Compliance
Mapped to the decisions, not to a spreadsheet
43 controls across seven frameworks, computed from what actually ran.
The problem
Compliance for AI systems is usually a document describing controls somebody believes are in place. The gap between that document and the running system is invisible until an incident, and then it is the only thing anyone reads.
Seven frameworks, 43 controls
One control set mapped across all of them, so a control evidenced once is not re-evidenced by hand for the next framework.
High-risk obligations, including Art. 12 logging and Art. 14 oversight
The AI management system standard
Govern, map, measure, manage
The trust services criteria an auditor already knows
The attack catalogue for language models
Threats specific to agents that act
Adversary tactics against ML systems
- 01
Seven frameworks, one control set
EU AI Act, ISO 42001, NIST AI RMF, SOC 2, OWASP LLM Top 10, OWASP Agentic and MITRE ATLAS. 43 controls, each mapped to the others, so a control satisfied for one framework is not re-evidenced by hand for the next.
- 02
Status computed, not asserted
A control’s standing comes from telemetry — did the rule exist, did it fire, was the detector degraded, is the chain intact. Nobody ticks a box, which also means nobody can tick a box.
agentfox compliance status - 03
A pack for high-risk systems
The EU AI Act pack is policy, not prose: human oversight under Article 14, logging under Article 12 and the rest expressed as rules that fire on real traffic and land in the same record as everything else.
- 04
Export it and let someone else check
Compliance output is an evidence package like any other — verifiable with a script that does not import our code. A framework mapping nobody can check independently is a mapping nobody should accept.
agentfox evidence export
What this is not
It is not a certification, and nothing here has been reviewed by an auditor, a notified body or a regulator. A mapping is our reading of a framework, and a reading can be wrong. Treat it as a head start on the evidence an assessor will ask for, not as the assessment.
Try to break it before you trust it
No account, no install, and the same enforcement code as the product.
pip install agentfox agentfox init && agentfox demo
Offline: no API key, no downloaded weights, no network egress.