verifiedShipped and covered by tests in the public repository.
partly verifiedShipped, but only part of it is tested, or it has been exercised only against test infrastructure.
disabled by defaultShipped and tested, but switched off until an operator turns it on.

Capabilities in rows, frameworks in columns. A solid chip is a direct reference to the framework’s official text; an outlined chip is a supporting reference; a dot means no direct mapping identified; a deeper tint means more references. Select a chip or a capability for details.
Capability	AI Act	GDPR	DORA	NIS2	CRA	CoE AI	RMF	OECD	SOC 2	42001	27001

verifiedConsent artifact	EU AI Act: no direct mapping identified						NIST AI RMF: 2 references `GOVERN 1.4`The risk management process and its outcomes are established through transparent policies, procedures, and other controls based on organizational risk priorities.Official text `MAP 1.6`System requirements (e.g., “the system shall respect the privacy of its users”) are elicited from and understood by relevant AI actors. Design decisions take socio-technical implications into account to address AI risks.Official text			ISO/IEC 42001: 4 references `A.9.4`Use within intended purposeISO catalogue page `A.9.2`Responsible-use processesISO catalogue page `A.6.2.6`Operation and monitoringISO catalogue page `Clause 8.1`Operational planning and controlISO catalogue page	ISO/IEC 27001: 4 references `A.5.15`Access controlISO catalogue page `A.8.3`Access restrictionISO catalogue page `A.5.18`Access rightsISO catalogue page `A.8.5`Secure authenticationISO catalogue page
verifiedConsent artifact						CoE AI Convention: no direct mapping identified					ISO/IEC 27001: 3 references `A.8.5`Secure authenticationISO catalogue page `A.5.15`Access controlISO catalogue page `A.8.24`Cryptography useISO catalogue page
verifiedReceipt		GDPR: no direct mapping identified	DORA: no direct mapping identified	NIS2: no direct mapping identified				OECD AI Principles: 2 references `Principle 1.3`Transparency and explainabilityOfficial text `Principle 1.5`AccountabilityOfficial text
verifiedReceipt					EU Cyber Resilience Act: no direct mapping identified	CoE AI Convention: no direct mapping identified				ISO/IEC 42001: 3 references `A.9.2`Responsible-use processesISO catalogue page `A.9.4`Use within intended purposeISO catalogue page `A.6.2.6`Operation and monitoringISO catalogue page	ISO/IEC 27001: 3 references `A.5.18`Access rightsISO catalogue page `A.8.3`Access restrictionISO catalogue page `A.5.26`Incident responseISO catalogue page
verifiedReceipt				NIS2: 2 references `Art. 21(2)(i)`human resources security, access control policies and asset management;Official text `Art. 21(2)(j)`the use of multi-factor authentication or continuous authentication solutions, secured voice, video and text communications and secured emergency communication systems within the entity, where appropriate.Official text			NIST AI RMF: 2 references `MAP 3.5`Processes for human oversight are defined, assessed, and documented in accordance with organizational policies from GOVERN function.Official text `GOVERN 3.2`Policies and procedures are in place to define and differentiate roles and responsibilities for human-AI configurations and oversight of AI systems.Official text	OECD AI Principles: 2 references `Principle 1.2`Respect for the rule of law, human rights and democratic values, including fairness and privacyOfficial text `Principle 1.5`AccountabilityOfficial text		ISO/IEC 42001: 3 references `A.9.2`Responsible-use processesISO catalogue page `A.9.4`Use within intended purposeISO catalogue page `A.3.2`AI roles and dutiesISO catalogue page	ISO/IEC 27001: 3 references `A.5.3`Duty segregationISO catalogue page `A.8.3`Access restrictionISO catalogue page `A.8.2`Privileged accessISO catalogue page
verifiedAudit export		GDPR: no direct mapping identified		NIS2: no direct mapping identified	EU Cyber Resilience Act: no direct mapping identified					ISO/IEC 42001: 4 references `A.2.4`AI policy reviewISO catalogue page `A.3.2`AI roles and dutiesISO catalogue page `Clause 7.5.3`Controlling recordsISO catalogue page `Clause 8.1`Operational planning and controlISO catalogue page	ISO/IEC 27001: 4 references `A.8.32`Change managementISO catalogue page `A.5.3`Duty segregationISO catalogue page `A.8.9`Configuration managementISO catalogue page `A.5.1`Security policiesISO catalogue page

