Where each control lands in the frameworks buyers already use
Every SoAITrust control has a primary reference (ISO/IEC 27001, ISO/IEC 42001, NIST AI RMF, OWASP Top 10 for LLM, LGPD/GDPR) and an indicative mapping to the EU AI Act, the Shared Assessments SIG questionnaire and the CSA Cloud Controls Matrix v4, which the CAIQ is built on.
Use it to answer a buyer who asks "does this cover the SIG AI domain?" or "which EU AI Act obligations does the assessment touch?". The mapping is at domain and article level; it does not replace a legal reading of the regulation.
Crosswalk v1, September 2026. Indicative mapping at domain and article level, maintained by SoAITrust. EU AI Act references point to Regulation (EU) 2024/1689; SIG domains follow the Shared Assessments SIG Core; CCM codes follow CSA Cloud Controls Matrix v4. Trademarks belong to their owners; no affiliation is implied.