# Crosswalk

- **Event:** [Built with Opus 4.7: a Claude Code hackathon](https://cerebralvalley.ai/e/built-with-4-7-hackathon)
- **When:** Apr 21 at 12:00 PM – Apr 27 at 2:00 AM (EDT)
- **Where:** Online
- **Team:** [Madina Gbotoe](https://cerebralvalley.ai/u/Zhalianna)
- **GitHub:** https://github.com/mgbotoe/Crosswalk
- **Demo video:** https://www.youtube.com/watch?v=UamV_92DOY0
- **Gallery:** https://cerebralvalley.ai/e/built-with-4-7-hackathon/hackathon/gallery
- **Page:** https://cerebralvalley.ai/e/built-with-4-7-hackathon/hackathon/gallery/89

Crosswalk reads your AI governance policy and validates it against EU AI Act, NIST AI RMF, FDA AI/ML SaMD, and ISO 42001 in one pass. You get drop-in policy language for every gap, not a remediation roadmap.

The pipeline is a 3-step prompt chain. Sonnet 4.6 extracts every concrete commitment from the policy as structured data. Opus 4.7 maps each commitment to framework requirements with verbatim evidence citations — every covered finding cites a specific commitment ID and a substring of that commitment's evidence quote, so you can audit Crosswalk's reasoning by hovering, not by trusting. Opus 4.7 then drafts remediation language matched to the policy's voice — preserving modal verbs, structure, and register. Microsoft RAI gets dense legalistic prose with numbered RS4.X structure. A flatter corporate policy gets institutional voice. I empirically verified by running the same Article 55 gap through both and comparing.

Two features I'm proud of:

Industry-aware applicability gate. Tell Crosswalk your industry and role, and it marks structurally out-of-scope requirements as not-applicable. Run a tech company through FDA SaMD and clinical-device requirements get skipped with a written rationale per item, not surfaced as false-positive gaps. The skipped section is the difference between a tool and a checklist.

Tier C cross-framework merging. Equivalent requirements across regulators (e.g., EU Article 9 risk management ≡ ISO 42001 Clause 6.1) collapse into single proposals via union-find clustering, so accepting one fix counts toward both regulators' coverage. Soft-conflict detection (Jaccard similarity on token sets) flags when regulators want different things on the same topic.

Word .docx export ships with a cover page, framework citations, severity badges, change-list table, and full audit trail. Per-step prompt caching keyed on policy_hash + framework_id makes re-runs near-instant and deterministic. Schema robustness via permissive parse + post-hoc hydration handles model drift without failing.

---

Markdown version of https://cerebralvalley.ai/e/built-with-4-7-hackathon/hackathon/gallery/89. Site index for agents: https://cerebralvalley.ai/llms.txt · full text: https://cerebralvalley.ai/llms-full.txt