Frontier technology risk: crosswalk to external standards
The external standards in the crosswalk domains of frontier technology risk, from the register, with the relation of each to the Nexus Standards. Each row links to the issuing body, and each relation is evidenced by attestations identified by UNIs (Unique Nexus Identifier).
- Nexus Standards: NS-0, NS-10, NS-11, NS-12.
- Open standards: FIPS 203 Module-Lattice-Based Key-Encapsulation Mechanism Standard; OECD AI Principles; PROV-O: The PROV Ontology; NIST Cybersecurity Framework 2.0.
- Data and feeds: Our World in Data datasets; World Bank Open Data and World Development Indicators API.
- Couples with: AI and autonomous systems; Cyber and digital; Biological hazard; Global catastrophic and existential.
The process.
The crosswalk as a table: 47 external standards by domain
Nexus Standards in the graph: NS-0, NS-3, NS-9, NS-11, NS-12. A relation is a register entry, never a compliance claim.
5 Nexus Standards · 4 domains · 47 external standards · 23 issuing bodies · 0 implementing repositories. Relations (adopt, profile, crosswalk, cite) are as recorded in the register; names and standards remain with their stewards.
Crosswalk graph79 nodes and 114 links from the registry of external standards, programme areas and implementations (the external standards register, the consumers register. Relations (adopt, profile, crosswalk, cite) are shown as recorded in the register.
- Nexus Standards
- 4
- NS-0, NS-10, NS-11
- Open standards
- 4
- named, never copied
- Data and feeds
- 2
- listed for reference
- Couplings
- 4
- with other areas
AI and models
16 register entries.
| Standard | Body | Version | Relation | Access | Verified |
|---|---|---|---|---|---|
| ISO/IEC 23894:2023 Information technology – Artificial intelligence – Guidance on risk management | ISO/IEC JTC 1/SC 42 | 2023 (edition 1, February 2023) | compatibility profile (restricted) | paywalled | verified |
| ISO/IEC 42001:2023 Artificial intelligence – Management system | ISO/IEC JTC 1/SC 42 | 2023 | compatibility profile (restricted) | paywalled | unverified |
| ISO/IEC 42005:2025 AI system impact assessment | ISO/IEC JTC 1/SC 42 | 2025 (28 May 2025 per secondary sources) | cite | paywalled | unverified |
| NIST AI Risk Management Framework (AI RMF 1.0, NIST AI 100-1) | NIST | 1.0 (26 January 2023) | crosswalk | open | verified |
| NIST AI 600-1 Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile | NIST | Final (July 2024) | cite | open | verified |
| IEEE 7000-2021 Standard Model Process for Addressing Ethical Concerns during System Design | IEEE Standards Association | 2021 | cite | paywalled | unverified |
| IEEE 7001-2021 Standard for Transparency of Autonomous Systems | IEEE Standards Association | 2021 | cite | paywalled | verified |
| IEEE 7010-2020 Recommended Practice for Assessing the Impact of Autonomous and Intelligent Systems on Human Well-Being | IEEE Standards Association | 2020 | cite | paywalled | unverified |
| Model Cards for Model Reporting | Mitchell et al. (FAT* 2019) | 2019 paper (arXiv 1810.03993) | profile | open | unverified |
| OECD AI Principles | OECD | 2024 update | crosswalk | open | unverified |
| UNESCO Recommendation on the Ethics of Artificial Intelligence | UNESCO | 2021 | crosswalk | open | unverified |
| ISO/IEC 5338:2023 AI system life cycle processes | ISO/IEC JTC 1/SC 42 | 2023 | compatibility profile (restricted) | paywalled | unverified |
| ISO/IEC 5259 Data quality for analytics and machine learning | ISO/IEC JTC 1/SC 42 | 2024 | compatibility profile (restricted) | paywalled | unverified |
| ISO/IEC 24029 Assessment of the robustness of neural networks | ISO/IEC JTC 1/SC 42 | 2023 | cite | paywalled | unverified |
| ISO/IEC 25059:2023 Quality model for AI systems | ISO/IEC JTC 1/SC 7 | 2023 | compatibility profile (restricted) | paywalled | unverified |
| Model Context Protocol specification | Agentic AI Foundation (Linux Foundation) | 2025-06-18 | profile | open | unverified |
Unverified entries rest on a secondary source for at least one field, as indicated in the register.
Security and cyber
16 register entries.
Unverified entries rest on a secondary source for at least one field, as indicated in the register.
