53 Controls. Seven Frameworks. Evidence That Generates Itself.
Compliance evidence accumulates continuously as developers work - signed, drift-monitored, and exportable when the auditor asks.
Auditors Started Asking About AI
SOC 2, ISO 27001, NIST, and now the EU AI Act all ask what AI systems an organization runs, who uses them, what data reaches them, and what controls sit in between. Most teams answer with a spreadsheet assembled the week before the audit.
The underlying evidence exists - it is scattered across endpoints, chat logs, and API bills. Kraitos AIDR collects it as a byproduct of running the platform, so the audit becomes an export rather than a project.
Frameworks, Evidence, Drift, Attestation
Seven frameworks
- SOC 2
- ISO 27001
- NIST 800-53
- PCI DSS v4.0.1
- HIPAA
- NIST AI RMF
- EU AI Act
Framework scope
| Framework | Identifier | Scope |
|---|---|---|
| SOC 2 | soc2 | Trust Services Criteria - CC6.1, CC6.6, CC6.7, CC6.8, CC7.1, CC7.2, CC7.3, CC8.1 |
| ISO 27001:2022 | iso27001 | ISMS Annex A - A.5.9, A.8.3, A.8.7, A.8.8, A.8.9, A.8.15, A.8.16, A.8.20, A.8.22, A.8.28 |
| NIST 800-53 Rev 5 | nist-800-53 | AC-2, AC-6, AU-2, AU-6, CM-5, CM-11, IR-6, SA-11, SC-7, SI-3, SI-4, SI-7 |
| PCI DSS v4.0.1 | pci-dss-4.1 | 1.3.2, 3.4.1, 5.2, 5.3.3, 6.3.1, 7.2.2, 10.2.1, 11.5 |
| HIPAA Technical Safeguards | hipaa | 45 CFR §164.312 - (a)(1), (a)(2)(iv), (b), (c)(1), (e)(1) |
| NIST AI RMF | nist_ai_rmf | AI risk management functions |
| EU AI Act | eu_ai_act | Risk-tier classification and register obligations |
Selected control mappings
- SOC 2 CC6.1
- Logical access controls - AI tool access logs, policy enforcement records, MCP allowlist enforcement
- SOC 2 CC7.2
- System monitoring - real-time alerts on policy violations via Slack, email, and webhook
- ISO A.8.16
- Monitoring activities - real-time AI conversation telemetry across every endpoint
- ISO A.8.28
- Secure coding - per-repo AI config enforcement via managed CLAUDE.md and .cursorrules
- NIST SI-4
- System monitoring - continuous behavioral and network monitoring with MITRE ATT&CK mapping
- PCI 5.2
- Malicious software prevention - native malware scanner, YARA, IOC matching, quarantine
- HIPAA §312
- Technical safeguards - access control, disk encryption checks, audit trails, FIM, network monitoring
The evidence engine
- Coverage computation - each control resolves continuously to proven, partial, or unproven from live fleet data
- Signed evidence bundles - cryptographically signed so an auditor can verify the bundle was produced by the platform and not altered
- Drift detection - when a proven control loses its evidence, an alert fires immediately rather than at the next audit
- Coverage gap analysis - the dashboard shows which controls lack evidence and what would satisfy them
- Control ownership - named owners per control, per framework, with timestamped attestation
- Scheduled reports - daily, weekly, or monthly cadence with automated delivery
AI Register - EU AI Act and NIST AI RMF
An inventory of every AI system in use, auto-populated from fleet discovery and manually extensible. Auto-discovered systems land as shadow / unclassified and enter the review queue.
| Field | Values |
|---|---|
| Risk tier | prohibited · high · limited · minimal · unclassified |
| NIST impact | high · moderate · low · unset |
| Approval status | approved · review · shadow |
| Discovery | auto (found by the agent) · manual (added by an admin) |
Per-Framework Coverage
See Kraitos AIDR in Action
Enroll an endpoint and see which AI tools it runs. Stop guessing what your AI-augmented organization is doing.
[email protected]kraitos.io