The Agentic Governance Overlap Matrix: How NIST, ISO 42001, and the EU AI Act Stack Into One Operating System
How do NIST, ISO and EU AI controls overlap? Map shared evidence across the frameworks while keeping their legal and management roles distinct. A common control can support several requirements, but it does not make voluntary guidance equivalent to a legal duty or remove the need to assess applicability. See AI governance consulting.
Why the Three Frameworks Are Stackable
NIST AI RMF 1.0 is a voluntary risk management framework published by the US National Institute of Standards and Technology in January 2023. It is functional in design. It tells you what to do across four functions: Govern, Map, Measure, Manage. It does not tell you how to certify, because it is voluntary.
ISO/IEC 42001:2023 is an international management system standard for AI. It is structural in design. It defines the controls, policies, roles, and processes that constitute an AI Management System. It is certifiable. An accredited certification body can audit your AI Management System against ISO 42001 and issue a certificate.
The EU AI Act is binding regulation. It is legal in design. It tells you what is prohibited, what is high-risk, what obligations apply per tier, and what penalties apply per violation. It is enforced.
The three layer cleanly. NIST gives you the operating functions. ISO 42001 gives you the controls that operationalize the functions. The EU AI Act gives you the legal obligations satisfied by those controls. Build the controls once. Pass the audit once. Satisfy the regulation once.
What the Overlap Matrix Actually Shows
The matrix has twelve rows, one per NIST sub-function across the four core functions. Each row reads left to right.
The first column names the NIST function. Govern. Map. Measure. Manage. With the sub-function. Govern Risk Tolerance. Map System Context. Measure Drift Detection. And so on.
The second column lists the ISO/IEC 42001 Annex A controls that operationalize that NIST sub-function. These are the controls your auditor will check during ISO certification. A.2 AI Policies. A.3 Internal Organization. A.4 AI System Inventory. A.5 Impact Assessment. A.6 Lifecycle Management. A.7 Data for AI Systems. A.8 Information for Interested Parties. A.9 Use of AI Systems. The Annex A control set covers thirty-eight controls total.
The third column maps the binding EU AI Act obligation that the same NIST sub-function and ISO Annex A control satisfies. Article 9 risk management system. Article 10 data governance. Article 11 technical documentation. Article 12 logging. Article 13 transparency to deployers. Article 14 human oversight. Article 17 quality management system. Article 26 deployer obligations. Article 49 EU database registration. Article 72 post-market monitoring.
Registration is scoped by Article 49, not required for every AI system in an inventory. Article 49(1): providers register Annex III high-risk AI systems in the EU database before placing them on the market or putting them into service. Annex III point 2 systems, covering critical infrastructure, are registered at national level under Article 49(5). Article 49(2): a provider that concludes under Article 6(3) that an Annex III system is not high-risk must still register that system. Regulation (EU) 2026/1744 simplified the information required for this registration, as explained in Recital 22. The provider must document the Article 6(3) assessment before placing the system on the market and show it to national authorities on request. Article 49(3): deployers that are public authorities, EU institutions, bodies, offices or agencies, or persons acting on their behalf, register their use of an Annex III high-risk system. Other deployers do not register. The national-level route for Annex III point 2 remains separate. Article 49(4): Annex III points 1, 6 and 7, covering biometrics, law enforcement, migration, asylum and border control, are registered in a secure non-public section of the database. Annex III high-risk obligations apply from December 2, 2027.
The fourth column is the differentiating one. It names the high-performer revenue lever unlocked by the row, in language a board can understand. This is what most governance documents skip. They tell you the obligation. They do not tell you the value.
The fifth column names the agentic failure mode if you skip the row. This is the loss column. The pair of columns four and five gives you a real ROI argument: every row has a revenue lever and a failure mode. That is your investment thesis. Governance is not a cost center.
Three Worked Rows
Govern Policies and Accountability. NIST asks for executive ownership and assigned responsibilities. ISO 42001 controls A.2 AI Policies, A.3 Internal Organization, A.9.2 Roles and Responsibilities operationalize it. EU AI Act Articles 9, 17, and 26 satisfied. Revenue lever: executive ownership of AI is associated with materially higher EBIT outcomes in cross-industry studies, and with faster deployment approvals because legal cycles compress when accountability is named. Failure mode if skipped: agents deployed without authorization. Incidents go unescalated. Shadow AI proliferates undetected.
Map System Context and AI Inventory. NIST asks for documented AI system inventory and lifecycle mapping. ISO 42001 controls A.4.1 AI System Inventory, A.4.2 System Documentation, A.6.1 Lifecycle Planning operationalize it. An inventory supports EU AI Act Article 11 documentation, Article 49 registration where applicable, and Article 6 classification. It does not itself complete registration. Revenue lever: an inventory is the prerequisite for company-wide scaling. Organizations without an inventory experience materially more AI incidents and cannot measure use-case-level ROI. Failure mode if skipped: unknown agents in production. Vendor model updates change risk profile invisibly. No baseline means you cannot prove AI value or detect decay.
Measure Drift Detection and Monitoring. NIST asks for ongoing monitoring of model performance and detection of drift. ISO 42001 controls A.6.3 Ongoing Monitoring, A.9.5 Incident Detection, A.9.6 Performance Review Cadence operationalize it. EU AI Act Article 9(2)(c) links risk management to post-market data, Article 26(5) addresses deployer monitoring, and Article 72 covers provider post-market monitoring. Market surveillance is Article 74. Revenue lever: monitoring is the prerequisite for safe agentic scale. Drift detection protects forecast accuracy as a leading revenue signal. Failure mode if skipped: pipeline AI drifts after a market shift. Q3 miss blamed on sales. Email AI tone degrades after a vendor model update and is undetected. Agent begins unauthorized actions as context accumulates.
The Operating Implication
Build to the matrix once. The same control set, same evidence repository, same incident response process, same monitoring cadence will satisfy NIST, pass an ISO 42001 audit, and demonstrate EU AI Act compliance. You file one set of artifacts, not three. You train your team once, not three times. You spend on substance, not duplication.
Run the three programs in parallel without the matrix and you produce a governance program your operating team will quietly route around. Run them as one program against the matrix and the governance team becomes the function that ships.
Download the Agentic Governance Overlap Matrix (email gated).
Related reading
This article is part of the Sophizo AI governance series.
Want All 12 Frameworks?
Get the complete 2026 Revenue Leader's Playbook with consulting-grade issue trees, first principles thinking, and agentic AI deployment templates.
Ready to Transform Your Business with AI?
Schedule a free discovery call to discuss your AI strategy
Schedule Free Call