---
title: "Framework comparison"
manual: "LLM Foundation"
version: "main"
permalink: "https://docs.typo3.org/permalink/netresearch/nr-llm:responsible-ai-framework-mapping@main"
source: "ResponsibleAi/FrameworkMapping.rst"
rendered: "2026-11-12T15:41:35+00:00"
---

# Framework comparison {#responsible-ai-framework-mapping}

This is a scoped comparison, not a certification or a legal assessment of
an installation. The technical capabilities and their limitations are in
[Capabilities and boundaries](https://docs.typo3.org/permalink/netresearch/nr-llm:responsible-ai-current-state@main); follow-up work is in
[Gaps, owners and acceptance](https://docs.typo3.org/permalink/netresearch/nr-llm:responsible-ai-gaps@main). A control can support several objectives without
proving that any framework is fulfilled.

Sources were checked on **7 November 2026**. The mappings below are this
project's interpretation. Recheck the sources and the deployed system when
using them for a customer, procurement exercise or public claim.

Evidence classes in the tables identify the **available entry point**:
**S** means source/document inspection only; **T** points to the behavior-test
contract and evidence in the owning ADR; **O** means deployment evidence is
still open. T does not claim that the entire external requirement has passed;
consult the ADR and the validation record for the tested revision. No row
claims a verified deployment. Owners are roles to assign to actual teams.

## Digital Public Goods Standard {#responsible-ai-framework-dpg}

The [DPG Standard](https://www.digitalpublicgoods.net/standard) has nine
indicators, with 9A--9C covering different harms. Its review concerns the
core solution, not individual installations. The following evidence prompts
apply to nr-llm's own scope:

| Indicator | Control or inspection reference | Evidence class, owner and remaining work |
| --- | --- | --- |
| 1.  SDG relevance | [Application assessment](https://docs.typo3.org/permalink/netresearch/nr-llm:responsible-ai-rai05@main) | **S/O; project and adopters.** Demonstrate public-benefit outcomes; openness alone is insufficient. |
| 1.  Open licensing | `LICENSE`; [licence boundary](https://docs.typo3.org/permalink/netresearch/nr-llm:responsible-ai-freedom@main) | **S/O; maintainers and operator.** Review dependencies and the separate model, dataset and service terms. |
| 1.  Clear ownership | [Responsibility register](https://docs.typo3.org/permalink/netresearch/nr-llm:responsible-ai-owners@main) | **S/O; project and application owner.** Name accountable people and reporting channels for the deployment. |
| 1.  Platform independence | [Provider abstraction](https://docs.typo3.org/permalink/netresearch/nr-llm:adr-001@main); [portability inventory](https://docs.typo3.org/permalink/netresearch/nr-llm:responsible-ai-portability@main) | **S/O; integrator.** Test substitution and enumerate proprietary dependencies under [RAI-09](https://docs.typo3.org/permalink/netresearch/nr-llm:responsible-ai-rai09@main). |
| 1.  Documentation | [Capability inventory](https://docs.typo3.org/permalink/netresearch/nr-llm:responsible-ai-current-state@main); [evidence record](https://docs.typo3.org/permalink/netresearch/nr-llm:responsible-ai-evidence-record@main) | **S/O; maintainers and integrator.** Document the actual application, operating procedure and limitations. |
| 1.  Data extraction | `AnalyticsController::exportBillingAction()`; [inspected scope](https://docs.typo3.org/permalink/netresearch/nr-llm:responsible-ai-portability@main) | **S/O; integrator.** Qualify the non-PII round trip in [RAI-09](https://docs.typo3.org/permalink/netresearch/nr-llm:responsible-ai-rai09@main); billing CSV can contain PII. |
| 1.  Privacy and applicable laws | [Data-flow inventory](https://docs.typo3.org/permalink/netresearch/nr-llm:responsible-ai-egress@main); [locality evidence](https://docs.typo3.org/permalink/netresearch/nr-llm:responsible-ai-rai07@main) | **S/O; operator.** Assess purpose, actual recipients, contracts and applicable obligations. |
| 1.  Standards and best practices | [Provider interface design](https://docs.typo3.org/permalink/netresearch/nr-llm:adr-001@main); [claim-maintenance rule](https://docs.typo3.org/permalink/netresearch/nr-llm:adr-269@main) | **S/O; maintainers and integrator.** Link versioned checks and validate the deployed integration; no whole-standard pass is claimed. |
| 9A. Privacy and security | `RunStepPrivacyFilter`; [provider privacy](https://docs.typo3.org/permalink/netresearch/nr-llm:adr-270@main); [retention procedure](https://docs.typo3.org/permalink/netresearch/nr-llm:responsible-ai-retention-evidence@main) | **T/O; maintainers and operator.** Verify configured permissions, recipients and deletion across copies under RAI-01/03/06. |
| 9B. Inappropriate or illegal content | [Approval controls](https://docs.typo3.org/permalink/netresearch/nr-llm:adr-132@main); [application test matrix](https://docs.typo3.org/permalink/netresearch/nr-llm:responsible-ai-evaluation-matrix@main) | **S/O; application team.** Implement suitable moderation and incident handling; approval alone does not assess content legality. |
| 9C. Protection from harassment | `CODE_OF_CONDUCT.md`; [complaint ownership](https://docs.typo3.org/permalink/netresearch/nr-llm:responsible-ai-owners@main) | **S/O; community and application owners.** Test reporting and response procedures for application users as well as contributors. |