verifiedINTENT entry	EU AI Act: 3 references `Art. 12`Record-keepingOfficial text `Art. 19`Automatically generated logsOfficial text `Art. 26`Obligations of deployers of high-risk AI systemsOfficial text				EU Cyber Resilience Act: 2 references `Annex I Part I, point (2)(l)`provide security related information by recording and monitoring relevant internal activity, including the access to or modification of data, services or functions, with an opt-out mechanism for the user;Official text `Annex I Part I, point (2)(f)`protect the integrity of stored, transmitted or otherwise processed data, personal or other, commands, programs and configuration against any manipulation or modification not authorised by the user, and report on corruptions;Official text	CoE AI Convention: 3 references `Art. 8`Transparency and oversightOfficial text `Art. 9`Accountability and responsibilityOfficial text `Art. 14`RemediesOfficial text	NIST AI RMF: 3 references `MEASURE 2.8`Risks associated with transparency and accountability – as identified in the MAP function – are examined and documented.Official text `MANAGE 4.1`Post-deployment AI system monitoring plans are implemented, including mechanisms for capturing and evaluating input from users and other relevant AI actors, appeal and override, decommissioning, incident response, recovery, and change management.Official text `GOVERN 1.4`The risk management process and its outcomes are established through transparent policies, procedures, and other controls based on organizational risk priorities.Official text	OECD AI Principles: 2 references `Principle 1.5`AccountabilityOfficial text `Principle 1.3`Transparency and explainabilityOfficial text		ISO/IEC 42001: 4 references `A.6.2.8`Event log recordingISO catalogue page `A.6.2.6`Operation and monitoringISO catalogue page `Clause 7.5.2`Creating and updating recordsISO catalogue page `Clause 7.5.3`Controlling recordsISO catalogue page	ISO/IEC 27001: 3 references `A.8.15`LoggingISO catalogue page `A.5.28`Evidence collectionISO catalogue page `A.5.33`Records protectionISO catalogue page
verifiedReceipt		GDPR: 2 references `Art. 5(2)`Principles relating to processing of personal data: accountabilityOfficial text `Art. 22(3)`Automated individual decision-making, including profilingOfficial text	DORA: no direct mapping identified	NIS2: no direct mapping identified					SOC 2: no direct mapping identified	ISO/IEC 42001: 2 references `A.6.2.8`Event log recordingISO catalogue page `Clause 7.5.3`Controlling recordsISO catalogue page	ISO/IEC 27001: 3 references `A.5.28`Evidence collectionISO catalogue page `A.8.15`LoggingISO catalogue page `A.5.33`Records protectionISO catalogue page
partly verifiedCheckpoint		GDPR: no direct mapping identified	DORA: no direct mapping identified	NIS2: no direct mapping identified					SOC 2: no direct mapping identified	ISO/IEC 42001: 2 references `A.6.2.8`Event log recordingISO catalogue page `Clause 7.5.3`Controlling recordsISO catalogue page	ISO/IEC 27001: 3 references `A.8.15`LoggingISO catalogue page `A.5.33`Records protectionISO catalogue page `A.5.28`Evidence collectionISO catalogue page
verifiedOffline verifier	EU AI Act: no direct mapping identified		DORA: no direct mapping identified		EU Cyber Resilience Act: no direct mapping identified		NIST AI RMF: 2 references `MEASURE 1.3`Internal experts who did not serve as front-line developers for the system and/or independent assessors are involved in regular assessments and updates. Domain experts, users, AI actors external to the team that developed or deployed the AI system, and affected communities are consulted in support of assessments as necessary per organizational risk tolerance.Official text `MEASURE 2.8`Risks associated with transparency and accountability – as identified in the MAP function – are examined and documented.Official text	OECD AI Principles: 2 references `Principle 1.3`Transparency and explainabilityOfficial text `Principle 1.5`AccountabilityOfficial text	SOC 2: no direct mapping identified	ISO/IEC 42001: 2 references `Clause 9.1`Monitoring and measurementISO catalogue page `Clause 9.2.1`Internal audit, generalISO catalogue page	ISO/IEC 27001: 5 references `A.5.35`Independent reviewISO catalogue page `A.5.36`Policy compliance reviewISO catalogue page `A.5.28`Evidence collectionISO catalogue page `Clause 9.1`Monitoring and measurementISO catalogue page `Clause 9.2.1`Internal audit, generalISO catalogue page

partly verifiedReceipt	EU AI Act: no direct mapping identified		DORA: no direct mapping identified	NIS2: no direct mapping identified						ISO/IEC 42001: 3 references `A.6.2.6`Operation and monitoringISO catalogue page `A.9.2`Responsible-use processesISO catalogue page `A.9.4`Use within intended purposeISO catalogue page
verifiedReceipt		GDPR: no direct mapping identified	DORA: no direct mapping identified	NIS2: no direct mapping identified	EU Cyber Resilience Act: no direct mapping identified				SOC 2: no direct mapping identified		ISO/IEC 27001: no direct mapping identified
verifiedAudit export	EU AI Act: no direct mapping identified	GDPR: 6 references `Art. 15`Right of access by the data subjectOfficial text `Art. 16`Right to rectificationOfficial text `Art. 17`Right to erasure (‘right to be forgotten’)Official text `Art. 18`Right to restriction of processingOfficial text `Art. 20`Right to data portabilityOfficial text `Art. 12`Transparent information, communication and modalities for the exercise of the rights of the data subjectOfficial text	DORA: no direct mapping identified	NIS2: no direct mapping identified	EU Cyber Resilience Act: no direct mapping identified
verifiedAudit export			DORA: no direct mapping identified	NIS2: no direct mapping identified	EU Cyber Resilience Act: no direct mapping identified			OECD AI Principles: no direct mapping identified			ISO/IEC 27001: 3 references `A.5.33`Records protectionISO catalogue page `A.8.10`Information deletionISO catalogue page `A.5.31`Legal and contractual requirementsISO catalogue page

verifiedAudit export	EU AI Act: no direct mapping identified			NIS2: 2 references `Art. 21(2)(i)`human resources security, access control policies and asset management;Official text `Art. 21(2)(j)`the use of multi-factor authentication or continuous authentication solutions, secured voice, video and text communications and secured emergency communication systems within the entity, where appropriate.Official text		CoE AI Convention: no direct mapping identified			SOC 2: 3 references `CC6.1`The entity implements logical access security software, infrastructure, and architectures over protected information assets to protect them from security events to meet the entity's objectives.Official text `CC6.2`Prior to issuing system credentials and granting system access, the entity registers and authorizes new internal and external users whose access is administered by the entity. For those users whose access is administered by the entity, user system credentials are removed when user access is no longer authorized.Official text `CC6.3`The entity authorizes, modifies, or removes access to data, software, functions, and other protected information assets based on roles, responsibilities, or the system design and changes, giving consideration to the concepts of least privilege and segregation of duties, to meet the entity's objectives.Official text		ISO/IEC 27001: 4 references `A.5.15`Access controlISO catalogue page `A.5.18`Access rightsISO catalogue page `A.8.2`Privileged accessISO catalogue page `A.8.5`Secure authenticationISO catalogue page
partly verifiedAudit export	EU AI Act: no direct mapping identified						NIST AI RMF: 2 references `MEASURE 2.7`AI system security and resilience – as identified in the MAP function – are evaluated and documented.Official text `MEASURE 2.10`Privacy risk of the AI system – as identified in the MAP function – is examined and documented.Official text

