Compliance
We turn adversarial testing into readiness evidence, matched to the frameworks you answer to. And we’re honest about the line between what we measured and what’s yours to attest.
We never assert that your AI is legally compliant. No tool honestly can. What we produce is readiness: for each requirement of a framework, the evidence we have and the gaps that remain.
That distinction is the point. A vendor that hands you a compliance percentage is averaging what it measured with what it didn’t. Readiness keeps the two apart, so what you take to an auditor holds up.
The readiness rollup for a framework is a count of these states, never a single percentage.
Technical or administrative evidence satisfies the requirement.
An administrative artifact was expected and isn't there yet. We surface it; you attest it once.
The test couldn't reach it this run, a dimension under its detection floor or one you didn't run. We say so instead of guessing.
A purely organizational duty the platform neither measures nor attests for you. We mark it as your responsibility.
From adversarial testing: registered, hash-citable traces and calibrated findings across the eight dimensions.
Your attestations, collected once through a human gate before testing starts. Each administrative question is asked once and reused across every framework.
Some obligations are purely organizational. We don't pretend to measure or attest them for you, and we say which ones they are.
Frameworks
A framework is a declarative crosswalk: a list of requirements, each mapped to technical evidence, an administrative question, or both. Adding one means writing its crosswalk, not rebuilding the engine.
Where our technical differential is strongest. Article 15 asks for measured resilience, so most of it is answered with evidence, not a questionnaire.
A management-system standard: much of it is attestable rather than technically verifiable. We mark which requirements we can measure and which you attest.
Mapping findings to frameworks is table stakes; everyone does it. The difference is the evidence underneath, and a trail that ties every readiness state back to the finding behind it.
Readiness, not verdicts · ISO 42001 + EU AI Act · 8 Dimensions · Immutable Audit Trail