Compliance

Supported Frameworks

4 of EvalGuard's 50 compliance frameworks are detailed below — the full registry ships in the product.

EU AI Act

The EU AI Act classifies AI systems by risk level and imposes obligations accordingly. EvalGuard maps your security scan and eval results to specific EU AI Act requirements.

Requirement Categories

• Risk Classification -- Prohibited, high-risk, limited, minimal risk determination
• Transparency -- AI interaction disclosure, deepfake labeling, content marking
• Human Oversight -- Human-in-the-loop, intervention capabilities, override mechanisms
• Data Governance -- Data quality, representativeness, bias testing
• Technical Robustness -- Accuracy, security, adversarial resilience
• Accountability -- Registration, documentation, conformity assessment
• Fundamental Rights -- Impact assessment on fundamental rights

Automated Checks

EvalGuard can automatically verify certain EU AI Act requirements through security scans. For example, the system-prompt-leak plugin verifies transparency requirement EU-TR-1 (AI Interaction Disclosure).

ISO 42001

ISO 42001 provides requirements for establishing, implementing, and improving an AI Management System (AIMS).

Requirement Categories

• A.2 — Policies related to AI -- Management direction and AI policy
• A.3 — Internal Organization -- Roles, responsibilities, and reporting
• A.4 — Resources for AI Systems -- Data, tooling, compute, and human resources
• A.5 — Assessing Impacts of AI Systems -- Impact assessments for individuals and society
• A.6 — AI System Life Cycle -- Responsible design and development
• A.7 — Data for AI Systems -- Data quality, provenance, and management
• A.8 — Information for Interested Parties -- Documentation and transparency to stakeholders
• A.9 — Use of AI Systems -- Responsible operation and use
• A.10 — Third Party and Customer Relationships -- Supplier and customer responsibilities

NIST AI RMF

The NIST AI Risk Management Framework organizes risk management into four core functions.

Core Functions

• Govern -- Cultivate a culture of risk management, establish policies and processes
• Map -- Understand the context, identify and assess AI risks
• Measure -- Analyze, assess, and track identified risks
• Manage -- Prioritize, respond to, and monitor risks

EvalGuard maps eval scorers and security plugins to NIST AI RMF subcategories, providing automated measurement for the Measure function.

MITRE ATLAS

MITRE ATLAS (Adversarial Threat Landscape for AI Systems) catalogs real-world adversarial techniques targeting AI. EvalGuard's security plugins directly map to ATLAS techniques.

Tactic Coverage

• Reconnaissance -- system-reconnaissance, model-identification plugins
• Initial Access -- prompt-injection, indirect-injection, few-shot-attack plugins
• ML Attack Staging -- staging adversarial inputs and crafting model-specific attacks
• Persistence -- memory-poisoning, rag-poisoning plugins
• Evasion -- jailbreak, roleplay-exploit, chain-of-thought-exploit plugins
• Exfiltration -- data-extraction, pii-leak, system-prompt-leak plugins
• Impact -- availability and model-integrity degradation

Running a Gap Analysis

Use the API or dashboard to run a compliance gap analysis. It compares your existing eval and security scan results against a framework's requirements.

Via API

curl -X GET "https://evalguard.ai/api/v1/compliance/gaps?framework=hipaa" \
  -H "Authorization: Bearer eg_live_your_api_key"

The gap-analysis route accepts these framework values: hipaa, fedramp, pci-dss, and india-dpdp-act. EU AI Act and ISO 42001 are served by their own dedicated registry routes (e.g. /api/v1/compliance/eu-ai-act/registry).

Response

{
  "framework": { "id": "hipaa", "name": "HIPAA AI Compliance", "...": "full framework object" },
  "timestamp": "2026-06-11T12:00:00.000Z",
  "overallScore": 72,
  "totalRequirements": 25,
  "metCount": 14,
  "partialCount": 4,
  "notMetCount": 3,
  "untestedCount": 4,
  "byCategory": {
    "administrative": { "total": 6, "met": 4, "partial": 1, "notMet": 0, "untested": 1, "score": 75 },
    "technical": { "total": 6, "met": 4, "partial": 2, "notMet": 0, "untested": 0, "score": 83 },
    "ai_specific": { "total": 8, "met": 3, "partial": 1, "notMet": 2, "untested": 2, "score": 44 }
  }
}

Via Dashboard

Navigate to Dashboard > Compliance to see a visual breakdown of your compliance posture across all frameworks.

Remediation Guidance

For each gap, EvalGuard provides:

• Priority -- Based on severity and business impact
• Action -- Specific steps to address the gap
• Effort -- Low, medium, or high implementation effort
• Automatable -- Whether EvalGuard can verify the fix automatically

Run the relevant security scan plugins or eval scorers to automatically verify remediation. Re-run the gap analysis to see updated scores.