Appearance
Control overlap across AI governance frameworks
This page shows how many Controls two Frameworks in Modulos share, at the AI System level and at the Organization level. Teams that use more than one Framework want to know this when they add a Framework.
How Modulos shares Controls between Frameworks
In Modulos, each Framework holds Requirements that Modulos takes from the source instrument. The source can be a law, a standard, or guidance. Thus a Requirement is not always a legal obligation. Each Requirement has linked Controls, and you attach Evidence in each Control.
Modulos shares Controls between Frameworks, but it does not share Requirements:
- Each Requirement belongs to one Framework. No two Frameworks share a Requirement, and each Requirement follows its own source.
- One Control can apply to the Requirements of more than one Framework. Other Controls apply to the Requirements of one Framework only.
For two Frameworks at the same level, the shared-Control count gives the number of Controls their Requirements share. The levels are AI System and Organization.
A shared Control does not make a Requirement Fulfilled. The Requirement Owner reviews the completed Controls and then marks each Requirement Fulfilled, also when a different Framework uses the same Controls. Frameworks in Modulos tells you how Frameworks work in an AI System.
The overlap matrix
The overlap matrix shows each pair of Modulos Frameworks at one level, with the Controls that the two Frameworks share. The Figures section below lists the pairs that share the most Controls.
Loading Control overlap data…
How to read the matrix
Each cell of the overlap matrix gives a percentage in one direction. Read the row first, then the column. The cell gives the shared Controls as a percentage of all the Controls of the column Framework. Different Control totals can give different percentages in the two directions.
For example, at the AI System level the EU AI Act and NIST AI RMF Frameworks share 54 Controls. These are 47% of the Controls of the EU AI Act Framework and 89% of the Controls of the NIST AI RMF Framework. At the Organization level, the two Frameworks share 4 Controls: 22% of the EU AI Act Framework and 21% of the NIST AI RMF Framework.
A percentage tells you about the full Framework. The EU AI Act Framework holds Requirements for more than one operator role, for example providers and deployers. Thus a percentage does not tell you which Requirements apply to one operator, and it does not tell you that a Requirement is Fulfilled.
When you set the matrix to show the number of shared Controls, the two cells of a pair show the same number. The direction changes only the number that you divide by.
Figures
The figures below come from the same data as the overlap matrix. In the matrix and in these figures, "AI application" is the AI System level.
These figures show mapped Controls, not completed work. Shared Controls do not make Requirements Fulfilled. The percentage reductions compare Control counts, not work.
AI System level
Counted Framework by Framework, the 26 Frameworks at this level map 1,240 Controls. Because Frameworks share Controls, these are 595 different Controls, 52% fewer than that count. Requirements of two or more Frameworks map 297 of the 595 Controls.
Framework pairs that share the most Controls:
| Frameworks | Shared Controls | Share of the first | Share of the second |
|---|---|---|---|
| ISO 27001 and NIS2 | 62 | 65% | 87% |
| OWASP - Top 10 for LLM Applications and OWASP - Top 10 for Agentic Applications | 56 | 66% | 85% |
| EU AI Act and NIST AI RMF | 54 | 47% | 89% |
| ISO 27001 and DORA | 44 | 46% | 81% |
| NIS2 and DORA | 40 | 56% | 74% |
| ISO 27001 and Cyber Resilience Act | 37 | 39% | 52% |
| EU AI Act and MAS FEAT | 35 | 31% | 92% |
| NIS2 and Cyber Resilience Act | 34 | 48% | 48% |
Controls that the most Frameworks map:
| Control | Title | Frameworks |
|---|---|---|
MCF-53 | Technical Documentation | 10 |
MCF-23 | Risk Management at Inception | 9 |
MCF-67 | Production Data Drift Monitoring | 9 |
MCF-61 | Deployment Acceptance | 8 |
MCF-65 | Deployed AI System Performance Monitoring | 8 |
MCF-76 | Risk Management in Operation | 8 |
MCF-32 | Data Bias Assessment | 7 |
MCF-55 | Testing Procedures | 7 |
MCF-58 | Model Fairness Testing | 7 |
MCF-66 | Production Data Quality Monitoring | 7 |
Organization level
Counted Framework by Framework, the 22 Frameworks at this level map 772 Controls. Because Frameworks share Controls, these are 335 different Controls, 57% fewer than that count. Requirements of two or more Frameworks map 155 of the 335 Controls.
Framework pairs that share the most Controls:
| Frameworks | Shared Controls | Share of the first | Share of the second |
|---|---|---|---|
| ISO 27001 and ISO 27701 | 66 | 96% | 84% |
| ISO 27001 and ISO 42001 | 60 | 87% | 80% |
| ISO 42001 and ISO 27701 | 60 | 80% | 76% |
| ISO 27001 and NIS2 | 52 | 75% | 64% |
| ISO 27001 and DORA | 52 | 75% | 60% |
| ISO 27701 and NIS2 | 52 | 66% | 64% |
| ISO 42001 and NIS2 | 51 | 68% | 63% |
| ISO 27701 and DORA | 51 | 65% | 59% |
Controls that the most Frameworks map:
| Control | Title | Frameworks |
|---|---|---|
OCF-1 | Governance Structure | 11 |
OCF-44 | AI Literacy and Awareness | 8 |
OCF-52 | Risk Management System | 8 |
OCF-95 | Risk criteria establishment | 8 |
OCF-97 | Risk assessment process | 8 |
OCF-123 | Document availability and suitability | 8 |
OCF-131 | External provider control | 8 |
OCF-47 | Documentation Keeping | 7 |
OCF-98 | Risk treatment process | 7 |
OCF-109 | Competence determination | 7 |
What the figures show and do not show
The figures show Control counts, shares, and links to Frameworks. The figures do not give all the work for a second Framework:
- The figures count Controls, not work. The work for each Control is different. You collect the Evidence for a shared Control in your own context. Controls implemented for one Framework can decrease the work for a second Framework that shares them.
- A shared Control is not a Fulfilled Requirement. The Requirement Owner reviews each Requirement of the second Framework and marks it Fulfilled, as How Modulos shares Controls between Frameworks tells you.
- The figures show how Modulos maps Requirements to Controls. Modulos decides which Controls each Requirement links. When Modulos changes these links, the figures change, also when the source instrument does not change. The figures do not compare the text of two instruments. For that, use the pages that compare two frameworks.
When the figures change
The overlap figures on this page change only when Modulos updates this page with new data from its Frameworks. They do not change automatically with each platform release. Thus they can be older than the Frameworks in Modulos. Modulos generated these figures on October 22, 2026.