Executive briefSimilar words can impose different obligations

One provision requires a provider to give information to a deployer before placing a system on the market. Another requires a controller to inform a person about personal-data processing. Both contain words such as transparency and information. They address different actors, subjects, moments, purposes, evidence and consequences. A single generic notice control may contribute to both while fully satisfying neither.

A regulatory crosswalk is therefore not a spreadsheet of similar phrases. It is a governed graph connecting an authoritative source, exact provision, applicability and accountable interpretation to a technology-neutral objective, implementation, test, evidence, owner, residual gap and change impact. Every mapping preserves scope and effective time. A legal obligation, supervisory guidance, voluntary standard and policy principle remain different types of authority.

The aim is disciplined reuse. A model inventory can support NIST governance, an ISO management system and a legal documentation duty. The common capability can be shared, but each receiving obligation may require different fields, actors, retention, accuracy, submission or review evidence. A common identifier does not make the evidence transferable.

The correct states include satisfies, contributes, requires overlay, conflicts, supersedes, not applicable and unknown. Unknown is not a compliance result. Not applicable requires a reason, evidence, owner and review trigger. No mapping count, compliance percentage or automated legal conclusion belongs in the method.

The strongest rival: a simple register and expert legal analysis

Experts often need a clear obligations register, legal advice and accountable control owners rather than an elaborate graph. Crosswalk programmes can consume large budgets, become stale and create false comfort. The graph is justified only when it reduces duplicate work, exposes scope and evidence gaps, and makes regulatory change traceable to operational decisions.

Where interpretation is contested or material facts are unavailable, record unknown and route the matter to accountable legal judgement. Embeddings can suggest candidate relationships for review, but semantic proximity is not authority. The enterprise should use the smallest graph that preserves decisive distinctions.

Obligation-to-Control Crosswalk GraphEleven node types preserve the chain from law to outcome

The graph prevents a common collapse: source text becomes a control label, the label becomes a test, and test completion becomes a compliance assertion. Each transition needs an accountable edge. A provision may require several objectives; one objective may receive several implementations; one test can support several evidence objects; evidence may contribute without satisfying.

Store source and interpretation versions separately. A law can remain unchanged while authoritative guidance or enterprise interpretation moves. Preserve the prior decision and its effective period so historical releases can be reconstructed. OSCAL can help represent catalogues, profiles, implementations and assessment results, but legal applicability and interpretation remain governed human judgements.

Typed edgesContribution is not satisfaction

Satisfies means evidence supports the full interpreted obligation for the stated scope. Use it only when applicability, implementation and proof all match. Contributes means a control addresses part of the obligation but cannot establish full satisfaction. Requires overlay means a shared objective or implementation needs jurisdiction, role, population or system-specific extension.

Conflicts records obligations or interpretations that cannot be implemented together without resolution. Supersedes connects a later source or interpretation to the exact earlier scope and time it replaces. Not applicable is a reasoned exclusion supported by facts and a change trigger. Unknown means applicability or interpretation is unresolved and cannot be treated as compliant.

Edge type belongs to a specific source, provision, scope, control version and time. The same inventory implementation can satisfy one reporting requirement, contribute to a management framework and require an overlay for a provider documentation duty. A later test may upgrade a contributes edge to satisfies for one population while other scopes remain partial.

False equivalenceSimilar vocabulary can hide different legal subjects

Transparency may concern a data subject, a deployer, a market authority, a customer or the public. Human oversight may be a provider design duty, a deployer operating duty, a supervisory expectation or an internal governance choice. Incident reporting differs by reportable event, severity, actor, recipient, clock and content. Word matching sees resemblance; implementation requires these distinctions.

Compare at least actor, regulated object, trigger, population, lifecycle stage, threshold, action, evidence, recipient, deadline and consequence. A framework outcome can suggest a control objective, but it cannot be mapped directly to a binding provision as if authority and scope were equal. OECD principles, NIST guidance, ISO requirements and EU law remain distinct even when a common control supports them.

Use semantic search to surface candidates for expert review, not to decide edge type. The reviewer sees both source passages, applicability facts, interpretations and evidence. If the difference cannot yet be resolved, mark unknown. This state is more accurate and safer than a guessed green cell.

Shared control coreReuse capability, then add the receiving obligation's overlay

A shared control objective describes a common outcome such as maintaining an accurate inventory of governed systems, preserving human decision authority or detecting reportable incidents. The implementation may provide common data, workflows and ownership. Overlays add jurisdiction, entity role, system category, population, legal definition, deadline, recipient, retention or evidence.

For inventory, the core may store system identity, owner, purpose, versions, data, suppliers and status. A management-system overlay adds lifecycle and review records. A provider documentation overlay adds information required for a regulated product. A deployer overlay adds actual use, monitoring and authority. A supervisory model register may require conceptual, validation and use details. One implementation can serve all, but its evidence is source-specific.

Keep overlays executable and separately testable where possible. A role field, jurisdiction-specific notice template or retention policy should map back to its provision and effective time. Avoid copying whole controls by jurisdiction when a stable core exists; avoid centralising so aggressively that source-specific meaning disappears.

Evidence Reuse RuleA common control identifier does not transfer proof

Evidence is reusable only when the control objective, implementation version, obligation scope, population, time, testing method, evidence quality and retention meet the receiving obligation. Evaluate every gate. A test on one language, geography or model version cannot support a different population merely because the control record has the same identifier.

A control can be genuinely reusable while its existing evidence is not. A common human-review workflow may serve both a supervisory model-use expectation and a high-risk system oversight duty. The workflow implementation is shared. Existing interview evidence from analysts may not prove that frontline deployers receive information, time, skill and authority in the second setting. Reuse the control, then run the receiving test.

