Bridges, not merges
A crosswalk says this provision over here bears on that provision over there. There are two ways to build one, they look similar on a slide, and they fail completely differently. This page argues for the one that fails visibly.
FrameworkReference, the bridge node type, is specified and never instantiated. This page is a design, and the shipped page says so too.Two ways to relate two instruments
| A merge | A bridge | |
|---|---|---|
| What it asserts | These two provisions mean the same thing | These two provisions stand in a stated relationship, on a stated basis |
| Where it lives | Inside a merged node | As an edge, with its own properties |
| Can a reader disagree with it? | Not usefully — the disagreement has nowhere to attach | Yes — the basis is written down and can be argued with |
| What happens when one is amended | A silently wrong node. The merged meaning is now false and nothing indicates it | A wrong edge you can find — the content hash moved under a bridge attached to the positional hash |
| Failure mode | Invisible | Visible and locatable |
A merge that is wrong is a silently wrong node. A bridge that is wrong is a wrong edge you can find and fix.
And two instruments almost never mean the same thing. GDPR Article 32 requires security appropriate to the risk; ISO/IEC 27002 describes an encryption control. Those are related. They are not the same statement, they do not have the same addressee, and one does not discharge the other. A merge asserts an equivalence that is not there; a bridge records the relationship that is.
Why bridges survive amendment
This is where the two-hash scheme stops being a storage detail and becomes the enabling decision.
A bridge attaches to the positional hash — the identity of the slot. When an instrument is amended, the wording moves and the content hash changes; the slot holds, and so does every mapping into it. Attach a crosswalk to text and you have a spreadsheet that rots. Attach it to a position and you have an artefact that survives revision and can report that the text underneath it moved.
bridge --attached-to--> positional hash (stable) | content hash (moves on amendment) | => the bridge is FLAGGED, not broken
That last line is the product. A mapping that knows it may be stale is worth having; a mapping that cannot tell is worse than none, because it looks current.
Every bridge carries a basis and a strength
A crosswalk that can only say yes is either wrong or useless. The project's own phrase for what is needed is “shades of compliance” — and there is no scale behind it yet. That is an open question, published as one, and it blocks the crosswalk browser.
The shape a bridge must carry, whatever the scale turns out to be:
| Field | Why it is mandatory |
|---|---|
from / to | Positional hashes, both ends. Never labels |
relation | From the published grammar — and if no established edge fits, an argument for the new one |
basis | Prose. Why somebody drew this edge. A bridge with no basis cannot be argued with, which makes it a merge wearing an edge's clothes |
strength | How much of the target this actually discharges. Undefined — Q4 |
asserted_by / asserted_at | A crosswalk is an opinion. Opinions have authors and dates |
source_content_hash | The content hash at each end when the bridge was drawn. This is what makes staleness computable rather than assumed |
The compounding argument
the AI standard already links to another of the standards, another acts that you need to be able to access as a graph… Map a second instrument and the edge resolves; map a third and two more resolve. So each mapping increases the value of the ones already done.
Concretely: the EU AI Act refers out to GDPR, to NIS2, to harmonised standards, to conformity assessment bodies and to notified bodies. Every one of those references is currently a node pointing at nothing. Model GDPR and a whole class of them resolves — and the AI Act graph gets better without anybody touching it.
The same conclusion was reached independently, years earlier, by somebody else, which is worth stating on a page arguing for a method:
A single graph can include nodes from GDPR, PCI DSS, ISO 27001, OWASP ASVS, etc. If two standards address the same concept (say “access control”), the graph can link them to a common concept node. The University of Maryland's researchers who built an integrated GDPR + PCI DSS ontology did exactly this.
What must be true before a crosswalk browser ships
- One crosswalk exists. Any pair. AI Act ↔ GDPR is the natural first — the two apply concurrently, so the relationship is real rather than academic.
FrameworkReferenceis instantiated. Specified since July, built never.- A basis and a strength on every bridge — which needs the scale that does not exist. Q4.
- The contract version is stamped in each instrument's
MANIFEST.json, so a tool can refuse a shape it does not speak. - The citation scheme is decided, because every bridge is a pair of citations. Done — the scheme is on the next page.
Five preconditions, one met. The crosswalk browser is T1 and it is the thing a multi-standard site sells; it is also the one tool that cannot be faked, because with zero bridges it renders an empty screen.