The [practical DPG guide](https://content.digitalpublicgoods.net/A_Practical_Guide_to_the_DPG_Standard_0249fee444.pdf)
clarifies the non-PII scope of indicator 6. This is not a reason to export
credentials or bypass access restrictions.

The [TYPO3 registry entry](https://www.digitalpublicgoods.net/r/typo3)
lists only the TYPO3 core repository as assessed. It explicitly excludes
unlisted repositories, add-ons and features. Its recognition therefore
does **not** establish recognition of nr-llm or a customer installation.

## ALTAI {#responsible-ai-framework-altai}

The European Commission's [ALTAI self-assessment](https://digital-strategy.ec.europa.eu/en/library/assessment-list-trustworthy-artificial-intelligence-altai-self-assessment)
organizes assessment into seven areas. Use the complete checklist for a
specific application; the following is a starting map, not its completion.

| Area | Control or inspection reference | Evidence class, owner and remaining work |
| --- | --- | --- |
| Human agency and oversight | [Permissions](https://docs.typo3.org/permalink/netresearch/nr-llm:administration-permissions@main); [approval boundary](https://docs.typo3.org/permalink/netresearch/nr-llm:adr-132@main) | **S/O; integrator and operator.** Reviewers can understand, refuse, correct and escalate actions; exercise the real workflow. |
| Technical robustness and safety | [Fallback privacy tests](https://docs.typo3.org/permalink/netresearch/nr-llm:adr-270@main); [egress qualification](https://docs.typo3.org/permalink/netresearch/nr-llm:responsible-ai-rai06@main) | **T/O; maintainers and operator.** Exercise deployed failure, shutdown and recovery procedures beyond the tested privacy scope. |
| Privacy and data governance | `PrivacyPolicy`; `PurgePrivacyDataCommand`; [RAI-03](https://docs.typo3.org/permalink/netresearch/nr-llm:responsible-ai-rai03@main) | **S/O; operator.** Verify actual recipients, lawful handling, schedules and deletion of all in-scope copies. |
| Transparency | `AfterAiRecordWrittenEvent`; [source checks](https://docs.typo3.org/permalink/netresearch/nr-llm:responsible-ai-rai04@main); [publication checks](https://docs.typo3.org/permalink/netresearch/nr-llm:responsible-ai-rai08@main) | **S/O; application and editorial teams.** Test actual notices, source support, uncertainty and user understanding. |
| Diversity, non-discrimination and fairness | `GoldenPromptSet`; [application evaluation](https://docs.typo3.org/permalink/netresearch/nr-llm:responsible-ai-rai05@main) | **S/O; application team and domain reviewers.** Test relevant groups, languages and accessibility with affected-person feedback. |
| Environmental and societal well-being | [Usage reporting](https://docs.typo3.org/permalink/netresearch/nr-llm:adr-231@main); [resource assessment](https://docs.typo3.org/permalink/netresearch/nr-llm:responsible-ai-evaluation-matrix@main) | **S/O; operator and application team.** Measure resource impact, benefits and harms against suitable alternatives. |
| Accountability | [Evidence ownership](https://docs.typo3.org/permalink/netresearch/nr-llm:adr-269@main); [assessment record](https://docs.typo3.org/permalink/netresearch/nr-llm:responsible-ai-evidence-record@main) | **S/O; project and deployment owners.** Name people, exercise complaint/incident handling, and review outcomes. |