Retain provenance and a receiving-obligation decision. Record accepted evidence, rejected evidence, scope delta, test delta, owner and expiry. Where the implementation version changes, old evidence may remain relevant only to historical releases. Where retention does not meet the new requirement, evidence reuse fails even if the test itself was sound.

Hierarchy and effective timeEvery edge lives inside an authority and a clock

A regulation, delegated act, supervisory interpretation, standard, voluntary framework, official implementation page and internal policy do not carry the same authority. Record the type explicitly. A helpful government summary can explain implementation, but the official legal text remains the source for a binding provision. A standard can support a management system without becoming a legal safe harbour. Internal policy may deliberately exceed a legal minimum, yet that choice does not change the law.

Time has several meanings: publication, entry into force, general application, a provision-specific application date, a transition period, a supervisory expectation and an internal readiness deadline. Preserve each date rather than compressing them into one status field. The European AI Act, for example, applies through a staged schedule and has continuing legislative implementation activity. The European Commission portal is useful current context, but teams should trace any claimed duty back to the official text and amendments applicable to the particular date.

A supersedes edge must identify exactly what changed, for which actor and scope, and from what date. In April 2026, the Federal Reserve, OCC and FDIC issued revised model-risk guidance that supersedes the 2011 interagency guidance for covered banking organisations. The revised guidance also says it does not address risks from generative AI or agentic AI. A crosswalk must not silently carry the earlier model-risk treatment into a current AI control claim.

Transition is an operational state, not a footnote. During it, retain the old obligation, incoming obligation, affected population, target implementation, test readiness, evidence migration, owner and release decision. A future edge cannot be treated as currently satisfied, and an expired rule cannot be deleted when historical decisions still depend on it.

Interpretation and conflictOpen a docket before choosing an implementation

A conflict is more than two passages that look inconsistent. First determine whether the sources govern the same actor, system, data, population, action and time. Many apparent conflicts disappear after applicability analysis. Real tension remains when two live obligations or accountable interpretations require incompatible handling, such as disclosure and confidentiality, access and security, retention and deletion, or central monitoring and local restrictions.

Do not resolve tension by selecting the stricter-looking phrase. Open a conflict docket containing both source passages, authority and time, applicable facts, interpreters, uncertainty, feasible implementation options, affected people, evidence, escalation route and deadline. Legal owns the interpretation; product and operations supply technical facts; risk challenges residual exposure; independent assurance tests the authorised implementation.

The docket can authorise a scoped design, seek clarification, restrict a use, alter data flows, delay a release or leave the scope. Record the rejected alternatives and the facts that would reopen the decision. A conflict edge remains visible until the resolution has been translated into controls and tested. The crosswalk is a decision record, not a substitute for legal advice.

Regulatory diff impactA changed source must reach live decisions before its deadline

A redline is only the beginning of regulatory change. Classify each change to authority, definitions, role, scope, norm, threshold, evidence, deadline or consequence. An interpretation change belongs in the same mechanism even when the source text is unchanged. Record the previous and new nodes, effective time, confidence and accountable interpreter.

Then traverse outgoing edges. Identify affected control objectives and implementation versions, tests, evidence objects, suppliers, systems, training, releases and in-scope decisions. Query inbound edges too: one supplier record or shared control may support several provisions. Impact analysis is complete only when every affected owner has accepted an action, deadline and verification route, or an authorised reason for no change.

Prioritisation should follow effective time, affected decisions, exposure and reversibility, not the number of changed paragraphs. A small definition change can alter scope across many products. A large recital edit may require no control change. Separate legal significance from engineering effort and track both.

Close the diff only after implementation, testing, evidence and decision records are updated. Preserve the earlier graph for historical reconstruction. Releases approaching the transition date need an explicit proceed, restrict, delay or withdraw decision. Supplier dependencies remain first-class nodes: request new evidence, amend an obligation, create a compensating control or constrain the integration.

Ten worked casesApply the full chain, including its negative controls

These compact cases demonstrate decision structure, not universal legal conclusions. Applicability and interpretation depend on facts, jurisdiction and current source text. Each row preserves the provision and scope, operational response, proof, edge, residual gap and trigger rather than treating a mapping label as the answer.

The fifth case is the important reuse boundary: a validation capability may be reusable while prior evidence does not cover a new model, method or population. The eighth prevents classification laundering between regimes. The tenth makes a reasoned exclusion narrow, evidenced and reversible rather than a permanent green status.

Interactive instrumentRegulation-to-Control Crosswalk Workbench

Choose the closest facts or load a named case. The result is a structured routing aid, not legal advice or an automated compliance conclusion. It deliberately produces no score and no mapping count.

Executive cadenceKeep the graph small enough to govern and rich enough to trust

At intake, legal and regulatory affairs register the authoritative source, provision, hierarchy, version, effective time and initial applicability. Product and operations supply the actual role, system, decision, population, supplier and release facts. No candidate similarity becomes an edge without accountable interpretation.

During control design, first-line owners identify shared objectives and implementations; legal preserves source-specific meaning; risk challenges scope and residual gaps; assurance defines independent tests. The Evidence Reuse Rule decides whether prior proof transfers. Overlays stay explicit, versioned and testable.

Before release, the decision owner reviews unknowns, conflicts, not-applicable records, supplier dependencies, transition actions and evidence validity. The choice to proceed, restrict, delay or leave scope cites the graph state. A mapped provision count is never a substitute for that decision.

On change, a source or interpretation diff traverses affected controls, tests, evidence, suppliers, releases and decisions. Owners accept actions before effective time; assurance verifies closure; historical versions remain available. Periodically retire unused nodes and duplicated mappings. The graph earns its cost only when it improves a real implementation or decision.