Framework Coverage
Framework Coverage shows how far your governed agents are toward meeting each framework. ANTS Platform ships with pre-built control mappings for three AI frameworks, the EU AI Act, ISO/IEC 42001 and NIST AI RMF, and two security frameworks, SOC 2 and ISO/IEC 27001. Each requirement is tied to an evidence category, so filling and signing off that category in Evidence Collection is what completes the requirement.
Enterprise feature. Open it from Governance → Framework Coverage. It needs the Framework Coverage read permission, which Owner, Security & Compliance, Department Admin and Auditor have. See Members & Roles.
How a requirement is assessed
Only agents whose governance profile includes a framework are assessed against it. For each agent and requirement, ANTS Platform looks at the requirement's evidence category:
| Agent status | Rule |
|---|---|
| Completed | The category is 100% filled and its attestation is signed |
| Awaiting Sign-off | The category is 100% filled but not attested |
| Partial | The category is partly filled |
| Not Assessed | Nothing in the category is filled |
Status is recalculated whenever evidence or attestations are saved. Approval in Requests & Review does not affect it.
What the page shows
Framework Compliance cards
One card per framework: EU AI Act, ISO 42001, NIST AI RMF, SOC 2 and ISO 27001. Each card shows:
- Version: the version of the framework the requirements are mapped to.
- Coverage percentage: for each agent tracking the framework, the share of its requirements that are Completed, averaged across those agents.
- Completed: controls where every assessed agent is Completed.
- In Progress: controls that not every assessed agent has Completed yet.
- Not Assessed: controls with no assessed agent.
- Compliant Agents: agents that are Completed on every requirement of the framework, out of the agents tracking it.
- Total Controls.
Select a card to filter the page to that framework.
Controls table
The table lists each requirement with its Article (the article, clause, function, criterion or control reference), Requirement, Category and Status (Completed, Partial or Not Assessed across agents). Search controls and filter by category and status.
Select a control to open its detail panel. It shows whether the control is Required (mandatory) or Recommended, and lists the assessed agents with their status. Filter the agents by All, Compliant or Needs Action. For each agent that needs action, the panel names the evidence section to complete, for example "Complete the Data Governance section in the evidence form", and links to the form.
Active drift alerts
The page also lists open drift alerts, with a link to the full list.
Framework versions
| Framework | Version |
|---|---|
| EU AI Act | Regulation (EU) 2024/1689 |
| ISO 42001 | ISO/IEC 42001:2023 |
| NIST AI RMF | NIST AI RMF 1.0 |
| SOC 2 | 2017 Trust Services Criteria |
| ISO 27001 | ISO/IEC 27001:2022 |
The requirements
EU AI Act
| Article | Requirement | Evidence category | Criticality |
|---|---|---|---|
| Art.6 | Classification of AI Systems | Risk Classification | Mandatory |
| Art.9 | Risk Management System | Risk Classification | Mandatory |
| Art.10 | Data Governance | Data Governance | Mandatory |
| Art.11 | Technical Documentation | Transparency & User Rights | Mandatory |
| Art.12 | Record-Keeping | Transparency & User Rights | Mandatory |
| Art.13 | Transparency | Transparency & User Rights | Mandatory |
| Art.14 | Human Oversight | Human Oversight | Mandatory |
| Art.15 | Accuracy & Robustness | Security & Abuse Prevention | Mandatory |
| Art.52 | Transparency for Users | Transparency & User Rights | Mandatory |
| Art.69 | Codes of Conduct | Legal & Accountability | Recommended |
ISO 42001
| Clause | Requirement | Evidence category | Criticality |
|---|---|---|---|
| 4.1 | Understanding the Organization | Use Case & Scope | Mandatory |
| 5.1 | Leadership and Commitment | Legal & Accountability | Mandatory |
| 6.1 | Actions to Address Risks | Risk Classification | Mandatory |
| 7.1 | Resources | Human Oversight | Mandatory |
| 8.1 | Operational Planning | Use Case & Scope | Mandatory |
| 9.1 | Performance Evaluation | Bias & Fairness | Mandatory |
| 10.1 | Continual Improvement | Legal & Accountability | Recommended |
NIST AI RMF
| Function | Requirement | Evidence category | Criticality |
|---|---|---|---|
| GOVERN-1 | Governance Structure | Legal & Accountability | Mandatory |
| MAP-1 | Context Mapping | Use Case & Scope | Mandatory |
| MAP-2 | Stakeholder Identification | Human Oversight | Mandatory |
| MEASURE-1 | Risk Metrics | Risk Classification | Mandatory |
| MEASURE-2 | Performance Metrics | Bias & Fairness | Mandatory |
| MANAGE-1 | Risk Treatment | Security & Abuse Prevention | Mandatory |
| MANAGE-2 | Incident Response | Security & Abuse Prevention | Recommended |
NIST AI RMF coverage also includes requirements at subcategory level under GOVERN, MAP, MEASURE and MANAGE. Each is tied to an evidence category and assessed the same way. The controls table lists them all.
SOC 2
The AI-relevant criteria of the SOC 2 Trust Services Criteria are mapped to evidence categories. Each criterion is assessed for an agent exactly like the AI framework requirements. The controls table lists each one with its criterion reference.
ISO 27001
The AI-relevant Annex A controls of ISO/IEC 27001 are mapped to evidence categories and assessed the same way. The controls table lists each one with its Annex A control reference.
Because several requirements share a category, completing one category can complete requirements in more than one framework. For example, a filled and attested Risk Classification section completes EU AI Act Art.6 and Art.9, ISO 42001 6.1 and NIST AI RMF MEASURE-1.
Closing gaps
- Select the framework card with the lowest coverage.
- Filter the controls table to Not Assessed or Partial.
- Open a control and select an agent under Needs Action to go to the section of the evidence form it needs.
- Fill the section and sign its attestation. Coverage updates when you save.
Next steps
- Evidence Collection: fill the outstanding sections.
- Risk Dashboard: see each agent's per-framework status alongside its risk.
- Audit & Export: export framework compliance for auditors.