Evidence over claims.

Compliance Guide

Map your agent's maturity to regulatory requirements. AMC supports EU AI Act, ISO 42001, NIST AI RMF, SOC 2, and OWASP LLM Top 10 — with 41 industry-specific domain packs across 7 sectors.

2027 Annex III timeline

EU AI Act — current high-risk timeline

Following the AI Omnibus political agreement, Annex III high-risk rules apply from 2 December 2027 and product-integrated high-risk rules from 2 August 2028. Confirm the current position in the official guidance.

EU AI Act Compliance

The EU AI Act (Regulation (EU) 2024/1689) uses a risk-based approach. AMC's compliance engine supports EU_AI_ACT as a first-class framework, mapping your maturity dimensions and evidence infrastructure directly to regulatory obligations.

# Generate EU AI Act compliance report
amc compliance report --framework EU_AI_ACT --window 30d --out reports/eu-ai-act.md

# Quick EU AI Act risk classification
amc compliance report --framework EU_AI_ACT

# Export compliance evidence binder
amc audit binder create --framework EU_AI_ACT
Important disclaimer AMC provides deterministic, evidence-linked compliance signals — not legal certifications. A signed or VALID report proves artifact integrity, not evidence sufficiency; use mappings externally only when evidence readiness is READY. AMC does not certify legal compliance. Always consult qualified legal counsel. See the European Commission high-risk guidance.

Risk Classification

AMC uses Domain Risk Classification to determine which governance tier applies to your agent:

Domain Risk ClassEU AI Act TierAMC Governance Requirements
critical Unacceptable (Art. 5) Prohibited unless exempted; AMC blocks deployment
high High-risk (Annex III) Full Art. 9–15, 17 obligations; strict human oversight
elevated Limited risk Transparency obligations (Art. 50); moderate oversight
standard Minimal risk Voluntary codes of practice; baseline AMC governance

High-risk domains per Annex III include: healthcare, finance, employment, education, law enforcement, critical infrastructure, and immigration/asylum.

Autonomy Duration Factor

Teams can configure stricter AMC policy targets as autonomy duration grows. These are AMC operating targets, not statutory maturity thresholds:

Autonomy DurationSuggested OversightExample AMC Policy Target
< 1 minuteStandard approval gatesL3+
1–15 minutesEnhanced monitoring + circuit breakersL4+
15–60 minutesContinuous oversight + auto-pauseL4+ with drift alerts
> 60 minutesMandatory periodic human checkpointsL5 only, with FRIA

Article-to-AMC Mapping

AMC maps 12 EU AI Act articles to specific dimensions, evidence modules, and diagnostic questions:

ArticleObligationAMC Evidence
Art. 9Risk Management SystemRisk register, duality assurance pack, drift detection. ≥60% OBSERVED evidence required.
Art. 10Data GovernanceDLP controls, exfiltration shield, data governance artifacts.
Art. 11Technical DocumentationArchitecture map, BOM, capability documentation.
Art. 12Record-keepingTransparency log, Merkle tree, signed evidence ledger.
Art. 13TransparencyTransparency reports, capability disclosures, output attestation.
Art. 14Human OversightGovernor policies, approval workflows, escalation gates.
Art. 15Accuracy, Robustness, Cybersecurity142 assurance packs, calibration gap, adversarial robustness, incident-to-regression closure.
Art. 17Quality Management SystemContinuous loop, drift alerts, scheduled assurance runs.

Compliance Workflow

1

Classify your agent

amc compliance report --framework EU_AI_ACT

AMC determines your risk classification based on domain and autonomy duration.

2

Apply domain packs

amc domain list                              # See all 7 domains + 41 packs
amc domain assess --domain health --agent my-agent  # Run domain assessment
3

Find compliance gaps

amc domain gaps --domain health --agent my-agent
amc compliance report --framework EU_AI_ACT --window 30d
4

Fix and verify

amc fix --target-level L3       # Generate remediation toward defined controls
amc guide --compliance EU_AI_ACT  # Map gaps to regulatory obligations
5

Export audit evidence

amc audit binder create --framework EU_AI_ACT  # Generate compliance binder
amc bundle export                                # Portable evidence bundle

7 Domains — 41 Industry Packs

Domain packs extend AMC's 244-question default rubric with industry-specific, regulatory-grounded questions. Each pack references specific regulatory articles — not vague guidelines. AMC has 41 sector-specific packs across 7 domains behind a planned commercial entitlement; public checkout is not live.

amc domain list                                   # See all 7 domains + packs
amc domain assess --domain health --agent my-agent  # Assess against a domain
amc domain gaps --domain wealth --agent my-agent    # Find compliance gaps
amc domain report --domain environment --output env.md  # Generate report

Environment

6 packs 87 questions EU Farm-to-Fork, REACH, IEC 61850, EU Drinking Water Directive

Agricultural AI, fashion/textile supply chains, advanced manufacturing, food systems, energy grids, water/sanitation.

Packs: farm-to-fork, weave-to-wear, material-to-machines, source-to-sustenance, ubiquity-to-utility, sip-to-sanitation

Health

9 packs 151 questions HIPAA §164.312, FDA 21 CFR Part 11, EU MDR 2017/745, ICH E6(R3)

EHR systems, wellness AI, patient journey management, clinical operations, medical professional AI, medtech/devices, pharma research, clinical trials, rare/precision medicine.

Packs: digital-health-record, wellness-management, patient-lifecycle, clinical-lifecycle, professional-practice, life-technology, drug-discovery, clinical-trials, specialized-medicine

Wealth

5 packs 70 questions MiFID II, PSD2, EU DORA, MiCA, FATF R1/R10

Investment management, payments, insurance, DeFi/crypto, banking and lending.

Education

5 packs 72 questions FERPA 20 U.S.C. §1232g, COPPA §312, IDEA, EU AI Act Annex III

K-12 learning, higher education, corporate training, special education, educational assessment.

Mobility

6 packs 78 questions EU EPBD 2024, UNECE WP.29 R155 §7, ETSI EN 303 645, EU NIS2

Autonomous vehicles, smart buildings, IoT infrastructure, logistics/supply chain, urban mobility.

Technology

5 packs 71 questions EU AI Act Art. 13, EU Data Act 2023, DSA Art. 34, TRIPS Agreement

SaaS platforms, cybersecurity AI, data analytics, developer tools, IP/patent management.

Governance

5 packs 71 questions EU eIDAS 2.0, EU AI Act Art. 5(1)(a), UNCAC Art. 7/9, UNGPs

Digital identity, public safety, anti-corruption, human rights impact, public administration.

Other Compliance Frameworks

ISO 42001

AI management system standard. Clauses 4–10 mapped to AMC dimensions.

amc compliance report --framework ISO_42001

NIST AI RMF

Risk management framework alignment for US federal and enterprise.

amc compliance report --framework NIST_AI_RMF

SOC 2

Trust service criteria mapping for service organization controls.

amc compliance report --framework SOC2

OWASP LLM Top 10

Full 10/10 coverage of the OWASP Large Language Model Top 10 risks.

amc compliance report --framework OWASP_LLM_TOP_10

Audit Binder

Generate a portable, signed evidence package for auditors:

# Create an audit binder for a specific framework
amc audit binder create --framework EU_AI_ACT

# List existing binders
amc audit binder list

# Verify binder integrity
amc audit binder verify

# Export for external sharing (controlled access)
amc audit binder export-request
amc audit binder export-execute
Every domain pack includes: risk tier classification, EU AI Act classification, SDG alignment, certification path, key risks, and regulatory article references.
← Adapter Guides Next: Scoring Methodology →