partly verifiedCI result	EU AI Act: no direct mapping identified	GDPR: no direct mapping identified	DORA: no direct mapping identified	NIS2: no direct mapping identified	EU Cyber Resilience Act: no direct mapping identified						ISO/IEC 27001: no direct mapping identified
verifiedReceipt	EU AI Act: no direct mapping identified	GDPR: no direct mapping identified	DORA: no direct mapping identified	NIS2: no direct mapping identified	EU Cyber Resilience Act: no direct mapping identified		NIST AI RMF: 3 references `MEASURE 2.6`AI system is evaluated regularly for safety risks – as identified in the MAP function. The AI system to be deployed is demonstrated to be safe, its residual negative risk does not exceed the risk tolerance, and can fail safely, particularly if made to operate beyond its knowledge limits. Safety metrics implicate system reliability and robustness, real-time monitoring, and response times for AI system failures.Official text `MEASURE 2.7`AI system security and resilience – as identified in the MAP function – are evaluated and documented.Official text `MANAGE 1.3`Responses to the AI risks deemed high priority as identified by the Map function, are developed, planned, and documented. Risk response options can include mitigating, transferring, avoiding, or accepting.Official text			ISO/IEC 42001: 3 references `A.6.2.6`Operation and monitoringISO catalogue page `A.9.2`Responsible-use processesISO catalogue page `A.9.4`Use within intended purposeISO catalogue page
verifiedConfiguration check	EU AI Act: no direct mapping identified	GDPR: no direct mapping identified	DORA: no direct mapping identified	NIS2: no direct mapping identified	EU Cyber Resilience Act: no direct mapping identified				SOC 2: no direct mapping identified		ISO/IEC 27001: no direct mapping identified

verifiedReceipt	EU AI Act: no direct mapping identified	GDPR: 2 references `Art. 5(1)(c)`adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (‘data minimisation’);Official text `Art. 32(1)(a)`the pseudonymisation and encryption of personal data;Official text	DORA: no direct mapping identified	NIS2: no direct mapping identified	EU Cyber Resilience Act: 2 references `Annex I Part I, point (2)(e)`protect the confidentiality of stored, transmitted or otherwise processed data, personal or other, such as by encrypting relevant data at rest or in transit by state of the art mechanisms, and by using other technical means;Official text `Annex I Part I, point (2)(g)`process only data, personal or other, that are adequate, relevant and limited to what is necessary in relation to the intended purpose of the product with digital elements (data minimisation);Official text		NIST AI RMF: 2 references `MEASURE 2.10`Privacy risk of the AI system – as identified in the MAP function – is examined and documented.Official text `MANAGE 1.3`Responses to the AI risks deemed high priority as identified by the Map function, are developed, planned, and documented. Risk response options can include mitigating, transferring, avoiding, or accepting.Official text				ISO/IEC 27001: 4 references `A.8.12`Data leakage preventionISO catalogue page `A.8.11`Data maskingISO catalogue page `A.5.12`Information classificationISO catalogue page `A.5.34`Privacy and PII protectionISO catalogue page
verifiedReceipt	EU AI Act: no direct mapping identified	GDPR: no direct mapping identified	DORA: no direct mapping identified	NIS2: no direct mapping identified		CoE AI Convention: no direct mapping identified

verifiedReceipt	EU AI Act: no direct mapping identified	GDPR: no direct mapping identified	DORA: no direct mapping identified	NIS2: no direct mapping identified		CoE AI Convention: no direct mapping identified	NIST AI RMF: 2 references `MEASURE 2.7`AI system security and resilience – as identified in the MAP function – are evaluated and documented.Official text `MANAGE 1.3`Responses to the AI risks deemed high priority as identified by the Map function, are developed, planned, and documented. Risk response options can include mitigating, transferring, avoiding, or accepting.Official text			ISO/IEC 42001: 3 references `A.9.4`Use within intended purposeISO catalogue page `A.6.2.6`Operation and monitoringISO catalogue page `Clause 8.1`Operational planning and controlISO catalogue page
partly verifiedCI result	EU AI Act: no direct mapping identified	GDPR: no direct mapping identified			EU Cyber Resilience Act: no direct mapping identified	CoE AI Convention: no direct mapping identified	NIST AI RMF: 2 references `MAP 4.2`Internal risk controls for components of the AI system including third-party AI technologies are identified and documented.Official text `GOVERN 6.1`Policies and procedures are in place that address AI risks associated with third-party entities, including risks of infringement of a third party’s intellectual property or other rights.Official text	OECD AI Principles: no direct mapping identified
verifiedCI result				NIS2: no direct mapping identified						ISO/IEC 42001: 2 references `A.6.2.6`Operation and monitoringISO catalogue page `Clause 8.1`Operational planning and controlISO catalogue page
verifiedCI result				NIS2: no direct mapping identified	EU Cyber Resilience Act: no direct mapping identified	CoE AI Convention: no direct mapping identified	NIST AI RMF: 2 references `MEASURE 2.7`AI system security and resilience – as identified in the MAP function – are evaluated and documented.Official text `GOVERN 6.2`Contingency processes are in place to handle failures or incidents in third-party data or AI systems deemed to be high-risk.Official text
verifiedCI result	EU AI Act: no direct mapping identified	GDPR: no direct mapping identified	DORA: no direct mapping identified	NIS2: no direct mapping identified	EU Cyber Resilience Act: no direct mapping identified	CoE AI Convention: no direct mapping identified	NIST AI RMF: no direct mapping identified	OECD AI Principles: no direct mapping identified
verifiedCI result	EU AI Act: no direct mapping identified	GDPR: no direct mapping identified	DORA: no direct mapping identified	NIS2: no direct mapping identified	EU Cyber Resilience Act: no direct mapping identified	CoE AI Convention: no direct mapping identified	NIST AI RMF: no direct mapping identified	OECD AI Principles: no direct mapping identified		ISO/IEC 42001: no direct mapping identified	ISO/IEC 27001: no direct mapping identified
verifiedConfiguration check	EU AI Act: no direct mapping identified	GDPR: no direct mapping identified		NIS2: no direct mapping identified		CoE AI Convention: no direct mapping identified				ISO/IEC 42001: 2 references `A.6.2.6`Operation and monitoringISO catalogue page `Clause 8.1`Operational planning and controlISO catalogue page

