Crosswalk pair
AI Governance Essentials and GDPR, control by control
1 canonical control in Keel’s library satisfies clauses of both AI Governance Essentials and GDPR. Implement each once, attach the evidence once, and it counts toward each standard. The overlap is the work you don’t repeat.
The overlap
What the two libraries have in common
Every figure here counts canonical controls in Keel’s library, not clauses of either standard. Each standard’s own authored count is on its framework page.
1
Controls that satisfy both
Canonical controls that crosswalk to at least one clause of each.
24
In Keel’s library for AI Governance Essentials
4% of them also map to GDPR.
50
In Keel’s library for GDPR
2% of them also map to AI Governance Essentials.
4
Evidence artifacts expected
Across the shared controls, from Keel’s evidence guidance. Gathered once.
-
1 control of 24 in Keel’s library for AI Governance Essentials also maps to GDPR.
-
GDPR 2%
1 control of 50 in Keel’s library for GDPR also maps to AI Governance Essentials.
The mapping
Controls that satisfy both
Each row is one control in Keel’s library and the clauses it answers on each side. Do the work once; both columns are then evidenced by the same artifacts.
| Canonical control | AI Governance Essentials clauses | GDPR clauses |
|---|---|---|
| Lawful basis for processing Every processing activity has a lawful ground identified and recorded before it starts, chosen from the grounds the law makes available rather than assumed after the fact - the individual’s consent, necessity for a contract with them or for steps taken at their request before entering one, a legal obligation on the organization, someone’s vital interests, a task carried out in the public interest or under official authority, or legitimate interests pursued by the organization or by a third party. Where legitimate interests is the ground, the interest is stated, the processing is tested as actually necessary to it, and the interest is weighed against the interests, rights and freedoms of the people affected - with particular weight where any of them is a child - and that assessment is written down rather than reached in conversation; a public authority may not rely on legitimate interests at all for the processing it carries out in performing its tasks. Where consent or a contract is the ground, what makes it available is recorded too, so a later reader can see why the ground applies to this activity and not merely that somebody selected it. The ground is revisited when the activity changes, when the ground stops being available - consent withdrawn, a contract ended, an obligation repealed - and on the same cadence as the register of processing activities; an activity found to have no ground is stopped rather than allowed to run while the question is settled. Where personal data feeds an AI system - as training data, as tuning data, or as an input at inference - that use is treated as a processing activity in its own right and given its own recorded ground, rather than inheriting the ground recorded for the activity the data was first collected under. The rights the people concerned hold over that processing are routed into the same procedure that serves every other activity, so a request is not refused on the basis that the data has been absorbed into a model. | DA.3 | Art.6(1) |
Beyond the pair
Where else this work counts
A framework is lit when a shared control above also maps to it. Unlit means none of them do — an absence, not a judgment about that standard.
Also reached by this control
- Amazon Appstore Child-Directed Apps
- Apple App Store Kids Category
- CIS Critical Security Controls
- COPPA
- ESG Essentials
- EU AI Act
- Google Play Families
- HIPAA
- ISO 9001
- ISO/IEC 27001
- ISO/IEC 42001
- NIST AI Risk Management Framework
- NIST Cybersecurity Framework
- NIST SP 800-171
- NIST SP 800-53
- PCI DSS
- SOC 2
- SOX (Sarbanes-Oxley) Section 404
- US Employment Law - Federal Baseline
The thesis
Why this is one project, not two
On a crosswalk-native model, GDPR mostly lights up controls you already built for AI Governance Essentials. You’re not re-uploading the same screenshot for a second audit. You apply the framework and see the genuine delta worth working. That’s the whole idea behind collect once, comply everywhere.
Next step
Add GDPR to the work you already did
Apply both frameworks in one workspace and see the overlap measured against the controls you already hold.