Compliance
The compliance workflow turns what you know about each AI agent into audit-ready evidence. For every agent you govern, you create a governance profile, record evidence in eight categories, sign off each category, and get the evidence reviewed and approved. ANTS Platform maps that evidence to three AI frameworks (the EU AI Act, ISO/IEC 42001 and NIST AI RMF) and three security frameworks (SOC 2, ISO/IEC 27001 and NIST CSF 2.0), compares it with what the agent actually does at runtime, and exports it as a report.
Enterprise feature. The compliance pages need the Enterprise governance entitlement. Without it, they show a preview only. All pages are under Governance in the sidebar: My Requests, Available Requests, Evidence Collection, Framework Coverage and Audit & Export. What each person can do depends on their role. See Who can do what.
Frameworks
Each governance profile tracks one or more frameworks. ANTS Platform ships with 87 pre-built control mappings across six frameworks. Each requirement is mapped to one of the eight evidence categories, so filling and signing off a category completes every requirement mapped to it, in every framework the agent tracks.
| Framework | Version | Requirements | Examples |
|---|---|---|---|
| EU AI Act | Regulation (EU) 2024/1689 | 10 (9 mandatory, 1 recommended) | Art.6 Classification of AI Systems, Art.10 Data Governance, Art.14 Human Oversight, Art.52 Transparency for Users |
| ISO 42001 | ISO/IEC 42001:2023 | 7 (6 mandatory, 1 recommended) | 4.1 Understanding the Organization, 6.1 Actions to Address Risks, 9.1 Performance Evaluation |
| NIST AI RMF | 1.0 | 27 (23 mandatory, 4 recommended): 7 function-level requirements and 20 subcategories | GOVERN-1.1 Legal and Regulatory Requirements, MAP-5.1 Impact Likelihood and Magnitude, MEASURE-2.10 Privacy Risk, MANAGE-4.1 Post-Deployment Monitoring |
| SOC 2 | 2017 Trust Services Criteria (rev. 2022) | 15 (13 mandatory, 2 recommended) | CC3.2 Risk Identification and Analysis, CC6.1 Logical Access Controls, CC7.2 Anomaly and Security Event Monitoring, C1.1 Confidential Information Identification |
| ISO 27001 | ISO/IEC 27001:2022 | 15 (12 mandatory, 3 recommended) | 6.1.2 Information Security Risk Assessment, A.5.9 Inventory of Information and Other Associated Assets, A.5.34 Privacy and Protection of PII, A.8.15 Logging |
| NIST CSF 2.0 | 2.0 | 13 (11 mandatory, 2 recommended) | GV.RM Risk Management Strategy, ID.AM Asset Management, PR.DS Data Security, DE.CM Continuous Monitoring |
For SOC 2, ISO/IEC 27001 and NIST CSF 2.0, only the controls relevant to AI systems are included. They help you organize evidence for those programs; they are not a full certification checklist. The control IDs and wording are drafted from the published standards. Mapping your evidence in ANTS Platform does not certify an agent or replace your auditor's assessment.
An agent is only assessed against the frameworks selected on its profile. The full list of requirements, and what changed for agents that already tracked NIST AI RMF, is in Framework Coverage.
How the workflow runs
- Create a governance profile. In Evidence Collection, select Add Agent, pick an agent that has sent traces, set its EU AI Act risk level, and choose the frameworks to track. See Evidence Collection.
- Decide who fills it. Choose Assign to Developer to send a request through Slack, Jira or Linear, or Fill Evidence Myself.
- Collect evidence. The person who accepts the request fills the eight evidence categories and ticks each category's attestation.
- Review. The submission appears in the requester's My Requests. The reviewer approves it or requests changes. See Requests & Review.
- Track coverage. A requirement counts as complete when its evidence category is fully filled and attested. See Framework Coverage.
- Watch for drift. Declared evidence is compared with detections and error rates from the agent's traces. See Drift Alerts.
- Export. Generate a PDF or Excel compliance report and review the governance activity history. See Audit & Export.
The evidence model
Evidence is recorded in eight categories: Use Case & Scope, Risk Classification, Data Governance, Human Oversight, Security & Abuse Prevention, Bias & Fairness, Transparency & User Rights, and Legal & Accountability.
Evidence takes these forms:
| Form | What it is |
|---|---|
| Declarative | Answers entered in the structured evidence form |
| Attestation | A per-category sign-off: the person filling the form confirms the category is accurate. ANTS Platform records who attested and when. |
| Document reference | A link to a supporting document, such as the DPIA, legal approval, incident response plan or model card. For the risk assessment and bias test results you pick a file, and ANTS Platform records its file name only. The file itself is not uploaded or stored. |
| Runtime-derived | Observed values computed from the agent's traces, shown next to the declared values in Runtime Validation on the agent's profile |
Runtime-derived values do not fill in the form for you. They are used to check the declared evidence and to raise drift alerts.
Evidence status
A governance profile's evidence moves through these statuses:
| Status | Meaning |
|---|---|
| Draft | The profile exists and evidence is being filled |
| Pending Review | The evidence was submitted for review |
| Changes Requested | The reviewer sent it back with feedback |
| Approved | The reviewer approved it |
Who can do what
Access is controlled by the Governance and Audit & Export permissions in Members & Roles.
| Role | Compliance access |
|---|---|
| Owner | Everything |
| Security & Compliance | Everything: create profiles, raise and send requests, accept and submit requests, edit evidence and attestations, request changes, approve, generate reports |
| Department Admin | Read only. No Audit & Export. |
| Auditor | Read only. Can view the audit trail and download existing reports, but cannot generate new ones. |
| Cost Analyst, Manager Viewer, End User, None | No access |
To give someone a contributor role without approval rights, create a custom role. The checks behind each action are:
| Action | Permission needed |
|---|---|
| View Available Requests | Governance, Request Queue & Approvals: Read |
| Accept, submit, request changes | Request Queue & Approvals: Read & Write |
| Approve | Request Queue & Approvals: Admin |
| View My Requests | Compliance Requests (own): Read |
| Raise or cancel a request | Compliance Requests (own): Read & Write |
| Edit evidence and attestations | Evidence Collection: Read & Write |
| Create, edit or delete a profile, send a request notification, resolve drift alerts | Agent Profiles & Drift: Read & Write |
| View Framework Coverage | Framework Coverage: Read |
| View the audit trail and download reports | Audit & Evidence Export: Read |
| Generate reports | Audit & Evidence Export: Read & Write |
In this section
Next steps
- Evidence Collection: create your first governance profile.
- Risk Dashboard: see how coverage feeds each agent's compliance risk.
- Members & Roles: give reviewers and contributors the right access.