verifiedAudit export	EU AI Act: no direct mapping identified	GDPR: no direct mapping identified	DORA: no direct mapping identified		EU Cyber Resilience Act: no direct mapping identified		NIST AI RMF: 2 references `GOVERN 1.6`Mechanisms are in place to inventory AI systems and are resourced according to organizational risk priorities.Official text `MAP 4.2`Internal risk controls for components of the AI system including third-party AI technologies are identified and documented.Official text
verifiedReceipt		GDPR: no direct mapping identified	DORA: no direct mapping identified				NIST AI RMF: 2 references `MANAGE 1.3`Responses to the AI risks deemed high priority as identified by the Map function, are developed, planned, and documented. Risk response options can include mitigating, transferring, avoiding, or accepting.Official text `MAP 3.5`Processes for human oversight are defined, assessed, and documented in accordance with organizational policies from GOVERN function.Official text	OECD AI Principles: 2 references `Principle 1.4`Robustness, security and safetyOfficial text `Principle 1.5`AccountabilityOfficial text			ISO/IEC 27001: 3 references `A.8.3`Access restrictionISO catalogue page `A.5.15`Access controlISO catalogue page `A.8.2`Privileged accessISO catalogue page
verifiedOffline verifier	EU AI Act: no direct mapping identified	GDPR: no direct mapping identified	DORA: no direct mapping identified		EU Cyber Resilience Act: no direct mapping identified
verifiedOffline verifier		GDPR: no direct mapping identified	DORA: no direct mapping identified	NIS2: no direct mapping identified	EU Cyber Resilience Act: no direct mapping identified		NIST AI RMF: 2 references `MEASURE 2.8`Risks associated with transparency and accountability – as identified in the MAP function – are examined and documented.Official text `MANAGE 4.1`Post-deployment AI system monitoring plans are implemented, including mechanisms for capturing and evaluating input from users and other relevant AI actors, appeal and override, decommissioning, incident response, recovery, and change management.Official text
partly verifiedReceipt	EU AI Act: no direct mapping identified	GDPR: no direct mapping identified	DORA: no direct mapping identified		EU Cyber Resilience Act: no direct mapping identified	CoE AI Convention: no direct mapping identified
partly verifiedReceipt	EU AI Act: no direct mapping identified	GDPR: no direct mapping identified	DORA: no direct mapping identified	NIS2: no direct mapping identified	EU Cyber Resilience Act: no direct mapping identified	CoE AI Convention: no direct mapping identified			SOC 2: no direct mapping identified		ISO/IEC 27001: no direct mapping identified

verifiedAudit export	EU AI Act: no direct mapping identified	GDPR: no direct mapping identified				CoE AI Convention: no direct mapping identified			SOC 2: 3 references `CC6.1`The entity implements logical access security software, infrastructure, and architectures over protected information assets to protect them from security events to meet the entity's objectives.Official text `CC6.2`Prior to issuing system credentials and granting system access, the entity registers and authorizes new internal and external users whose access is administered by the entity. For those users whose access is administered by the entity, user system credentials are removed when user access is no longer authorized.Official text `CC6.3`The entity authorizes, modifies, or removes access to data, software, functions, and other protected information assets based on roles, responsibilities, or the system design and changes, giving consideration to the concepts of least privilege and segregation of duties, to meet the entity's objectives.Official text	ISO/IEC 42001: no direct mapping identified	ISO/IEC 27001: 4 references `A.5.16`Identity managementISO catalogue page `A.5.17`Authentication informationISO catalogue page `A.5.18`Access rightsISO catalogue page `A.8.5`Secure authenticationISO catalogue page
partly verifiedConfiguration check	EU AI Act: no direct mapping identified	GDPR: no direct mapping identified	DORA: no direct mapping identified			CoE AI Convention: no direct mapping identified	NIST AI RMF: no direct mapping identified	OECD AI Principles: no direct mapping identified		ISO/IEC 42001: no direct mapping identified	ISO/IEC 27001: 3 references `A.8.5`Secure authenticationISO catalogue page `A.5.16`Identity managementISO catalogue page `A.5.17`Authentication informationISO catalogue page
verifiedConfiguration check	EU AI Act: no direct mapping identified	GDPR: no direct mapping identified	DORA: no direct mapping identified			CoE AI Convention: no direct mapping identified	NIST AI RMF: no direct mapping identified	OECD AI Principles: no direct mapping identified		ISO/IEC 42001: no direct mapping identified
verifiedAudit export	EU AI Act: no direct mapping identified										ISO/IEC 27001: 3 references `A.8.2`Privileged accessISO catalogue page `A.5.3`Duty segregationISO catalogue page `A.5.18`Access rightsISO catalogue page

verifiedOffline verifier	EU AI Act: no direct mapping identified					CoE AI Convention: no direct mapping identified				ISO/IEC 42001: no direct mapping identified
verifiedTest vector	EU AI Act: no direct mapping identified	GDPR: no direct mapping identified				CoE AI Convention: no direct mapping identified	NIST AI RMF: no direct mapping identified	OECD AI Principles: no direct mapping identified	SOC 2: no direct mapping identified	ISO/IEC 42001: no direct mapping identified
partly verifiedConfiguration check	EU AI Act: no direct mapping identified		DORA: no direct mapping identified		EU Cyber Resilience Act: no direct mapping identified	CoE AI Convention: no direct mapping identified		OECD AI Principles: no direct mapping identified		ISO/IEC 42001: no direct mapping identified
verifiedConfiguration check	EU AI Act: no direct mapping identified						NIST AI RMF: 2 references `MEASURE 2.7`AI system security and resilience – as identified in the MAP function – are evaluated and documented.Official text `MEASURE 2.10`Privacy risk of the AI system – as identified in the MAP function – is examined and documented.Official text			ISO/IEC 42001: no direct mapping identified
verifiedInclusion proof	EU AI Act: no direct mapping identified	GDPR: no direct mapping identified	DORA: no direct mapping identified	NIS2: no direct mapping identified					SOC 2: no direct mapping identified
verifiedAudit export	EU AI Act: no direct mapping identified			NIS2: no direct mapping identified		CoE AI Convention: no direct mapping identified	NIST AI RMF: 2 references `MANAGE 4.1`Post-deployment AI system monitoring plans are implemented, including mechanisms for capturing and evaluating input from users and other relevant AI actors, appeal and override, decommissioning, incident response, recovery, and change management.Official text `MEASURE 2.7`AI system security and resilience – as identified in the MAP function – are evaluated and documented.Official text				ISO/IEC 27001: 3 references `A.8.15`LoggingISO catalogue page `A.8.16`MonitoringISO catalogue page `A.5.33`Records protectionISO catalogue page
disabled by defaultCheckpoint	EU AI Act: no direct mapping identified	GDPR: no direct mapping identified	DORA: no direct mapping identified	NIS2: no direct mapping identified		CoE AI Convention: no direct mapping identified		OECD AI Principles: no direct mapping identified	SOC 2: no direct mapping identified

