Compliance evidence for AI agents

Compliance evidence for AI agents: SOC 2, ISO 42001, NIST AI RMF, EU AI Act

These frameworks ask, in different words, who acted, under whose authority and whether you can show it. Provantix produces evidence that can support those controls. It does not make you compliant, and it says where its evidence stops.

See what the evidence supports Download the verification kit Get an invite

What the controls tend to ask for

Who or what acted, and under whose authority (SOC 2 access criteria, ISO/IEC 42001 roles and responsibilities).
Recording of events by the AI system (ISO/IEC 42001 event logs; EU AI Act record-keeping for high-risk systems).
Monitoring for unusual or unauthorized activity (SOC 2 monitoring criteria).
Human oversight of sensitive actions (EU AI Act human oversight).

What Provantix gives you

Sealed, hash-chained records in signed exports that an auditor verifies offline.
Findings and alerts for the activity an auditor asks about, with who decided what in a decision log.
Reports an auditor can read: coverage and integrity, approvals and authorization, findings, exportable as CSV or PDF.
Approvals attached to sensitive actions, where your application sends them.

What you still bring

A control is met by your own processes: who may deploy an agent, how access is requested and removed, how approvals are decided, how incidents are handled, how long records are kept. Provantix evidences what happened. It does not run those processes.

The mapping table says, for each control theme, what Provantix records and what it does not cover.
References are to the published control titles. Check the edition your auditor uses.

Honesty, up front

What the evidence proves, and what it does not

What it proves

What was recorded about agent actions, in what order, and that it was not altered afterwards.
Where your application sent approvals, that they were attached to the actions.

What it does not

That you are compliant with any framework. Provantix is not an audit, a certification or legal advice, and we are not ourselves certified under SOC 2, ISO 27001 or ISO 42001 yet.
That an export satisfies a particular audit. No audit firm has validated that yet, and we do not say otherwise.
Whether a system is high-risk under the EU AI Act, or the retention that applies. Those are for you and your counsel.

What the evidence supports — The control-by-control table, with what each row does not cover.
Trust: keys, custody and what we cannot do
Approvals: who approved what
Security and isolation

Get an invite

Invite-only during early access. We check your email with a one-time code, then review your request and send the invite. Ask for a demo if you want one.