECD Principles. References point to the most directly related provisions; they are not an exhaustive compliance mapping and are not legal advice.

The four frameworks in this crosswalk

EU AI Act
European Union

The binding, risk-tiered law governing AI systems placed on the EU market. Legally enforceable, with obligations that phase in through 2026 and 2027.

EU AI Act — Regulation (EU) 2024/1689
NIST AI RMF
US National Institute of Standards and Technology

A voluntary, widely referenced framework organised around four functions — Govern, Map, Measure and Manage — for managing risks across the AI lifecycle.

NIST AI Risk Management Framework 1.0
ISO/IEC 42001
ISO / IEC

The first certifiable AI management-system standard, defining the controls an organisation puts in place to govern its use of AI — the AI analogue of ISO 27001.

ISO/IEC 42001:2023
OECD Principles
OECD (adopted by 40+ countries)

The values-based principles for trustworthy AI that underpin most national AI strategies and the G20 AI Principles. High-level and jurisdiction-neutral.

OECD AI Principles

The crosswalk

Each F-ACT dimension, and the provisions of each framework it most directly speaks to.

G
Grant
Who authorised this agent, and can that authority be traced to an accountable human?
EU AI Act
  • Art. 14 — Human oversight
    Requires natural persons able to oversee a high-risk system and its use.
  • Art. 26 — Deployer obligations
    Assigns responsibility for operating the system to an identifiable deployer.
NIST AI RMF
  • GOVERN 2 — Accountability
    Accountability structures and clear lines of responsibility are in place.
  • GOVERN 3 — Roles
    Roles, responsibilities and delegated authority are defined and documented.
ISO/IEC 42001
  • Clause 5.3 — Roles & authorities
    Assigns organisational roles, responsibilities and authorities for the AI management system.
  • Annex A.3.2 — Roles
    Documents accountability for AI systems within the organisation.
OECD Principles
  • Principle 1.5 — Accountability
    Actors are accountable for the proper functioning of AI systems.
U
Usage
What is this agent permitted to do — and what is explicitly out of bounds?
EU AI Act
  • Art. 9 — Risk management
    A risk-management system bounds foreseeable use and reasonably foreseeable misuse.
  • Art. 13 — Transparency & instructions
    Intended purpose and conditions of use must be stated to the deployer.
NIST AI RMF
  • MAP 1 — Context
    Intended purpose, setting and constraints are established up front.
  • MAP 2 — Categorization
    System capabilities and permitted tasks are documented.
ISO/IEC 42001
  • Clause 4.3 — Scope of the AIMS
    Defines the boundaries of what the AI management system covers.
  • Annex A.6.1.2 — System requirements
    Requirements, including intended use and limitations, are specified.
OECD Principles
  • Principle 1.4 — Robustness & safety
    Systems should function appropriately and not pose unreasonable safety risk in their conditions of use.
D
Data
What data may it touch, on what basis, and where may that data go?
EU AI Act
  • Art. 10 — Data & data governance
    Training, validation and testing data must meet quality and governance criteria.
NIST AI RMF
  • MAP 3 — Data & context
    Data provenance and appropriateness for the context are assessed.
  • MEASURE 2 — Privacy & data
    Data privacy and integrity are measured and monitored.
ISO/IEC 42001
  • Annex A.7 — Data for AI systems
    Controls for data acquisition, quality, provenance and preparation (A.7.2–A.7.6).
OECD Principles
  • Principle 1.2 — Human rights & privacy
    AI should respect the rule of law, human rights and privacy throughout its lifecycle.
A
Audit
Is every consequential action recorded in a form that survives a dispute?
EU AI Act
  • Art. 12 — Record-keeping
    High-risk systems must technically allow automatic logging of events over their lifetime.
  • Art. 19 — Logs
    Automatically generated logs must be kept for an appropriate period.
NIST AI RMF
  • MEASURE 1 — Methods & metrics
    Appropriate methods and metrics are identified and applied, and documented.
  • MANAGE 4 — Documentation
    Post-deployment monitoring and documentation support traceability.
ISO/IEC 42001
  • Annex A.6.2.8 — Event logging
    Recording of events generated by the AI system during operation.
  • Clause 9 — Evaluation
    Monitoring, measurement, analysis and internal audit of the AI management system.
OECD Principles
  • Principle 1.3 — Transparency & explainability
    Meaningful information enables those affected to understand and challenge outcomes.
R
Revocation
Can its authority be withdrawn instantly — and proven withdrawn?
EU AI Act
  • Art. 14 — Human oversight (stop)
    Oversight includes the ability to intervene in or halt the system (a “stop” function).
  • Art. 20 — Corrective actions
    Providers must take corrective action, including withdrawing a non-conforming system.
NIST AI RMF
  • MANAGE 2.4 — Deactivation
    Mechanisms to supersede, disengage or deactivate systems that behave inconsistently with intended use.
  • MANAGE 4.1 — Monitoring
    Post-deployment monitoring triggers response, recovery and change.
ISO/IEC 42001
  • Annex A.6.2.6 — Operation & monitoring
    Controls for operating the AI system, including intervention during operation.
  • Clause 10 — Improvement
    Nonconformity and corrective action, including stopping or changing a system.
OECD Principles
  • Principle 1.4 — Robustness & safety
    Systems should be safe across their lifecycle and able to be overridden or decommissioned.

What this means in practice

If you already run an EU AI Act, NIST or ISO/IEC 42001 programme, F-ACT does not ask you to start over. It gives you a compact, verifiable way to show that the agent-level controls those regimes require are actually in place — authority that traces to a person, scope that denies by default, a governed data path, a tamper-evident record, and revocation you can prove. A published F-ACT tier is a piece of evidence you can point a regulator, auditor or customer at, not a competing regime to comply with.

Read the standard

The five dimensions and four tiers in full.

F-ACT 1.0
Adopt & self-declare

Map your controls to the five dimensions and publish a tier.

How to adopt
Verify a claim

Check any published conformance claim against the registry.

Verify