verifiedAudit export			DORA: no direct mapping identified	NIS2: no direct mapping identified	EU Cyber Resilience Act: no direct mapping identified		NIST AI RMF: no direct mapping identified	OECD AI Principles: no direct mapping identified			ISO/IEC 27001: 3 references `A.5.33`Records protectionISO catalogue page `A.5.31`Legal and contractual requirementsISO catalogue page `A.8.10`Information deletionISO catalogue page
verifiedAudit export	EU AI Act: no direct mapping identified		DORA: no direct mapping identified	NIS2: no direct mapping identified	EU Cyber Resilience Act: no direct mapping identified			OECD AI Principles: no direct mapping identified			ISO/IEC 27001: 3 references `A.5.34`Privacy and PII protectionISO catalogue page `A.8.10`Information deletionISO catalogue page `A.5.33`Records protectionISO catalogue page
verifiedAudit export	EU AI Act: no direct mapping identified	GDPR: 2 references `Art. 5(1)(c)`adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (‘data minimisation’);Official text `Art. 25`Data protection by design and by defaultOfficial text	DORA: no direct mapping identified	NIS2: no direct mapping identified							ISO/IEC 27001: 3 references `A.8.11`Data maskingISO catalogue page `A.5.34`Privacy and PII protectionISO catalogue page `A.8.15`LoggingISO catalogue page

verifiedAudit export		GDPR: no direct mapping identified		NIS2: no direct mapping identified	EU Cyber Resilience Act: no direct mapping identified					ISO/IEC 42001: 3 references `A.6.2.8`Event log recordingISO catalogue page `Clause 7.5.2`Creating and updating recordsISO catalogue page `Clause 7.5.3`Controlling recordsISO catalogue page	ISO/IEC 27001: 3 references `A.5.28`Evidence collectionISO catalogue page `A.8.15`LoggingISO catalogue page `A.5.33`Records protectionISO catalogue page
verifiedOffline verifier					EU Cyber Resilience Act: no direct mapping identified		NIST AI RMF: 2 references `MEASURE 2.8`Risks associated with transparency and accountability – as identified in the MAP function – are examined and documented.Official text `MEASURE 1.3`Internal experts who did not serve as front-line developers for the system and/or independent assessors are involved in regular assessments and updates. Domain experts, users, AI actors external to the team that developed or deployed the AI system, and affected communities are consulted in support of assessments as necessary per organizational risk tolerance.Official text	OECD AI Principles: 2 references `Principle 1.5`AccountabilityOfficial text `Principle 1.3`Transparency and explainabilityOfficial text		ISO/IEC 42001: 3 references `Clause 7.5.3`Controlling recordsISO catalogue page `Clause 9.1`Monitoring and measurementISO catalogue page `Clause 9.2.1`Internal audit, generalISO catalogue page	ISO/IEC 27001: 5 references `A.5.35`Independent reviewISO catalogue page `A.5.36`Policy compliance reviewISO catalogue page `A.5.28`Evidence collectionISO catalogue page `Clause 9.1`Monitoring and measurementISO catalogue page `Clause 9.2.1`Internal audit, generalISO catalogue page
partly verifiedAudit export	EU AI Act: no direct mapping identified	GDPR: no direct mapping identified	DORA: no direct mapping identified		EU Cyber Resilience Act: no direct mapping identified	CoE AI Convention: no direct mapping identified	NIST AI RMF: 2 references `GOVERN 1.5`Ongoing monitoring and periodic review of the risk management process and its outcomes are planned, organizational roles and responsibilities are clearly defined, including determining the frequency of periodic review.Official text `MEASURE 2.8`Risks associated with transparency and accountability – as identified in the MAP function – are examined and documented.Official text	OECD AI Principles: no direct mapping identified			ISO/IEC 27001: 2 references `A.5.36`Policy compliance reviewISO catalogue page `Clause 9.1`Monitoring and measurementISO catalogue page
verifiedReceipt		GDPR: no direct mapping identified			EU Cyber Resilience Act: no direct mapping identified			OECD AI Principles: 2 references `Principle 1.5`AccountabilityOfficial text `Principle 1.3`Transparency and explainabilityOfficial text	SOC 2: no direct mapping identified	ISO/IEC 42001: 2 references `A.6.2.8`Event log recordingISO catalogue page `Clause 7.5.2`Creating and updating recordsISO catalogue page

