Faster preparation for ISO/IEC 42001, the EU AI Act and NIST AI RMF.

AIGRCeler is an AI GRC Accelerator. It turns each framework into work that agents lead and people decide, and it keeps the evidence in one place.

Three frameworks. One small company.

The regulatory map lines the EU AI Act, the NIST AI RMF and ISO/IEC 42001 up with the starter controls and shows where each control helps.

How the mapping works

Every item in a framework is mapped to a control in the 104-control catalog, to part of how AIGRCeler works (the decision journal, the go gate, the approval rules), and to the discovery questions that supply the facts.

For each AI system, AIGRCeler then shows where every item stands, and lists what is not fully covered, so your team knows what is left to do.

ISO/IEC 42001:2023

The international standard for an AI management system. Read about it at ISO. Certification is decided by an accredited body, not by AIGRCeler.

Items mapped	65 items. 62 are supplied by a control or by how AIGRCeler works and 3 only partly. None is left unmapped.
Only partly	A.4.4 Tooling resources. AIGRCeler suggests tools and records their use as evidence, but does not inventory your tools. A.4.5 System and computing resources. Recovery and dependencies are covered. Capacity planning is your engineering practice and is recorded, not checked. A.10.4. Information for the people who receive your AI output is covered. What your customer contracts say is your legal work.

Items mapped

65 items. 62 are supplied by a control or by how AIGRCeler works and 3 only partly. None is left unmapped.

Only partly

A.4.4 Tooling resources. AIGRCeler suggests tools and records their use as evidence, but does not inventory your tools.
A.4.5 System and computing resources. Recovery and dependencies are covered. Capacity planning is your engineering practice and is recorded, not checked.
A.10.4. Information for the people who receive your AI output is covered. What your customer contracts say is your legal work.

EU AI Act, Regulation (EU) 2024/1689

The European regulation on AI. Read the official text. Each item in the map says which roles (provider, deployer, importer, distributor) and which classes of system (prohibited, high-risk, limited, minimal, general-purpose model) it is relevant to. Whether a system is in a class, and which duties apply to your company, are questions for your lawyer.

Items mapped	32 items. 30 are supplied by a control or by how AIGRCeler works and 2 only partly. None is left unmapped.
Only partly	Article 17, quality management. The starter catalog covers accountability, risk management, data management, testing, record-keeping, change control and monitoring after launch. It does not cover the list of harmonised standards you apply, or written procedures for dealing with national authorities beyond incidents. Your lawyer decides what your quality management document must contain. Articles 51 to 55, general-purpose models. Covered for a company that uses such a model: it obtains the provider's documentation. The duties of a company that provides such a model are outside the starter catalog.

Items mapped

32 items. 30 are supplied by a control or by how AIGRCeler works and 2 only partly. None is left unmapped.

Only partly

Article 17, quality management. The starter catalog covers accountability, risk management, data management, testing, record-keeping, change control and monitoring after launch. It does not cover the list of harmonised standards you apply, or written procedures for dealing with national authorities beyond incidents. Your lawyer decides what your quality management document must contain.
Articles 51 to 55, general-purpose models. Covered for a company that uses such a model: it obtains the provider's documentation. The duties of a company that provides such a model are outside the starter catalog.

NIST AI RMF 1.0

The voluntary US framework for managing AI risk. Read about it at NIST.

Items mapped	72 items. 66 are supplied by a control or by how AIGRCeler works and 6 only partly. None is left unmapped.
Only partly	Six items depend on your own practice: the make-up of your teams and your culture (GOVERN 3.1 and 4.1), independent assessment (MEASURE 1.3), review of testing with people (MEASURE 2.2), energy and emissions (MEASURE 2.12) and review by a domain expert (MEASURE 4.2).

What the map is not

It is AIGRCeler's own mapping. It is not legal advice, not a statement that your company complies, and not a certification.
Whether a duty applies to one of your AI systems is a question for your lawyer.
Many settings (retention periods, incident clocks, risk bands, evidence validity) are starting values that you must check for your company.

The full tables, one per framework, are in the regulatory mappings folder of the product. See an example or get started.