Compliance
The frameworks your AI operation answers to. The evidence the substrate produces.
The substrate produces the attributable, tamper-evident record of what your agents actually did, under whose policy, kept inside your boundary. This is not a certification claim. It is the evidence the governance each framework expects assumes you can produce.
2026 interagency model-risk guidance that supersedes SR 11-7 and scopes agentic AI out of its model-risk scope.
Read the SR 26-2 page →
Mandatory cybersecurity standards for the Bulk Electric System.
Read the NERC CIP page →
The AI Risk Management Framework and its Generative AI Profile ask for governed, mapped, measured, and managed AI.
Read the NIST AI RMF 1.0 page →
Regulation (EU) 2024/1689 sets record-keeping (Art 12) and transparency (Art 13) obligations for high-risk AI.
Read the EU AI Act page →
ISO/IEC 42001:2023, the AI management-system standard. Certification attests that you govern AI; a surveillance audit still asks whether the controls operated. We are not a certification.
Read the ISO 42001 page →
Regulation (EU) 2022/2554 mandates ICT event logging, incident-trace retention, and regulator reporting for financial entities. The AI-decision-record home is the EU AI Act, not DORA.
Read the DORA page →
This material is informational, not legal or regulatory advice. The substrate produces the record; assess your specific obligations with qualified counsel.
Regulatory mapping reviewed: September 2026