Compliance
Evidence that answers the obligation
Frameworks do not ask whether you bought a control. They ask whether it works, and increasingly they ask you to show it. This is how executed validation evidence maps onto what you report.
Framework mapping
The obligation, and what answers it
A list of framework names proves nothing. What matters is the specific obligation each one creates and which executed evidence speaks to it.
EU AI Act Regulation (EU) 2024/1689
European Union
The obligation
Deployers and providers of AI systems must operate risk management, human oversight and post-market monitoring, and be able to demonstrate them in operation.
What Veync evidence provides
A reconciled inventory of AI actually running, a map from each policy clause to the mechanism enforcing it, and tested evidence that approval gates and human-in-the-loop controls cannot be bypassed.
NIS2 Directive (EU) 2022/2555
European Union
The obligation
Essential and important entities must manage cyber risk on a defined basis and report significant incidents within strict deadlines.
What Veync evidence provides
Per-control prevented, detected, alerted or missed verdicts with measured detection and response times, which is the same measurement a reporting deadline depends on.
DORA Regulation (EU) 2022/2554
European Union
The obligation
Financial entities must maintain digital operational resilience, including threat-led penetration testing of critical functions.
What Veync evidence provides
Continuous adversary emulation across the kill chain against the live environment, with a complete executed-action log and an attack-path graph for each objective reached.
ISO/IEC 42001 2023
ISO/IEC
The obligation
An AI management system must define controls across the AI lifecycle and provide evidence that they operate as described.
What Veync evidence provides
A governance gap register derived from executed tests rather than self-assessment, with each satisfied clause linked to the action that demonstrated it.
NIST AI RMF 1.0
NIST
The obligation
AI risk should be governed, mapped, measured and managed, with measurement grounded in evidence rather than intent.
What Veync evidence provides
Measured guardrail hold rates per attack class and an effective-authority matrix per agent, which turns the measure function from a questionnaire into a result.
ISO/IEC 27001 2022
ISO/IEC
The obligation
Annex A controls must be implemented where applicable and their effectiveness monitored and reviewed.
What Veync evidence provides
Control-category verdicts mapped to the relevant Annex A controls, plus the detection-engineering changes that would close each gap found.
SOC 2
AICPA
The obligation
Trust services criteria must be supported by evidence an independent auditor can examine and rely on.
What Veync evidence provides
A clause-level register in which every satisfied item resolves to an executed action, and every untested item is marked untested rather than assumed.
EU AI Act
The application timeline
The Act entered into force in August 2024 and applies in stages. The dates below are the application milestones as published in the Official Journal.
Entry into force
The Regulation enters into force twenty days after publication, starting the clock on every staged obligation that follows.
Prohibited practices apply
The prohibitions on unacceptable-risk practices, and the AI literacy obligations, become applicable.
General-purpose AI obligations apply
Obligations for providers of general-purpose AI models, along with governance and penalty provisions, become applicable.
General application
The bulk of the Regulation applies, including the high-risk requirements for systems covered by Annex III.
Annex I high-risk systems
The extended deadline for high-risk AI systems embedded in products regulated under existing Union legislation.
These dates are recorded as published. Amending proposals have been discussed that would move some high-risk obligations, so verify against the Official Journal before relying on them for a compliance plan.
Data residency
Where the evidence lives
Validation evidence is a detailed map of where your defences fail, which makes residency and access a compliance question in its own right.
- Processed and stored in the EU
- Evidence, telemetry and run records stay in EU regions, with no replication outside the Union for convenience.
- Named access only
- Access is restricted to named personnel on your engagement, logged, and revoked when it ends.
- Retention you set
- Retention is contractual rather than default, with deletion on request and a certificate of destruction.
- Disclosed subprocessors
- The subprocessor list forms part of the agreement and changes are notified rather than discovered.
An important limit
Veync is not a certification body
Veync produces evidence. It does not issue certifications, attestations, conformity assessments or marks of any kind, and it is not accredited to do so. Nothing Veync provides is a certificate, and no Veync output should be presented to a regulator or a customer as one.
What the evidence does is support the work of the people who are accredited. An auditor, a notified body or an internal assurance function can take an evidence-linked gap register and verify each claim back to the executed action that produced it, which is a materially stronger starting point than a completed questionnaire.
Stating this plainly costs nothing and prevents a real misunderstanding. A vendor that lets a buyer believe its report is a certificate has created a compliance problem rather than solved one.
Questions
What compliance teams ask
Can we use this evidence in an audit?
Yes, and that is what it is formatted for. Every satisfied clause resolves to the executed action that demonstrated it, so an auditor can verify the claim rather than accept it. Veync is not a certification body and issues no certificates; the evidence supports the accredited party's work.
Does this satisfy DORA's threat-led penetration testing requirement?
Continuous adversary emulation against the live environment with a complete executed-action log is the substance that requirement is asking for. Whether a specific programme satisfies a specific supervisor is a determination for you and your regulator, and we will not claim otherwise.
What if a clause has no evidence?
It is marked untested rather than assumed satisfied. An honest gap register with known holes is more useful than a complete-looking one built on optimism, and the untested items are usually the most informative output of the first engagement.
How do you handle the AI Act's staged dates?
The timeline above records the dates as published in the Official Journal. Because amending proposals could move some high-risk obligations, we treat the dates as something to verify rather than assert, and the pre-launch checklist for this site carries that obligation explicitly.
Map your obligations to evidence
A validation briefing starts from the frameworks you report against and works back to the scope that would produce defensible evidence for each one.
Veync produces evidence and is not a certification body.