verifiedConfiguration check	EU AI Act: no direct mapping identified	GDPR: no direct mapping identified		NIS2: no direct mapping identified		CoE AI Convention: no direct mapping identified		OECD AI Principles: no direct mapping identified
partly verifiedConfiguration check		GDPR: no direct mapping identified				CoE AI Convention: no direct mapping identified	NIST AI RMF: 2 references `MEASURE 2.4`The functionality and behavior of the AI system and its components – as identified in the MAP function – are monitored when in production.Official text `MANAGE 4.1`Post-deployment AI system monitoring plans are implemented, including mechanisms for capturing and evaluating input from users and other relevant AI actors, appeal and override, decommissioning, incident response, recovery, and change management.Official text			ISO/IEC 42001: 2 references `A.6.2.6`Operation and monitoringISO catalogue page `Clause 9.1`Monitoring and measurementISO catalogue page
disabled by defaultConfiguration check	EU AI Act: no direct mapping identified	GDPR: no direct mapping identified	DORA: no direct mapping identified	NIS2: no direct mapping identified	EU Cyber Resilience Act: no direct mapping identified	CoE AI Convention: no direct mapping identified	NIST AI RMF: no direct mapping identified	OECD AI Principles: no direct mapping identified	SOC 2: no direct mapping identified	ISO/IEC 42001: no direct mapping identified	ISO/IEC 27001: no direct mapping identified
verifiedConfiguration check	EU AI Act: no direct mapping identified	GDPR: no direct mapping identified		NIS2: no direct mapping identified	EU Cyber Resilience Act: no direct mapping identified	CoE AI Convention: no direct mapping identified		OECD AI Principles: no direct mapping identified
partly verifiedConfiguration check	EU AI Act: no direct mapping identified	GDPR: no direct mapping identified			EU Cyber Resilience Act: no direct mapping identified	CoE AI Convention: no direct mapping identified	NIST AI RMF: 2 references `MANAGE 4.1`Post-deployment AI system monitoring plans are implemented, including mechanisms for capturing and evaluating input from users and other relevant AI actors, appeal and override, decommissioning, incident response, recovery, and change management.Official text `MANAGE 4.3`Incidents and errors are communicated to relevant AI actors including affected communities. Processes for tracking, responding to, and recovering from incidents and errors are followed and documented.Official text	OECD AI Principles: no direct mapping identified			ISO/IEC 27001: 3 references `A.8.16`MonitoringISO catalogue page `A.5.25`Event assessmentISO catalogue page `A.5.26`Incident responseISO catalogue page
partly verifiedAudit export					EU Cyber Resilience Act: no direct mapping identified	CoE AI Convention: no direct mapping identified	NIST AI RMF: 2 references `MANAGE 4.3`Incidents and errors are communicated to relevant AI actors including affected communities. Processes for tracking, responding to, and recovering from incidents and errors are followed and documented.Official text `MANAGE 2.3`Procedures are followed to respond to and recover from a previously unknown risk when it is identified.Official text	OECD AI Principles: no direct mapping identified		ISO/IEC 42001: 2 references `A.8.4`Incident communicationISO catalogue page `Clause 10.2`Nonconformity and corrective actionISO catalogue page	ISO/IEC 27001: 5 references `A.5.24`Incident planningISO catalogue page `A.5.25`Event assessmentISO catalogue page `A.5.26`Incident responseISO catalogue page `A.5.28`Evidence collectionISO catalogue page `A.6.8`Event reportingISO catalogue page
verifiedReceipt				NIS2: no direct mapping identified	EU Cyber Resilience Act: no direct mapping identified					ISO/IEC 42001: 3 references `A.6.2.6`Operation and monitoringISO catalogue page `A.6.2.8`Event log recordingISO catalogue page `Clause 8.1`Operational planning and controlISO catalogue page
partly verifiedConfiguration check	EU AI Act: no direct mapping identified				EU Cyber Resilience Act: no direct mapping identified	CoE AI Convention: no direct mapping identified	NIST AI RMF: 2 references `MANAGE 2.3`Procedures are followed to respond to and recover from a previously unknown risk when it is identified.Official text `GOVERN 6.2`Contingency processes are in place to handle failures or incidents in third-party data or AI systems deemed to be high-risk.Official text		SOC 2: 3 references `A1.2`The entity authorizes, designs, develops or acquires, implements, operates, approves, maintains, and monitors environmental protections, software, data back-up processes, and recovery infrastructure to meet its objectives.Official text `A1.3`The entity tests recovery plan procedures supporting system recovery to meet its objectives.Official text `CC7.5`The entity identifies, develops, and implements activities to recover from identified security incidents.Official text	ISO/IEC 42001: no direct mapping identified	ISO/IEC 27001: 3 references `A.8.13`BackupISO catalogue page `A.5.30`ICT continuity readinessISO catalogue page `A.5.29`Security during disruptionISO catalogue page
verifiedConfiguration check					EU Cyber Resilience Act: 2 references `Annex I Part I, point (2)(b)`be made available on the market with a secure by default configuration, unless otherwise agreed between manufacturer and business user in relation to a tailor-made product with digital elements, including the possibility to reset the product to its original state;Official text `Annex I Part I, point (2)(j)`be designed, developed and produced to limit attack surfaces, including external interfaces;Official text	CoE AI Convention: no direct mapping identified			SOC 2: 3 references `CC6.1`The entity implements logical access security software, infrastructure, and architectures over protected information assets to protect them from security events to meet the entity's objectives.Official text `CC6.6`The entity implements logical access security measures to protect against threats from sources outside its system boundaries.Official text `CC8.1`The entity authorizes, designs, develops or acquires, configures, documents, tests, approves, and implements changes to infrastructure, data, software, and procedures to meet its objectives.Official text
verifiedConfiguration check	EU AI Act: no direct mapping identified	GDPR: no direct mapping identified				CoE AI Convention: no direct mapping identified		OECD AI Principles: no direct mapping identified

verifiedCI result	EU AI Act: no direct mapping identified	GDPR: no direct mapping identified	DORA: no direct mapping identified	NIS2: no direct mapping identified	EU Cyber Resilience Act: no direct mapping identified	CoE AI Convention: no direct mapping identified	NIST AI RMF: no direct mapping identified	OECD AI Principles: no direct mapping identified
partly verifiedCI result	EU AI Act: no direct mapping identified	GDPR: no direct mapping identified	DORA: no direct mapping identified	NIS2: no direct mapping identified	EU Cyber Resilience Act: no direct mapping identified	CoE AI Convention: no direct mapping identified	NIST AI RMF: no direct mapping identified	OECD AI Principles: no direct mapping identified	SOC 2: no direct mapping identified	ISO/IEC 42001: no direct mapping identified	ISO/IEC 27001: no direct mapping identified
verifiedCI result	EU AI Act: no direct mapping identified	GDPR: no direct mapping identified	DORA: no direct mapping identified	NIS2: no direct mapping identified	EU Cyber Resilience Act: no direct mapping identified		NIST AI RMF: no direct mapping identified	OECD AI Principles: no direct mapping identified	SOC 2: no direct mapping identified
verifiedCI result	EU AI Act: no direct mapping identified	GDPR: no direct mapping identified	DORA: no direct mapping identified	NIS2: no direct mapping identified		CoE AI Convention: no direct mapping identified	NIST AI RMF: no direct mapping identified	OECD AI Principles: no direct mapping identified	SOC 2: no direct mapping identified	ISO/IEC 42001: no direct mapping identified
verifiedTest vector	EU AI Act: no direct mapping identified	GDPR: no direct mapping identified	DORA: no direct mapping identified	NIS2: no direct mapping identified	EU Cyber Resilience Act: no direct mapping identified				SOC 2: no direct mapping identified	ISO/IEC 42001: no direct mapping identified

