Evidence-first governance for the EU AI Act and ISO/IEC 42001
In development. This page describes the product we are building and what it will do. Cyron AI Compliance is being built to discharge an obligation only on evidence produced by live measurement, keep a qualified human at the point of judgement, and generate the filing documentation itself.
Companies adopted AI far faster than they adopted the ability to prove that their AI is governed. In a Gartner survey published on 30 September 2026, 54% of organisations had no defined approach to limiting what AI agents can access, or relied on access rules written for people.
Meanwhile the enforcement architecture stopped being prospective. Germany's KI-Marktüberwachungs- und Innovationsförderungsgesetz (KI-MIG) entered into force on 29 July 2026, making the Bundesnetzagentur the market surveillance authority for the AI Act and Germany's single point of contact under it, with sector regulators retaining competence in their fields. The German NIS2 implementation act has been in force since 6 December 2025 and expanded the regulated population from roughly 4,500 to around 29,500 entities, according to the BSI. Management must implement and oversee the risk measures, attend regular training, and is liable to the entity for culpable breaches.
The gap between how fast AI arrived and how slowly governance followed is the market. The gap between that and a named enforcing authority is the urgency.
An obligation will be discharged by evidence, graded on how that evidence was obtained, confirmed by a named human, and rendered into a filing that can be reproduced on demand.
It will take in evidence produced by live measurement, such as the findings Cyron AI Security records, and by contained probes, rather than questionnaire answers. Its evidence will come from runtime behaviour after deployment, exactly the stage most compliance tooling never reaches.
Evidence is not a boolean. It will be ordered by how it was obtained, and the ordering will determine what it can settle. For every duty class the system will state which grade is necessary and which is sufficient.
A named qualified human will confirm each mapping, and a second named human will sign the attestation. A language model may draft narrative; it will never author the interpretation.
It will produce the filing itself: technical documentation, the Statement of Applicability, the gap register. Any rendered filing will regenerate byte-for-byte from the ledger plus pinned versions.
These are the answers the finished system is designed to give, stated so you can test it against them.
It will return a reviewed, attested applicability determination naming your role, risk classification and subject scope, with its own version and its own named reviewer.
For each duty element, it will show whether it is discharged, by which evidence, under which crosswalk rule and rule-set version, confirmed by which named human, and until when.
Every unmet duty will be attributed: a condition in your environment, a Cyron condition, or an unmet regulatory precondition. Never silence.
Every discharge will carry its freshness window, its binding constraint, and the next event that will decay it.
Any rendered filing will regenerate byte-for-byte from the ledger plus pinned versions, and any attestation will be verifiable against the exact discharge set it bound.
A change upstream will propagate as a decay signal, void exactly the attestations it should, and name what must be re-reviewed. Nothing will go quietly stale.
Version one will cover the EU AI Act and ISO/IEC 42001, decomposed into individual duty elements. The corpus model is designed to be framework-agnostic, so a third framework will be a corpus addition rather than a re-architecture.
| Framework | What the product will produce | Who reads it |
|---|---|---|
| EU AI Act — applicability and role | Attested determination of provider, deployer, importer or distributor, with risk classification and its recorded basis | Legal, compliance, the board |
| EU AI Act — Article 15 robustness and cybersecurity | Discharge records backed by measured security evidence, with a reproducible account of how it was obtained | Auditor, market surveillance authority |
| EU AI Act — Annex IV technical documentation | Generated technical documentation with every claim traced to its source evidence | Notified body, product and quality management |
| ISO/IEC 42001 | Statement of Applicability and AI management system evidence, with unmet duties attributed | Certification body, CISO |
| Cross-framework | Gap register naming, for each unmet duty, whose condition prevents it | Internal audit, risk, remediation owners |
These are the outputs version one is designed to produce, stated so you can test the finished product against them.
A statement of what a system is not is more binding than a statement of what it is, because you can hold us to it.
No control will be discharged because a customer asserted it. A single asserted control in the discharge path collapses the entire claim, because an auditor will find it and ask what else was asserted.
The answer to "who decided this evidence discharges this duty" will be a named person and a dated artefact. If it were a model, the mapping would be indefensible as soon as it was challenged.
A compliance product whose natural resting state is a clean report will produce a clean report from an empty evidence stream. Its resting state will be an explicit, attributed account of what is not known.
Workflow state, ownership, priority and due dates are deliberately left out. It will record what is true and who said so, not what somebody intends to do about it. It will export a gap list; what you do with it is another system's job.
The entire loop is designed to run on your premises with no outbound network path, including the language model that will draft narrative. For buyers in defence, public sector, healthcare, energy and finance this is often a procurement precondition rather than a preference.
Cyron AI Compliance will be the evidence layer. Cyron API Security sees what reaches your APIs. Cyron AI Security measures what your agents do and records the findings. Cyron AI Compliance will turn those records into attested regulatory filings.
Each will deploy independently. Fed by runtime measurement, it will discharge duties on graded evidence; where only an assertion exists, the filing will record it as an assertion rather than presenting it as proof.
See all three productsJoin the design partners shaping Cyron AI Compliance, or start now with an applicability determination and a governance readiness assessment from our advisory practice.