A successful test of an approval mechanism does not demonstrate effective
human oversight. A benchmark score does not demonstrate fairness across
populations. Budget, token and cost records do not measure energy, water or
emissions.

## NIST AI RMF and Generative AI Profile {#responsible-ai-framework-nist}

This comparison uses **AI RMF 1.0** and **NIST AI 600-1, July 2024**.
The [NIST overview](https://www.nist.gov/itl/ai-risk-management-framework)
describes voluntary use and ongoing revision work. Pin the edition in an
assessment rather than silently adopting later changes.

The action IDs below come from the [Generative AI Profile](https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf). The evidence
column is this project's proposed application of a selected subset.

| Action | Action theme and evidence entry point | Evidence class, owner and remaining work |
| --- | --- | --- |
| GV-1.3-002 | Release thresholds; [evaluation report](https://docs.typo3.org/permalink/netresearch/nr-llm:responsible-ai-evaluation-report@main) | **S/O; application owner.** Record acceptance criteria and decision. |
| GV-1.3-007 | Stop deployment; [evaluation report](https://docs.typo3.org/permalink/netresearch/nr-llm:responsible-ai-evaluation-report@main) | **S/O; operator.** Exercise shutdown and assign its decision owner. |
| GV-1.5-001 | Review ownership; [claims rule](https://docs.typo3.org/permalink/netresearch/nr-llm:adr-269@main) | **S/O; project and operator.** Name provenance/incident reviewers. |
| GV-1.5-003 | Evidence retention; [RAI-03](https://docs.typo3.org/permalink/netresearch/nr-llm:responsible-ai-rai03@main) | **S/O; operator.** Apply a privacy-aware evaluation-retention policy. |
| GV-6.2-006 | Fallback risks; [provider-attempt privacy](https://docs.typo3.org/permalink/netresearch/nr-llm:adr-270@main) | **T/O; maintainers and operator.** Test the enabled fallback chain and actual recipients under [RAI-07](https://docs.typo3.org/permalink/netresearch/nr-llm:responsible-ai-rai07@main). |
| MP-1.1-001 | Intended purpose; [assessment record](https://docs.typo3.org/permalink/netresearch/nr-llm:responsible-ai-evidence-record@main) | **S/O; application team.** Describe purpose, data sources and limits. |
| MP-1.1-003 | Measurement plan; [RAI-05](https://docs.typo3.org/permalink/netresearch/nr-llm:responsible-ai-rai05@main) | **S/O; application team.** Run risk-linked cases and human review. |
| MS-2.3-002 | Capability validation; [benchmark identity](https://docs.typo3.org/permalink/netresearch/nr-llm:adr-271@main) | **T/O; maintainers and evaluators.** Validate application claims; identity tests alone do not establish model quality. |
| MS-2.5-001 | Limit claims; [evaluation limits](https://docs.typo3.org/permalink/netresearch/nr-llm:responsible-ai-rai05@main) | **S/O; evaluators.** Report sample limits and uncertainty. |
| MS-2.5-003 | Verify citations; [source procedure](https://docs.typo3.org/permalink/netresearch/nr-llm:responsible-ai-source-evidence@main) | **S/O; application team.** Test claim support and ongoing source drift. |
| MS-2.7-007 | Adversarial tests; [egress procedure](https://docs.typo3.org/permalink/netresearch/nr-llm:responsible-ai-egress@main) | **S/O; security and application teams.** Exercise injection/abuse scenarios across every enabled boundary. |
| MS-2.11-001 | Bias benchmarks; [test matrix](https://docs.typo3.org/permalink/netresearch/nr-llm:responsible-ai-evaluation-matrix@main) | **S/O; domain evaluators.** Run relevant cases and document limits. |
| MS-2.12-003 | Environmental impact; [resource limits](https://docs.typo3.org/permalink/netresearch/nr-llm:responsible-ai-controls@main) | **S/O; operator and provider.** Supply energy/water evidence and method. |
| MG-4.1-002 | Operational monitoring; [review procedure](https://docs.typo3.org/permalink/netresearch/nr-llm:responsible-ai-evaluation-report@main) | **S/O; operator.** Record quality/incident review after deployment. |