verifiedCI result	EU AI Act: no direct mapping identified	GDPR: no direct mapping identified					NIST AI RMF: 3 references `MEASURE 2.5`The AI system to be deployed is demonstrated to be valid and reliable. Limitations of the generalizability beyond the conditions under which the technology was developed are documented.Official text `MEASURE 2.7`AI system security and resilience – as identified in the MAP function – are evaluated and documented.Official text `MEASURE 2.13`Effectiveness of the employed TEVV metrics and processes in the MEASURE function are evaluated and documented.Official text
verifiedCI result							NIST AI RMF: 2 references `MEASURE 2.7`AI system security and resilience – as identified in the MAP function – are evaluated and documented.Official text `MEASURE 2.6`AI system is evaluated regularly for safety risks – as identified in the MAP function. The AI system to be deployed is demonstrated to be safe, its residual negative risk does not exceed the risk tolerance, and can fail safely, particularly if made to operate beyond its knowledge limits. Safety metrics implicate system reliability and robustness, real-time monitoring, and response times for AI system failures.Official text			ISO/IEC 42001: no direct mapping identified
verifiedTest vector	EU AI Act: no direct mapping identified	GDPR: no direct mapping identified	DORA: no direct mapping identified	NIS2: no direct mapping identified		CoE AI Convention: no direct mapping identified				ISO/IEC 42001: no direct mapping identified
partly verifiedCI result	EU AI Act: no direct mapping identified	GDPR: no direct mapping identified	DORA: no direct mapping identified	NIS2: no direct mapping identified	EU Cyber Resilience Act: no direct mapping identified	CoE AI Convention: no direct mapping identified	NIST AI RMF: no direct mapping identified	OECD AI Principles: no direct mapping identified	SOC 2: no direct mapping identified	ISO/IEC 42001: no direct mapping identified	ISO/IEC 27001: no direct mapping identified
verifiedCI result	EU AI Act: no direct mapping identified	GDPR: no direct mapping identified	DORA: no direct mapping identified			CoE AI Convention: no direct mapping identified	NIST AI RMF: no direct mapping identified	OECD AI Principles: no direct mapping identified			ISO/IEC 27001: 3 references `A.8.25`Secure development lifecycleISO catalogue page `A.8.28`Secure codingISO catalogue page `A.8.32`Change managementISO catalogue page
verifiedCI result	EU AI Act: no direct mapping identified	GDPR: no direct mapping identified	DORA: no direct mapping identified	NIS2: 2 references `Art. 21(2)(e)`security in network and information systems acquisition, development and maintenance, including vulnerability handling and disclosure;Official text `Art. 21(2)(d)`supply chain security, including security-related aspects concerning the relationships between each entity and its direct suppliers or service providers;Official text	EU Cyber Resilience Act: 2 references `Annex I Part II, point (1)`identify and document vulnerabilities and components contained in products with digital elements, including by drawing up a software bill of materials in a commonly used and machine-readable format covering at the very least the top-level dependencies of the products;Official text `Annex I Part II, point (3)`apply effective and regular tests and reviews of the security of the product with digital elements;Official text	CoE AI Convention: no direct mapping identified	NIST AI RMF: 2 references `MAP 4.2`Internal risk controls for components of the AI system including third-party AI technologies are identified and documented.Official text `GOVERN 6.1`Policies and procedures are in place that address AI risks associated with third-party entities, including risks of infringement of a third party’s intellectual property or other rights.Official text		SOC 2: 3 references `CC7.1`To meet its objectives, the entity uses detection and monitoring procedures to identify (1) changes to configurations that result in the introduction of new vulnerabilities, and (2) susceptibilities to newly discovered vulnerabilities.Official text `CC8.1`The entity authorizes, designs, develops or acquires, configures, documents, tests, approves, and implements changes to infrastructure, data, software, and procedures to meet its objectives.Official text `CC9.2`The entity assesses and manages risks associated with vendors and business partners.Official text	ISO/IEC 42001: no direct mapping identified	ISO/IEC 27001: 4 references `A.8.8`Vulnerability managementISO catalogue page `A.8.9`Configuration managementISO catalogue page `A.8.32`Change managementISO catalogue page `A.5.21`ICT supply chainISO catalogue page
verifiedCI result		GDPR: no direct mapping identified	DORA: no direct mapping identified	NIS2: no direct mapping identified					SOC 2: no direct mapping identified

A · Consent and Policy

B · Cryptographic Evidence

C · Data Protection

G · Execution, Routing and Provider Controls

H · Agents, Tools and Action Governance

K · Privacy Operations and Data Lifecycle

L · Audit Exports, Compliance and Reporting

M · Operations, Monitoring and Resilience

O · Security Testing, Change Control and Software Assurance

No direct mapping identified for 50 of 74 capabilities.

A · Consent and Policy

B · Cryptographic Evidence

C · Data Protection

D · Identity and Access

F · Data Loss Prevention and Response Control

G · Execution, Routing and Provider Controls

I · Identity, Authentication and Tenant Security

J · Cryptographic Key Management and Evidence Integrity

K · Privacy Operations and Data Lifecycle

L · Audit Exports, Compliance and Reporting

M · Operations, Monitoring and Resilience

O · Security Testing, Change Control and Software Assurance

No direct mapping identified for 45 of 74 capabilities.

A · Consent and Policy

B · Cryptographic Evidence

D · Identity and Access

G · Execution, Routing and Provider Controls

I · Identity, Authentication and Tenant Security

J · Cryptographic Key Management and Evidence Integrity

L · Audit Exports, Compliance and Reporting

M · Operations, Monitoring and Resilience

O · Security Testing, Change Control and Software Assurance

No direct mapping identified for 42 of 74 capabilities.

A · Consent and Policy

B · Cryptographic Evidence

D · Identity and Access

G · Execution, Routing and Provider Controls

H · Agents, Tools and Action Governance

I · Identity, Authentication and Tenant Security

J · Cryptographic Key Management and Evidence Integrity

L · Audit Exports, Compliance and Reporting

M · Operations, Monitoring and Resilience

O · Security Testing, Change Control and Software Assurance

No direct mapping identified for 40 of 74 capabilities.

