| Framework | The question it answers | What it does not ask |
|---|---|---|
| Deploy, Reshape, Invent — BCG | How ambitious should each initiative be? | Anything about the supplier |
| 10-20-70 — BCG | Where the effort goes: 10% algorithms, 20% technology and data, 70% people and process | Anything about the supplier |
| AI Opportunity Radar — Gartner | Which use cases, internal against customer-facing, everyday against game-changing? | Anything about the supplier |
| AI-era Operating Model — Bain | How must the organization be restructured? | Anything about the supplier |
| Six Dimensions of Value Capture — McKinsey | Which internal capabilities must move together? | Anything about the supplier |
| Govern, Map, Measure, Manage — NIST AI RMF 1.0 | What risk does the system pose, and who is accountable? | What rights the buyer holds against the vendor |
The omission they share
Five are consultancy publications, shaped legitimately to describe a problem whose resolution is an engagement; the sixth is a US federal standard. All six point inward. None poses the four questions that decide whether an AI amendment to an existing agreement is survivable. Who holds title to the artifacts derived from the buyer's data — embeddings, fine-tunes, extracted structure? Can the buyer extract everything, complete and timestamped, without the vendor's help? What does leaving cost, in money and in days? In which jurisdiction does inference run, and who can compel access there? NIST comes closest and still stops short: it governs the risk the system poses to and by the deploying organization, and is near-silent on the buyer's position across the table from the supplier — exactly where an incumbent renewal is won or lost, because the data is already resident, the switching cost is already sunk, and only the derived artifacts are new.
Where EgD-GCF-001 sits
The Global Compliance Framework Assessment does not compete with the six; it occupies the empty space. Eight sovereignty control domains scored 2 for evidenced, 1 for asserted, 0 for absent, a jurisdictional register anchored to the EU AI Act, the EU Data Act, GDPR and DORA, four veto conditions, and a sixteen-point sheet that yields a number before signature rather than a judgment after it. Domain SD-5, inference jurisdiction, is addressed by none of the six. Lead with the NIST pairing, because it is a standard rather than a sales asset: its Map function asks that context be established and risk prioritized, which is what a sovereignty scoring sheet is, and its Govern function asks for policy and accountability, which is what the four veto conditions are. A client committed to the AI RMF adopts this underneath it without abandoning anything.
You have the adoption side, and NIST gives you the risk side. Neither one scores the counterparty. This does, and it produces a number before you sign.
Sources — BCG, The Leader's Guide to Transforming with AI and the 10-20-70 ratio · Gartner, AI Opportunity Radar · NIST, AI RMF 1.0, NIST AI 100-1 and the AI RMF Core · EVEglyphDesign, EgD-GCF-001