Benchmark revision and generator provenance are separate evidence.
Record evaluator versions, grader prompts/models, thresholds, settings and
sample sizes as well. A content fingerprint does not freeze an external
model or prove that the benchmark measures the intended outcome.

## EU transparency requirements {#responsible-ai-framework-transparency}

Legal duties are separate from voluntary ethical assessment. Evaluate the
actual system, role and use case against [Article 50](https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-50) and the
Commission's [scope guidelines](https://digital-strategy.ec.europa.eu/en/policies/guidelines-ai-transparency-obligations).

| Provision | Integration question |
| --- | --- |
| Article 50(1) | Does a person interacting directly with the system receive the required AI notice, considering the applicable exceptions? |
| Article 50(2) | Are relevant outputs marked in a machine-readable and detectable way? A private database flag alone does not demonstrate this. |
| Article 50(3) | If applicable, are people informed about emotion-recognition or biometric-categorisation systems? |
| Article 50(4) | Does publication require deepfake or public-interest-text disclosure? Assess the respective exceptions separately. |
| Article 50(5) | Is the information clear, distinguishable and accessible by the first interaction or exposure? |

Human review or editorial control, together with editorial responsibility,
is relevant to the text-publication exception in paragraph 4. It is not a
general exemption from every transparency duty.

Article 50 generally applies from **2 August 2026**. The
[consolidated AI Act, Article 111(4)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:02024R1689-20260727)
provides until **2 December 2026** for Article 50(2) compliance by providers
of the specified synthetic-content systems placed on the market before
2 August 2026. This transition does not postpone all of Article 50.

The [Code of Practice on Transparency of AI-generated Content](https://digital-strategy.ec.europa.eu/en/policies/code-practice-ai-generated-content)
was finalized on 10 June 2026. The Commission describes it as an adequate
voluntary compliance tool for its marking and labelling scope. It does not
replace the Act, constitute a general ethics certificate, or automatically
make users of nr-llm signatories. It is distinct from the GPAI model code.

## Additional references and software freedom {#responsible-ai-framework-other}

The [TYPO3 Open Web Manifesto](https://docs.typo3.org/m/typo3/guide-policy/main/en-us/Association/OpenWebManifesto.html)
provides a values basis for independence, participation and privacy.
Provider choice and non-AI access paths are practical application choices
to assess against those values.

The [UNESCO Ethical Impact Assessment](https://www.unesco.org/ethics-ai/en/eia) helps assess individual systems
before and during use, including engagement with affected stakeholders.
The [OECD AI Principles](https://www.oecd.org/en/topics/ai-principles.html)
provide a broader reference. Neither is a product badge supplied by this
comparison.

[ISO/IEC 42001:2023](https://www.iso.org/standard/42001) addresses an
organization's AI management system. nr-llm controls can contribute
evidence; they cannot establish organizational certification.

The GPL licence remains unchanged. Development commitments, recommended
practices and supported-use boundaries add no licence restrictions. The
[Open Source Definition](https://opensource.org/osd), notably sections
3, 5 and 6, protects modification and rejects discrimination by person,
group or field of use. An unevaluated use is not thereby prohibited under
the software licence, and a runtime safeguard is not a prohibition on
changing the software.