Crosswalk pair
AI Governance Essentials and PIPEDA, control by control
1 canonical control in Keel’s library satisfies clauses of both AI Governance Essentials and PIPEDA. Implement each once, attach the evidence once, and it counts toward each standard. The overlap is the work you don’t repeat.
The overlap
What the two libraries have in common
Every figure here counts canonical controls in Keel’s library, not clauses of either standard. Each standard’s own authored count is on its framework page.
1
Controls that satisfy both
Canonical controls that crosswalk to at least one clause of each.
24
In Keel’s library for AI Governance Essentials
4% of them also map to PIPEDA.
30
In Keel’s library for PIPEDA
3% of them also map to AI Governance Essentials.
4
Evidence artifacts expected
Across the shared controls, from Keel’s evidence guidance. Gathered once.
-
1 control of 24 in Keel’s library for AI Governance Essentials also maps to PIPEDA.
-
PIPEDA 3%
1 control of 30 in Keel’s library for PIPEDA also maps to AI Governance Essentials.
The mapping
Controls that satisfy both
Each row is one control in Keel’s library and the clauses it answers on each side. Do the work once; both columns are then evidenced by the same artifacts.
| Canonical control | AI Governance Essentials clauses | PIPEDA clauses |
|---|---|---|
| Lawful basis for processing Every processing activity has a lawful ground identified and recorded before it starts, chosen from the grounds the law makes available rather than assumed after the fact - the individual’s consent, necessity for a contract with them or for steps taken at their request before entering one, a legal obligation on the organization, someone’s vital interests, a task carried out in the public interest or under official authority, or legitimate interests pursued by the organization or by a third party. Where legitimate interests is the ground, the interest is stated, the processing is tested as actually necessary to it, and the interest is weighed against the interests, rights and freedoms of the people affected - with particular weight where any of them is a child - and that assessment is written down rather than reached in conversation; a public authority may not rely on legitimate interests at all for the processing it carries out in performing its tasks. Where consent or a contract is the ground, what makes it available is recorded too, so a later reader can see why the ground applies to this activity and not merely that somebody selected it. The ground is revisited when the activity changes, when the ground stops being available - consent withdrawn, a contract ended, an obligation repealed - and on the same cadence as the register of processing activities; an activity found to have no ground is stopped rather than allowed to run while the question is settled. Where personal data feeds an AI system - as training data, as tuning data, or as an input at inference - that use is treated as a processing activity in its own right and given its own recorded ground, rather than inheriting the ground recorded for the activity the data was first collected under. The rights the people concerned hold over that processing are routed into the same procedure that serves every other activity, so a request is not refused on the basis that the data has been absorbed into a model. | DA.3 | 5(3), 7(1), 7(2) |
Beyond the pair
Where else this work counts
A framework is lit when a shared control above also maps to it. Unlit means none of them do — an absence, not a judgment about that standard.
Also reached by this control
- Amazon Appstore Child-Directed Apps not reached
- Apple App Store Kids Category not reached
- CIS Critical Security Controls not reached
- COPPA not reached
- ESG Essentials not reached
- EU AI Act not reached
- GDPR also reached
- Google Play Families not reached
- HIPAA not reached
- ISO 9001 not reached
- ISO/IEC 27001 not reached
- ISO/IEC 42001 not reached
- NIST AI Risk Management Framework not reached
- NIST Cybersecurity Framework not reached
- NIST SP 800-171 not reached
- NIST SP 800-53 not reached
- PCI DSS not reached
- SOC 2 not reached
- SOX (Sarbanes-Oxley) Section 404 not reached
- US Employment Law - Federal Baseline not reached
Nearby pairs
The thesis
Why this is one project, not two
On a crosswalk-native model, PIPEDA mostly lights up controls you already built for AI Governance Essentials. You’re not re-uploading the same screenshot for a second audit. You apply the framework and see the genuine delta worth working. That’s the whole idea behind collect once, comply everywhere.
Next step
Add PIPEDA to the work you already did
Apply both frameworks in one workspace and see the overlap measured against the controls you already hold.