Compliance Center
Your agent goes live when its approvers can see their rules applied
Risk, compliance, and audit sign off on an agent when they can check its decisions against their own rules. VeriProof gives each of them a portal that shows exactly that, so the approval stops being the thing that holds your agent back.
The compliance officer's portal
Coverage, gaps, and who is fixing them
The compliance officer picks the frameworks that apply and sees, control by control, where the recorded decisions support them and where they don't yet.
A gap becomes assigned work with an owner, a due date, and a priority. When the missing piece is data the agent doesn't send, the developer who owns the integration gets a fix request, and compliance is asked to check again once the data arrives.
The auditor's portal
An engagement with a fixed scope
Auditors work inside an engagement scoped to the applications and dates under review. They can read and export the evidence, and they can't change rules or operate the agent.
Each record in the pack carries the rule version that applied, the reviewer's decision where one was needed, and a proof the auditor can check without asking your team.
How the work moves between them
These handoffs are built in, so an approval doesn't depend on someone remembering to forward an email.
An agent action needs a person
Reviewer with authority
A rule needs data the agent does not send
Developer
A governance engineer changes a rule for a production agent
Administrator or Compliance Officer
A control is not met
Assigned owner
A risk needs a business decision
Business Owner
An audit begins
Auditor
Find the rules your agent answers to
Start with what your agent does. Each page maps specific requirements to the records VeriProof keeps and says where your own team or adviser still has work to do.
AI laws and management standards
- EU AI Act: dates, deployer duties, and the records behind Articles 12, 14, and 26
- AIUC-1: the agent standard enterprise buyers ask software vendors about
- ISO/IEC 42001: operating evidence for an AI management system audit
- NIST AI RMF: subcategory by subcategory across GOVERN, MAP, MEASURE, and MANAGE
Automated decisions about people
- GDPR Article 22: contested decisions and the human who looked again
- Quebec Law 25: notice, reasons, and a staff member who can review
- NYC Local Law 144: hiring tools, bias audits, and candidate notices
Health, lending, and payments
- HIPAA: clinical AI decisions without patient detail the review doesn't need
- OSFI E-23: model risk for Canadian lenders, in effect May 1, 2027
- AP2: what an agent was allowed to spend, and what it paid
- MiCA: stablecoin payments in the EU
- GENIUS Act: stablecoin payments in the US, with rules expected January 18, 2027
Dates move. The regulatory timeline keeps the ones that matter to agents on one page, with official sources.
One decision, several reviews
An insurance agent that declines part of a claim may interest a privacy team under GDPR, a risk team under the EU AI Act, and an internal auditor. Each opens the same decision record from their own portal and keeps their own findings. Nobody rebuilds the story for anyone else.
Want a single workflow reviewed against one framework before you commit? Regulatory evidence starters scope that review with your assessors.
Find out what's between your agent and approval
Answer eight questions about one agent and see which of these handoffs are already in place and which are gaps. You don't need to give us your email to see the result.