Compliance · Evidence Matrix
Every regulatory obligation maps to a runtime control with exportable evidence. No bolt-on audit tooling, no quarterly scramble — the platform produces the artifact at the moment of execution.
Regulatory Surface
Five frameworks gate enterprise AI deployment in 2026. Each one is mapped to how we work. A control map, not an assessment.
Mapped · not certified or audited
Scope
Agentic application security baseline — 10 risk categories for autonomous systems.
Control
ASI01–ASI10 mitigations mapped to runtime practices
Evidence in Git history
Per-risk product feature mapping (see below)
Mapped · not certified or audited
Scope
High-risk AI system obligations: logging, human oversight, transparency.
Control
Art. 12 — automated event logging across the agent lifecycle
Evidence in Git history
Git history: one reviewed pull request per change, with who merged it
Control
Art. 14 — effective human oversight and shutdown
Evidence in Git history
Agents open draft pull requests. A person approves every merge. Rollback by reverting the merge.
Control
Art. 13 — instructions for use and transparency
Evidence in Git history
Per-workflow model card + tool inventory generated at deploy time
ISO 42001 · Mapped · not certified or audited
Scope
AI management system — governance, risk, lifecycle, supplier obligations.
Control
Change management with versioned policies
Evidence in Git history
Git-backed policy plane, every change reviewable and reversible
Control
Third-party model and tool registry
Evidence in Git history
Vendor inventory with provenance and version pinning
SOC 2 · Mapped · not certified or audited
Scope
Trust services criteria — security, availability, confidentiality.
Control
Change management and segregation of duties
Evidence in Git history
Git history: one reviewed pull request per change. Agents open draft pull requests. A person approves every merge.
Mapped · not certified or audited
Scope
Swiss financial services — operational risk and outsourcing of AI services.
Control
Outsourcing oversight and exit plan
Evidence in Git history
Code and specs stay in your own repositories + documented exit procedures
Mapped · not certified or audited
Scope
Automated individual decisions — transparency, contestation, human review.
Control
Notification of automated decisions to data subjects
Evidence in Git history
Templated notice generated per decision class
Control
Right to human review of automated outcomes
Evidence in Git history
Built-in review queue routed to designated reviewers
Control
Logic, scope, and consequences disclosed on request
Evidence in Git history
Per-decision rationale exportable in plain language
OWASP ASI 2026 — Full Mapping
Each row maps an ASI risk category to its mitigation strategy and the practice designed to address it. A control map, not an assessment.
Evidence Pack
There is no SOC 2 report, ISO certificate or evidence pack to share.
'/%3e%3cpath%20d='m0%200-119.7-83.92%2091.32-65.6%20128.91%2079.56z'%20fill='%231d6075'%20stroke='%231d6075'%20stroke-width='0.8'%20stroke-linejoin='round'%20transform='matrix(1.33333%200%200%20-1.33333%20588.6%20492.05)'/%3e%3cpath%20d='m0%200%20113.06-90.6L320.45%2054.67l.46%20143.88z'%20fill='%2318505f'%20stroke='%2318505f'%20stroke-width='0.8'%20stroke-linejoin='round'%20transform='matrix(1.33333%200%200%20-1.33333%20278.27%20483.16)'/%3e%3cpath%20d='m0%200%20.34%20159.15-225.4-137.58L-83.84-66.9Z'%20fill='%23216b83'%20stroke='%23216b83'%20stroke-width='0.8'%20stroke-linejoin='round'%20transform='matrix(1.33333%200%200%20-1.33333%20390.91%20251.7)'/%3e%3cpath%20d='m0%200%20.34%20159.15%20236.09-134.2L95.2-63.54Z'%20fill='%23123e4b'%20stroke='%23123e4b'%20stroke-width='0.8'%20stroke-linejoin='round'%20transform='matrix(1.33333%200%200%20-1.33333%20390.91%20251.7)'/%3e%3c/svg%3e){kind=small}