Compliance

Every control tied to the evidence that proves it.

29 frameworks in 9 jurisdictions plus global standards, with 122+ controls. Each control is proved by assessment answers, by a live signal from the platform, or by both.

Framework explorer

29 frameworks. 122+ controls.

Pick a jurisdiction, then a framework, to see its controls and whether each is proved by a live signal or by the assessment. 65 of the 122 controls carry a live signal today. Middle East frameworks are available and mapped at onboarding.

evidence chain

Browse the framework library

Regulators are shown by flag and name. Their emblems are not licensed for vendor use.

How a control is proved

From obligation to evidence pack.

The same chain runs for every framework. Follow one control, OWASP LLM01 Prompt Injection, through it.

  1. Obligation

    What the framework requires.

    OWASP LLM01: defend against prompt injection.
  2. Control

    What your organisation does about it.

    Injection attempts are detected and blocked before they reach a model.
  3. Assessment question

    Your people answer.

    “Is there an input validation layer that blocks prompt injection?” Yes.
    Live signal

    The platform measures.

    Firewall block rate and injection probe pass rate.
  4. Evidence

    A status, and what it rests on.

    Attested from the answer, verified from the signals.
  5. Pack

    One export for the people who check.

    One export for the OWASP LLM Top 10, ready for an assessor.

A live signal that contradicts the answers wins: a strong attestation with a weak signal does not count as compliant. A control with no evidence reads “not assessed” and still counts against the framework.

Regulator-ready evidence

Evidence a regulator can check without trusting us.

Choose a framework and export its evidence in one step. Anyone holding it can confirm it has not been changed since it left the platform.

What it proves

Every obligation in the framework, its status, and whether a live signal or an attestation stands behind it.

Tamper-evident

Records are hash-chained. An edit, deletion or reordering breaks the chain, and a reader can recompute it alone.

Exportable

Machine-readable evidence for assessors, with a report and a summary for people, built from the same record.

Who it is for

Regulators and auditors, boards and risk committees, and partners who issue it to their customers under their own name.

Each export states its basis: a point-in-time, control-assurance view under management’s responsibility, not legal advice. Partners can issue it to their customers: see the partner programme.

Notification clocks

One incident, many clocks.

When an incident opens, the platform lists the regulator notification duties it may have started, for the frameworks you have in scope, and shows when each falls due.

The clock starts when the incident opensCounted from its earliest signal, or from when it was raised. The deadline shown is never later than the real one.
  1. 12 hours
    SOCI ActASD / ACSC · significant impact
  2. 24 hours
    NIS2Early warningCyber Resilience ActEarly warning to CSIRT and ENISA
  3. 72 hours
    GDPRLead supervisory authorityAPRA CPS 234APRASOCI ActASD / ACSC · relevant impactNIS2Incident notificationCyber Resilience ActNotification
  4. One month
    NIS2Final reportCyber Resilience ActFinal report, severe incident
No fixed period in the regulation’s own text
Privacy Act 1988As soon as practicableDORAInitial, intermediate and final reportsAPPIPreliminary report promptlyDPDP Act 2023In the prescribed form and mannerBNM RMiTWithin the policy’s timeframes

Whether an incident is material or significant is your judgement: the platform lists what applies if it is notifiable, and records who decided. A period is shown only where the regulation’s text states one.

Middle East and roadmap

Middle East available now. More on the way.

Middle East frameworks are available and mapped to your controls at onboarding. Roadmap frameworks are not yet mapped and show no evidence; neither group is counted in the 29 above.

Available · Middle East

Personal Data Protection Law (PDPL)SDAIA · In force since September 2024.Available · mapped at onboarding
SAMA Cyber Security FrameworkSaudi Central Bank (SAMA) · For banks, insurers and finance companies.Available · mapped at onboarding
NCA Essential Cybersecurity ControlsNational Cybersecurity Authority · Baseline controls for government and critical sectors.Available · mapped at onboarding
AI Ethics PrinciplesSDAIA · National principles for building and using AI.Available · mapped at onboarding
Federal Decree-Law No. 45 of 2021 (PDPL)UAE Data Office · Federal personal data protection law.Available · mapped at onboarding
DIFC Data Protection Law 2020 and Regulation 10DIFC Commissioner of Data Protection · Regulation 10 covers personal data processed by autonomous and AI systems.Available · mapped at onboarding
ADGM Data Protection Regulations 2021ADGM Office of Data Protection · Abu Dhabi Global Market free zone.Available · mapped at onboarding
Personal Data Privacy Protection Law (Law No. 13 of 2016)National Cyber Security Agency · Qatar’s personal data law.Available · mapped at onboarding
Personal Data Protection Law (Law No. 30 of 2018)Personal Data Protection Authority · Bahrain’s personal data law.Available · mapped at onboarding
Personal Data Protection Law (Royal Decree 6/2022)Ministry of Transport, Communications and IT · Oman’s personal data law.Available · mapped at onboarding

On the roadmap

AI Basic ActMinistry of Science and ICT · Korea’s framework act on AI, in force from January 2026.On the roadmap
APRA CPS 230 Operational Risk ManagementAPRA · In force since July 2025, amended from 1 July 2026. Coming to the framework mapping.On the roadmap
Personal Data Protection Law (Law No. 27 of 2022)Government of Indonesia · Fully in force since October 2024.On the roadmap
Colorado AI Act (SB 24-205)State of Colorado · Repealed and re-enacted in May 2026 as automated decision-making disclosure duties, from 1 January 2027.On the roadmap
Request a briefing

See your frameworks on your own estate.

We map the frameworks you answer to against the AI you actually run, and show which controls are proved by live evidence.

Request a briefing Framework library
FAQ

Questions buyers ask.

What is the difference between verified and attested?

Attested means the control is evidenced by answers to the assessment. Verified means a live signal from the gateway, the probes or the device sensor confirms it. A control can carry both, and a live signal that contradicts a strong attestation stops the control counting as compliant.

Can a regulator check the evidence without trusting Kapālins?

Yes. The evidence is hash-chained, so a reader can recompute the chain from the records in the export and see that nothing was edited, removed or reordered.

Does the platform decide whether an incident is notifiable?

No. Materiality is the organisation’s judgement. The platform lists the duties that apply if the incident is notifiable, shows when each falls due, and records who decided.

Are Middle East frameworks covered?

Yes. Saudi PDPL, SAMA CSF, NCA ECC, the SDAIA AI Ethics Principles, UAE PDPL, the DIFC and ADGM data protection laws and the Qatar, Bahrain and Oman personal data laws are available, and are mapped to your controls at onboarding.