AI CORE / DOCUMENTATION

Each framework has its own role

AI CORE uses selected international sources. Its profiles remain separate AISYSTEMS specifications, not official releases of those organizations.

OWASP ASVS and AISVS

ASVS provides verifiable application security requirements. AISVS adds AI system areas such as tools, orchestration and MCP. The control catalog identifies specific releases and requirement identifiers; a selection does not replace assessment against every item of a standard. OWASP Agentic Top 10 is a supplementary risk taxonomy, not a complete test plan by itself.

NIST AI RMF

The framework supports risk management through GOVERN, MAP, MEASURE and MANAGE. It helps justify scope, roles, measurement and response to findings. It is neither automatic certification nor a substitute for legal assessment.

NIST OSCAL

OSCAL distinguishes control catalogs, profiles, implementation descriptions, assessment plans, results and remediation. AI CORE uses this distinction as conceptual support. Its JSON files are not claimed to be valid OSCAL documents. A future conversion must select a specific OSCAL model and version, map fields and validate the result against that schema.

W3C PROV-O

PROV-O describes entities, activities, agents and provenance relationships. Evidence can conceptually correspond to an entity, control execution to an activity and its originator to an agent. This explanation is not a formal OWL mapping or a claim that AI CORE ontology 2.0 imports PROV-O.

European AI Act

Legal obligations depend on a system's purpose, the entity's role, risk classification and applicable provisions. Technical auditability can support evidence gathering, but using a profile does not establish legal compliance or replace required assessments. Specific applicability needs separate assessment under current law.

Accurate attribution

AI CORE control texts are independently formulated. Source links preserve attribution and imply no partnership, endorsement or accreditation. Read mappings alongside their stated relationship type and limitations. The distinction between a direct requirement and conceptual support must not be omitted.

Exact source list and selected releases