Compliance frameworks, one page each
One page for each framework the AiSSAY engine ships a requirement table for. Each page is generated from that table: the requirement, the mechanism, duty or gap the engine records against it, and its type. The same tables build the evidence packs and the coverage PDF, so the three cannot say different things.
Informational mapping prepared by the operator's own tooling. Not a legal opinion, not a certification, and not a substitute for advice of counsel. It organizes the operator's records against the cited requirements; whether those records satisfy the requirements is a determination for the operator, counsel, and the examiner.
Financial services
For broker-dealers, trading desks, banks and model-risk functions: records that cannot be altered after the fact, supervision evidenced in writing, and model documentation an independent reviewer can challenge.
- SEC Rule 17a-4 — books and records (electronic storage posture)
- FINRA rules applied to generative AI and AI agents — broker-dealers
- US bank model risk guidance — SR 26-2, which superseded SR 11-7 on 17 April 2026 — model risk evidence
Law
For firms whose lawyers use AI on client work: the Model Rules as ABA Formal Opinion 512 applies them, and the client file.
Accounting and audit
For audit firms: documentation that shows who did the work and who reviewed it, kept for the required period and never silently changed after completion.
Healthcare
For covered entities and business associates: the HIPAA Security Rule's technical safeguards over systems that hold ePHI.
Education
For schools and the providers they engage: FERPA's conditions on school officials and its record of disclosures.
EU-regulated and high-risk AI
Articles 12 and 14 place their duties mainly on the provider of a high-risk AI system: logging capability built in, oversight measures built in. Deployers carry their own duties under Article 26 — keeping the logs the system produces, assigning competent oversight. These tables map what the records evidence for whichever role holds the duty.
- EU AI Act Article 12 — record-keeping for high-risk AI systems
- EU AI Act Article 14 — human oversight of high-risk AI systems
Security and audit
For SOC 2 and ISO/IEC 27001 programs: integrity, access accountability, key custody and dependency hygiene, with the organizational clauses named as organizational.
- SOC 2 Trust Services — Security (Common Criteria) readiness view
- ISO/IEC 27001:2022 Annex A — control readiness view
AI governance
For AI risk and management-system programs: mapping AiSSAY's records onto NIST AI RMF and ISO/IEC 42001, where an evidence store speaks and where only management can.