COMPLIANCE
Compliance as the output of your system
Controls map themselves as your AI runs, so the audit is already answered when it arrives.
8 frameworks
Pre-mapped controls
11 of 12
EU AI Act articles covered
1 click
Evidence pack export
WORM
Immutable, configurable retention
Frameworks
One integration. Every framework.
SOC 2 Type II
Full CC7 system operations coverage, with policy audit trail for CC6.1 and boundary enforcement for CC6.6.
EU AI Act
11 of 12 articles covered and evidenced automatically; Art. 9 delineated as customer-managed. Enforcement begins Aug 2, 2026.
GDPR
PII detection and redaction across 19 types, with Article 33 breach evidence ready on demand.
ISO 42001
Risk management, human oversight, and lifecycle documentation generated from your live audit trail.
NIST AI RMF
All four RMF functions mapped to running controls rather than a point-in-time questionnaire.
OWASP LLM Top 10
Prompt injection, insecure output handling, and sensitive-information disclosure evidenced at call time.
HIPAA
PHI detection on every prompt and response, with the same signed, tamper-evident trail.
CCPA
PII detection across all LLM calls, with data export and deletion workflows supported.
Continuous compliance
Not a sprint before the audit
01
Integrate once
Wrap your LLM client with the obsvr SDK. Zero call-site changes, under 5 minutes.
02
Controls run continuously
Policy enforcement, PII detection, and cryptographic signing run on every call, automatically.
03
Evidence generates itself
When your auditor asks, export a one-click ZIP with every control mapped and every proof included.
Evidence pack
One click, and the audit is already answered
Questions auditors actually ask
"Can you prove your logs haven't been tampered with?"
Yes. Every event is HMAC-SHA256 signed at capture, daily Merkle roots are anchored to S3 Object Lock and a GitHub repo, and verify_merkle.py lets auditors confirm independently.
"Show me your control mapping to SOC 2 CC7."
controls-mapping.json maps every control to CC7.1-CC7.5, CC6.1, and CC6.6, with evidence pointers linking each control to the log entries that prove it.
"What happened during your last incident and how long did it take to resolve?"
incident-response.md contains the full timeline - detection time, containment steps, root cause, MTTR, and notified parties. Ready to hand over as-is.
"How do you demonstrate EU AI Act Article 18 documentation requirements?"
controls-mapping.json addresses all 12 articles - 11 covered, Art. 9 explicitly delineated as customer-managed - with immutable log retention configurable beyond the Act's minimum 6 months.
EU AI Act coverage
11 of 12 articles. Nothing overclaimed.
11 Articles Covered
Art. 9 delineated as customer-managed - the mapping in the evidence pack says exactly which is which.
Ready for Aug 2, 2026
Ready| Article | Requirement | obsvr Coverage | Status |
|---|---|---|---|
| Art. 5 | Prohibited AI Practices | Policy engine blocks prohibited use cases at call-time | ✓ Covered |
| Art. 9 | Risk Management System | Customer-managed governance - obsvr supplies the running controls and signed evidence that feed it | Customer-managed |
| Art. 12 | Record-Keeping & Logging | Immutable HMAC-signed log of all LLM calls and agent runs | ✓ Covered |
| Art. 14 | Human Oversight Controls | Escalation hooks + policy-triggered human-in-loop steps | ✓ Covered |
| Art. 17 | Quality Management System | Policy controls with evidence export for QMS documentation | ✓ Covered |
| Art. 18 | Documentation Keeping | Auto-generated evidence packets with hash manifests retained for 10-year audit window | ✓ Covered |
| Art. 19 | Automatically Generated Logs | Immutable, automatically captured logs retained for the required minimum period | ✓ Covered |
| Art. 20 | Post-Market Monitoring | Continuous event monitoring + automated incident detection | ✓ Covered |
| Art. 26 | Deployer Obligations | Deployer-scoped policy controls + full audit trail | ✓ Covered |
| Art. 72 | Incident Reporting | Automated classification, detection, and alert generation | ✓ Covered |
| Art. 73 | Serious Incident Reporting | Escalation hooks + detailed incident documentation | ✓ Covered |
| Art. 86 | Right to Explanation | Full cryptographic audit log of every AI decision | ✓ Covered |