Digital and AI regulation
8 register entries.
| Standard | Body | Version | Relation | Access | Verified |
|---|---|---|---|---|---|
| Regulation (EU) 2024/1689 (Artificial Intelligence Act) | European Parliament and Council | in force 1 August 2024; staged application | crosswalk | open | verified |
| CEN-CENELEC JTC 21 harmonised standards in support of the EU AI Act (incl. prCEN/CLC/TR 18347) | CEN-CENELEC JTC 21 | in development; EN 18286 reported at public enquiry (30 October 2025) and later approval by differing sources | cite | paywalled | unverified |
| Regulation (EU) 2024/2847 (Cyber Resilience Act) | European Parliament and Council | in force 10 December 2024; reporting obligations from 11 September 2026; main requirements 11 December 2027 | cite | open | unverified |
| Directive (EU) 2022/2555 (NIS2) | European Parliament and Council | transposition deadline 17 October 2024 | cite | open | unverified |
| Regulation (EU) 2016/679 (General Data Protection Regulation) | European Parliament and Council | 2016 | cite | open | unverified |
| OECD Recommendation of the Council on Regulatory Policy and Governance | OECD | 2012 | cite | open | unverified |
| Universal Digital Public Infrastructure Safeguards Framework | UN Office of the Secretary-General’s Envoy on Technology and UNDP | 2024 | crosswalk | open | unverified |
| United Nations Global Principles for Information Integrity | United Nations | 2024 | crosswalk | open | unverified |
Unverified entries rest on a secondary source for at least one field, as indicated in the register.
Supply chains and logistics
7 register entries.
| Standard | Body | Version | Relation | Access | Verified |
|---|---|---|---|---|---|
| ISO/IEC 27036-2:2022 Cybersecurity – Supplier relationships – Part 2: Requirements | ISO/IEC JTC 1/SC 27 | 2022 (Part 1 2021, Part 3 2023, Part 4 cloud) | cite | paywalled | verified |
| NIST SP 800-161 Rev. 1 Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations | NIST | Rev. 1 (May 2022), Update 1 (1 November 2024) | cite | open | verified |
| OASIS Common Security Advisory Framework (CSAF) Version 2.0 | OASIS CSAF TC | 2.0 (OASIS Standard, November 2022) | cite | open | verified |
| OpenVEX specification | OpenVEX community (OpenSSF project) | draft | cite | open | unverified |
| Supply-chain Levels for Software Artifacts (SLSA) | OpenSSF (Linux Foundation) | 1.1 (April 2025, Approved Specification); site states 1.2 is current | adopt | open | verified |
| ISO 28000:2022 Security and resilience – Security management systems | ISO/TC 292 | 2022 | compatibility profile (restricted) | paywalled | unverified |
| WCO SAFE Framework of Standards to Secure and Facilitate Global Trade | World Customs Organization | 2021 | cite | open | unverified |
Unverified entries rest on a secondary source for at least one field, as indicated in the register.
Relation types and their evidence
| Relation | Meaning | Evidence |
|---|---|---|
cite | The Nexus Standard refers to the external standard as context. | Identifier, version and URL in the register. |
profile | The Nexus Standard constrains or specialises an open external standard (for example STAC, DCAT, PROV-O, DataCite, CAP). | Conformance tests against the external standard’s own validator where one exists. |
crosswalk | Elements of the external standard map to Nexus elements (clauses, record fields). | A crosswalk table in the register entry; each row cites the external clause by number, never by text. |
adopt | The Nexus Standards use the external standard as it is for a function (for example ISO 3166-1, SPDX, ORCID, ROR). | Validation of values against the external scheme. |
extend | A Nexus Standard adds machine-readable, real-time or provenance elements that the external standard lacks. | The extension is a Nexus clause or field; the external standard is cited as the baseline. |
gap | No external standard covers the concern; a Nexus Standard specifies it. | The gap statement in the landscape study. |
Questions and answers.
Does a crosswalk establish that a frontier technology risk artefact conforms to these standards?
Why are some relations shown as compatibility profile (restricted)?
Why are some entries marked unverified?
Around frontier technology risk.
Shape the standards for frontier technology risk.
Governments, regulators, standards bodies, industry, academia and communities are invited to shape the catalogue ahead of its first official release, targeted for 2030: comment on a draft, propose a change, join a working group or host a field exercise.
Status and use. The Nexus Standards are proposed standards developed through an open process under NS-13 and published for voluntary use; they do not constitute certification, accreditation or regulatory approval, and adoption remains a decision of the Global Standards Council and, in each country, of its National Standards Council. A UNI (Unique Nexus Identifier) identifies an artefact; it does not certify it. Names of standards bodies and their standards belong to their stewards and are used only to identify the documents; no text of an external standard is reproduced here. Nexus Standards is not affiliated with, endorsed by or certified by any standards body named here.
Licences: CC BY 4.0 for standards text, registries, schemas and data; Apache-2.0 for reference code. External standards are cited by name, number and link under their own licences. Third-party data, libraries and fonts keep their own licences: see Third-party notices.