Stop running three parallel governance programs. NIST AI RMF, ISO/IEC 42001, and the EU AI Act overlap by design. The crosswalk that lets you build once and certify against all three, with the high-performer revenue lever per row.

The Agentic Governance Overlap Matrix: How NIST, ISO 42001, and the EU AI Act Stack Into One Operating System

Most enterprise AI programs treat NIST AI RMF, ISO/IEC 42001, and the EU AI Act as three separate workstreams. That structure is the reason the programs run over budget, over time, and underweight on actual operating impact. Confidence: high. The three frameworks were designed by different bodies for different audiences but they overlap on purpose. Run them as one operating system and you compress the program by sixty to seventy percent. The SOPHIZO-GOV-004 Agentic Governance Overlap Matrix is the crosswalk that makes that compression executable.

Why the Three Frameworks Are Stackable

NIST AI RMF 1.0 is a voluntary risk management framework published by the US National Institute of Standards and Technology in January 2023. It is functional in design. It tells you what to do across four functions: Govern, Map, Measure, Manage. It does not tell you how to certify, because it is voluntary.

ISO/IEC 42001:2023 is an international management system standard for AI. It is structural in design. It defines the controls, policies, roles, and processes that constitute an AI Management System. It is certifiable. An accredited certification body can audit your AI Management System against ISO 42001 and issue a certificate.

The EU AI Act is binding regulation. It is legal in design. It tells you what is prohibited, what is high-risk, what obligations apply per tier, and what penalties apply per violation. It is enforced.

The three layer cleanly. NIST gives you the operating functions. ISO 42001 gives you the controls that operationalize the functions. The EU AI Act gives you the legal obligations satisfied by those controls. Build the controls once. Pass the audit once. Satisfy the regulation once.

What the Overlap Matrix Actually Shows

The matrix has twelve rows, one per NIST sub-function across the four core functions. Each row reads left to right.

The first column names the NIST function. Govern. Map. Measure. Manage. With the sub-function. Govern Risk Tolerance. Map System Context. Measure Drift Detection. And so on.

The second column lists the ISO/IEC 42001 Annex A controls that operationalize that NIST sub-function. These are the controls your auditor will check during ISO certification. A.2 AI Policies. A.3 Internal Organization. A.4 AI System Inventory. A.5 Impact Assessment. A.6 Lifecycle Management. A.7 Data for AI Systems. A.8 Information for Interested Parties. A.9 Use of AI Systems. The Annex A control set covers thirty-eight controls total.

The third column maps the binding EU AI Act obligation that the same NIST sub-function and ISO Annex A control satisfies. Article 9 risk management system. Article 10 data governance. Article 11 technical documentation. Article 12 logging. Article 13 transparency to deployers. Article 14 human oversight. Article 17 quality management system. Article 26 deployer obligations. Article 49 EU database registration. Article 72 post-market monitoring.

The fourth column is the differentiating one. It names the high-performer revenue lever unlocked by the row, in language a board can understand. This is what most governance documents skip. They tell you the obligation. They do not tell you the value.

The fifth column names the agentic failure mode if you skip the row. This is the loss column. The pair of columns four and five gives you a real ROI argument: every row has a revenue lever and a failure mode. That is your investment thesis. Governance is not a cost center.

Three Worked Rows

Govern Policies and Accountability. NIST asks for executive ownership and assigned responsibilities. ISO 42001 controls A.2 AI Policies, A.3 Internal Organization, A.9.2 Roles and Responsibilities operationalize it. EU AI Act Articles 9, 17, and 26 satisfied. Revenue lever: executive ownership of AI is associated with materially higher EBIT outcomes in cross-industry studies, and with faster deployment approvals because legal cycles compress when accountability is named. Failure mode if skipped: agents deployed without authorization. Incidents go unescalated. Shadow AI proliferates undetected.

Map System Context and AI Inventory. NIST asks for documented AI system inventory and lifecycle mapping. ISO 42001 controls A.4.1 AI System Inventory, A.4.2 System Documentation, A.6.1 Lifecycle Planning operationalize it. EU AI Act Article 11 technical documentation, Article 49 EU database registration, and the Article 6 classification (which requires knowing what you have) satisfied. Revenue lever: an inventory is the prerequisite for enterprise scaling. Organizations without an inventory experience materially more AI incidents and cannot measure use-case-level ROI. Failure mode if skipped: unknown agents in production. Vendor model updates change risk profile invisibly. No baseline means you cannot prove AI value or detect decay.

Measure Drift Detection and Monitoring. NIST asks for ongoing monitoring of model performance and detection of drift. ISO 42001 controls A.6.3 Ongoing Monitoring, A.9.5 Incident Detection, A.9.6 Performance Review Cadence operationalize it. EU AI Act Articles 9(1)(d) post-market monitoring, 26(5) deployer monitoring, and 72 market surveillance satisfied. Revenue lever: monitoring is the prerequisite for safe agentic scale. Drift detection protects forecast accuracy as a leading revenue signal. Failure mode if skipped: pipeline AI drifts after a market shift. Q3 miss blamed on sales. Email AI tone degrades after a vendor model update and is undetected. Agent begins unauthorized actions as context accumulates.

The Operating Implication

Build to the matrix once. The same control set, same evidence repository, same incident response process, same monitoring cadence will satisfy NIST, pass an ISO 42001 audit, and demonstrate EU AI Act compliance. You file one set of artifacts, not three. You train your team once, not three times. You spend on substance, not duplication.

Run the three programs in parallel without the matrix and you produce a governance program your operating team will quietly route around. Run them as one program against the matrix and the governance team becomes the function that ships.

Download the Agentic Governance Overlap Matrix (email gated).

The Agentic Governance Overlap Matrix: How NIST, ISO 42001, and the EU AI Act Stack Into One Operating System