- 42 compliance frameworks in 15 jurisdictions plus global standards, with 217 controls, 93 of them read live from the platform
- Gulf and South Korean frameworks added on 11 October 2026
- From 22 frameworks in June to 42 in October
Kapālins now maps AI controls across 42 compliance frameworks in 15 jurisdictions plus global standards: 217 controls, 93 of which are read live from the platform and the rest assessed by a person.
Kapālins’ view is that security leaders are now asked to show what their AI tools and agents did, and that organisations operating across borders must show it against several sets of rules at once.
The compliance crosswalk was built with 22 frameworks in June 2026, ahead of the platform’s first production release in July. DORA, NIS2, the EU Cyber Resilience Act and three Japanese frameworks took the count to 28 in August, and frameworks from the Gulf states and South Korea took it to 42 on 11 October.
How the crosswalk grew
The Middle East frameworks include Saudi PDPL, SAMA CSF, NCA ECC, UAE PDPL, the DIFC and ADGM data protection laws, and the Qatar, Bahrain and Oman personal data laws.
Elsewhere, the frameworks include APRA CPS 234, the Essential Eight, the Privacy Act and the SOCI Act in Australia; India’s DPDP Act; Singapore’s MAS TRM and PDPA; Hong Kong’s HKMA guidance; Malaysia’s BNM RMiT; the EU AI Act, GDPR, DORA and NIS2; and ISO/IEC 42001 and 27001.
Each control is scored as live, read from the platform, or assessed, declared by a person.
Mapping depth varies by framework. Mapping shows which controls a framework touches; it is not certification or legal advice.
Organisations that want to see their frameworks mapped can request a briefing at kapalins.com.
