Compliance
Map your AI systems against leading regulatory frameworks. Track compliance status at the requirement level, attach evidence, and export compliance packages for regulators and auditors.
Supported Frameworks
AI SENTINEL ships with nine pre-loaded frameworks: three that apply by risk tier (the EU AI Act, NIST AI RMF and ISO/IEC 42001), five that apply by jurisdiction (the GDPR and the California, Colorado, Texas and Washington AI rules) and one you choose: AIUC-1, the certification standard for AI agents. Each framework is broken down into articles, clauses or functions with individual compliance tracking.
EU AI Act
Key-obligation mapping from Art. 4 (AI literacy) and Art. 5 (prohibited practices) through Art. 73 (serious incidents) and the Art. 113 applicability timeline, plus relevant annexes. The primary regulatory framework for AI systems in the European Union.
83 requirements: articles and annexesNIST AI RMF
The US National Institute of Standards and Technology AI Risk Management Framework. Four core functions with sub-categories.
23 requirements: GOVERN, MAP, MEASURE, MANAGEISO 42001
International standard for AI Management Systems. Covers organizational context, leadership, planning, support, and operations.
33 requirements: clauses 4 to 10 and Annex A controlsAIUC-1
AIUC-1, the certification standard for AI agents: six domains (data and privacy, security, safety, reliability, accountability, society), with mandatory technical testing at least every three months. It does not attach by risk tier: you choose it for your agents.
57 requirements: six domains and the 51 requirements in forceGDPR
The AI-relevant articles of Regulation (EU) 2016/679, with Article 22 on solely automated decisions and Article 35 on impact assessments in full. Attaches by jurisdiction.
26 requirementsCalifornia CCPA ADMT
The California regulations on automated decision-making technology, risk assessments and cybersecurity audits. Attaches by jurisdiction.
92 requirementsColorado SB 26-189
The statute that replaced the original Colorado AI Act: advance notice, post-decision disclosure, correction and review, and developer documentation. Attaches by jurisdiction.
10 requirementsTexas TRAIGA
House Bill 149: intent-based prohibitions, government and health care disclosure duties, and the NIST safe harbour. Attaches by jurisdiction.
11 requirementsWashington
Five instruments: consumer health data, content provenance, companion chatbots, prior authorisation and public agencies. Attaches by jurisdiction.
16 requirementsCompliance Statuses
Each requirement can be independently assessed for every AI system. The status reflects the current compliance posture for that specific requirement.
Compliance Matrix
The compliance matrix provides a per-AI-system view of all requirements within a chosen framework. For each requirement, you can set the compliance status, add notes, and attach evidence documents.
Per-requirement tracking
- • Compliance status (5 levels)
- • Evidence attachments and notes
- • Applicability filtering by risk level
- • Responsible person assignment
Export capabilities
- • CSV export for spreadsheet analysis
- • PDF export for regulatory submissions
- • Technical documentation packages (Art. 11 / Annex IV)
- • Audit-ready compliance reports
Cross-Framework Mapping
Many requirements across the nine frameworks overlap. AI SENTINEL includes 301 pre-built cross-framework mappings, so that one piece of work can stand as evidence against several frameworks at once.
When you mark a requirement as Compliant or Partially Compliant, AI SENTINEL shows linked requirements from other frameworks and offers to propagate the status automatically.
For example, marking EU AI Act Art. 9 (Risk Management) as compliant can automatically update NIST GOVERN 1 (Risk Management Policies) and ISO 42001 Clause 6.1 (Actions to Address Risks): because they cover the same obligation.
34
Equivalent mappings
64
Partial mappings
203
Related mappings
Auto-Generated Compliance Snapshot
When you classify an AI system's risk level (e.g., high risk under the EU AI Act), AI SENTINEL automatically creates compliance mapping records for every applicable requirement of the EU AI Act, NIST AI RMF and ISO/IEC 42001. The GDPR and the US state rules attach once the organization's jurisdictions and screening questions are answered. You arrive at the compliance matrix with the relevant controls pre-populated: no manual setup needed.
For a High Risk system, this means 130 requirements are initialised at once across the EU AI Act, the NIST AI RMF and ISO/IEC 42001, each set to “Not Assessed” and ready for evaluation.
Mapping Compliance
AI OfficerNavigate to Compliance
Go to Governance → Compliance from the top navigation.
AI OfficerSelect framework and AI system
Choose one of the nine frameworks and the AI system to assess.
AI OfficerAssess each requirement
Work through the requirements list. For each, set the compliance status and add notes or evidence.
AI OfficerFilter by applicability
Use risk-level filtering to focus on requirements that apply to your system's classification (e.g., high-risk only).
AI OfficerExport documentation
Generate CSV or PDF reports for regulatory submissions, audits, or internal stakeholders.