Compliance Frameworks Guide
Evaluate AI models against EU AI Act, DORA, MAS TRMG, NIST AI RMF, SR 11-7, HIPAA/FDA, and SOX/SEC. Generate audit-ready artifacts in minutes — including EU AI Act Annex III classification and Annex IV technical documentation enforced at deploy.
Overview
The compliance engine evaluates AI models against regulatory frameworks using a plugin architecture. Each framework plugin implements risk classification, control evaluation, and artifact generation. Evaluations are synchronous and complete in under 5 minutes.
Supported Frameworks
Seven frameworks are available out of the box.
| Framework | Jurisdiction | Key Controls | Pass Threshold |
|---|---|---|---|
| EU AI Act | European Union | Art. 9 risk management, prohibited use classification | 75% |
| DORA (EU 2022/2554) | European Union | ICT risk register, TLPT, incident reporting (12 controls) | 65% |
| MAS TRMG + FEAT | Singapore | Fairness, Ethics, Accountability, Transparency (12 controls) | 65% |
| NIST AI RMF 1.0 | United States | GOVERN/MAP/MEASURE/MANAGE (16 controls) | 60% |
| SR 11-7 | United States (Fed) | Model risk management, challenger models, validation | 70% |
| HIPAA / FDA SaMD | United States | Clinical AI safety, PHI boundaries, SaMD submissions | 75% |
| SOX / SEC AI Governance | United States | Material AI risk, board reporting, audit trail | 70% |
Running an Evaluation
Trigger evaluations via the API or GitHub Actions.
1import { AegisSovereignClient } from "@aegissovereign/sdk";
2
3const client = new AegisSovereignClient({
4 baseUrl: "https://sovereign.yourcompany.com",
5 apiKey: process.env.AEGISSOVEREIGN_API_KEY!,
6 workspaceId: "ws_prod_abc123",
7});
8
9const result = await client.regulatory.evaluate(
10 "model_fraud_v2",
11 "eu_ai_act",
12 {
13 use_case: "fraud_detection",
14 incident_reporting_ref: "INC-2026-001",
15 }
16);
17
18console.log(result.passed); // true
19console.log(result.score); // 0.83
20console.log(result.findings.length); // 21curl -X POST https://api.aegissovereign.io/api/v1/compliance/evaluate \
2 -H "Authorization: Bearer $API_KEY" \
3 -H "Content-Type: application/json" \
4 -d '{
5 "model_id": "model_fraud_v2",
6 "framework": "eu_ai_act",
7 "workspace_id": "ws_prod_abc123"
8 }'Compliance Artifacts
Each evaluation generates signed artifacts ready for auditors, Legal teams, or regulatory submissions. Artifacts are stored as versioned records linked to the evaluation and can be downloaded at any time. When an evaluation fails, the RemediationSuggestionAgent fires automatically — it analyses the failing controls, maps them to specific regulatory text, and attaches a prioritised remediation plan (critical/high/medium with effort estimates) to the evaluation record. The CompliancePipelineAgent also auto-promotes a model if all required evaluations pass, or routes it to a Legal HITL approval queue if any fail.
EU AI Act — Annex III classification & Annex IV documentation
Digital Omnibus (June 2026): Annex III high-risk obligations apply from 2 December 2027 — deferred, not repealed; HIGH classifications carry an enforcement_note with the dates. Beyond the evaluation pack, three dedicated endpoints expose structured classification and the live technical-documentation state for any model — powering the EU AI Act panel in the Model Registry (the ⚖ row action) and the deploy-time enforcement gate. Classification (Article 6 + Annex III) returns the category, legal basis, rationale, and any carve-out — not just a risk label — with the fintech categories first-class. Annex IV documentation (Article 11) is assembled from evidence the platform already holds across the nine Annex IV sections, scored for per-section completeness with critical gaps listed; format=markdown returns the full downloadable document.
| Model signal | Classification | Legal basis |
|---|---|---|
| Credit scoring / creditworthiness of natural persons | HIGH | Annex III 5(b) |
| Financial-fraud detection (only) | MINIMAL — exempt | Annex III 5(b) carve-out |
| Mixed credit and fraud signals | HIGH (carve-out voided) | Annex III 5(b) |
| Life/health insurance risk & pricing | HIGH | Annex III 5(c) |
| Social scoring / biometric surveillance / NCII / CSAM | UNACCEPTABLE | Article 5 (Digital Omnibus additions incl.) |
| Chatbot / generative / emotion recognition | LIMITED | Article 50 (transparency) |
Enforced at deploy — the Annex IV promotion gate
Promoting a high-risk model to production is blocked while any critical Annex IV item is missing. The gate returns exactly what is outstanding and a link to the generated document; supplying an override reason proceeds but is written to the tamper-evident audit chain. Article 5 prohibited systems are never promotable; minimal/limited-risk models carry no Annex IV obligation. This is enforcement, not reporting — the deploy path is the control point.
1curl -X POST https://api.aegissovereign.io/api/v1/registry/models/<id>/promote \
2 -H "Authorization: Bearer $API_KEY" -H "Content-Type: application/json" \
3 -d '{"target_stage":"production"}'
4# → 422 EU_AI_ACT_NOT_READY
5# {
6# "risk_level": "high",
7# "category": "Creditworthiness evaluation / credit scoring (Annex III 5(b))",
8# "blocking": ["Intended purpose (Annex IV 1(a))", "Measures for examination of bias (Art. 10(2)(f-g))"],
9# "documentation": "/api/v1/models/<id>/eu-ai-act/annex-iv"
10# }