A · Consent and Policy

B · Cryptographic Evidence

C · Data Protection

D · Identity and Access

F · Data Loss Prevention and Response Control

G · Execution, Routing and Provider Controls

H · Agents, Tools and Action Governance

I · Identity, Authentication and Tenant Security

J · Cryptographic Key Management and Evidence Integrity

K · Privacy Operations and Data Lifecycle

M · Operations, Monitoring and Resilience

N · API, SDKs and Developer Integration

O · Security Testing, Change Control and Software Assurance

No direct mapping identified for 36 of 74 capabilities.

A · Consent and Policy

B · Cryptographic Evidence

C · Data Protection

D · Identity and Access

E · Content Inspection and Risk Classification

F · Data Loss Prevention and Response Control

G · Execution, Routing and Provider Controls

H · Agents, Tools and Action Governance

I · Identity, Authentication and Tenant Security

J · Cryptographic Key Management and Evidence Integrity

K · Privacy Operations and Data Lifecycle

L · Audit Exports, Compliance and Reporting

M · Operations, Monitoring and Resilience

N · API, SDKs and Developer Integration

O · Security Testing, Change Control and Software Assurance

No direct mapping identified for 37 of 74 capabilities.

A · Consent and Policy

B · Cryptographic Evidence

C · Data Protection

D · Identity and Access

E · Content Inspection and Risk Classification

F · Data Loss Prevention and Response Control

G · Execution, Routing and Provider Controls

H · Agents, Tools and Action Governance

I · Identity, Authentication and Tenant Security

J · Cryptographic Key Management and Evidence Integrity

K · Privacy Operations and Data Lifecycle

L · Audit Exports, Compliance and Reporting

M · Operations, Monitoring and Resilience

N · API, SDKs and Developer Integration

O · Security Testing, Change Control and Software Assurance

No direct mapping identified for 13 of 74 capabilities.

A · Consent and Policy

B · Cryptographic Evidence

C · Data Protection

D · Identity and Access

E · Content Inspection and Risk Classification

F · Data Loss Prevention and Response Control

G · Execution, Routing and Provider Controls

H · Agents, Tools and Action Governance

I · Identity, Authentication and Tenant Security

J · Cryptographic Key Management and Evidence Integrity

K · Privacy Operations and Data Lifecycle

L · Audit Exports, Compliance and Reporting

M · Operations, Monitoring and Resilience

N · API, SDKs and Developer Integration

O · Security Testing, Change Control and Software Assurance

No direct mapping identified for 24 of 74 capabilities.

A · Consent and Policy

B · Cryptographic Evidence

C · Data Protection

D · Identity and Access

E · Content Inspection and Risk Classification

F · Data Loss Prevention and Response Control

G · Execution, Routing and Provider Controls

H · Agents, Tools and Action Governance

I · Identity, Authentication and Tenant Security

J · Cryptographic Key Management and Evidence Integrity

K · Privacy Operations and Data Lifecycle

L · Audit Exports, Compliance and Reporting

M · Operations, Monitoring and Resilience

N · API, SDKs and Developer Integration

O · Security Testing, Change Control and Software Assurance

No direct mapping identified for 17 of 74 capabilities.

A · Consent and Policy

B · Cryptographic Evidence

C · Data Protection

D · Identity and Access

E · Content Inspection and Risk Classification

F · Data Loss Prevention and Response Control

G · Execution, Routing and Provider Controls

H · Agents, Tools and Action Governance

I · Identity, Authentication and Tenant Security

J · Cryptographic Key Management and Evidence Integrity

K · Privacy Operations and Data Lifecycle

L · Audit Exports, Compliance and Reporting

M · Operations, Monitoring and Resilience

N · API, SDKs and Developer Integration

O · Security Testing, Change Control and Software Assurance

No direct mapping identified for 17 of 74 capabilities.

A · Consent and Policy

B · Cryptographic Evidence

C · Data Protection

D · Identity and Access

E · Content Inspection and Risk Classification

F · Data Loss Prevention and Response Control

G · Execution, Routing and Provider Controls

H · Agents, Tools and Action Governance

I · Identity, Authentication and Tenant Security

J · Cryptographic Key Management and Evidence Integrity

K · Privacy Operations and Data Lifecycle

L · Audit Exports, Compliance and Reporting

M · Operations, Monitoring and Resilience

N · API, SDKs and Developer Integration

O · Security Testing, Change Control and Software Assurance

No direct mapping identified for 8 of 74 capabilities.

Only references that were read in the official text on 2026-11-01 appear. Identifiers verified against ISO/IEC 42001:2023 and ISO/IEC 27001:2022 on 2026-11-03. The standards are sold; their text is not reproduced here and the descriptors are the authors’ own. Each capability’s status, evidence paths in the public repositories and its offline check are in its detail panel.

Not counted as coverage (4)

These are specified or planned, not connected in the shipped gateway, or have no test evidence yet. They carry no references and are not counted in the matrix.

Automatic retention rule type
specified onlyK · Privacy Operations and Data Lifecycle
Listed as planned work in the gateway roadmap; retention is configured today with retention policies.
- docs/ROADMAP.md
- docs/guides/DATA_GOVERNANCE.md
Clustering and automatic failover
not wiredM · Operations, Monitoring and Resilience
The docs state clustering and automatic failover are not provided; the supported production deployment is one instance.
- docs/limitations.md
- docs/deployment/topology.md
Go and Java SDKs
unassessedN · API, SDKs and Developer Integration
The repository holds Go and Java SDK code and tests but no CI job for them was found; both implement protocol V1 only and neither is published.
Mutation testing and test adequacy
unassessedO · Security Testing, Change Control and Software Assurance
A mutation-testing tool is a development dependency, but no configuration or result was found.
- package.json

How it fits

From a framework to evidence an auditor can check.

Frameworks such as the EU AI Act, GDPR and the NIST AI RMF ask for records, oversight and accountability.
qodiqa produces signed consent, a hash-chained audit trail and receipts.
An auditor or regulator verifies them offline.