EU AI Act: high-risk (Annex III) obligations now apply from 2 December 2027 — Regulation (EU) 2026/1744 moved the original August 2026 date. See if you’re ready →
Execlave maps runtime enforcement, audit trails, and governance controls to the compliance frameworks your organization already cares about.
§ COVERAGE
Control-by-control coverage
Each framework maps directly to platform controls, so audit evidence is generated from real runtime behavior.
“Supported” means an Execlave capability produces evidence for that control. It is not an audit opinion or a certification — your auditor assesses whether your organization meets each control.
01 / Framework
SOC 2 Type II
Service Organization Control framework for trust service criteria: security, availability, processing integrity, confidentiality, and privacy.
Access control and authentication
●Supported
RBAC with 4 role levels, API key scoping, Logto SSO integration
Change management
●Supported
Prompt version control with approval workflows and rollback capability
Monitoring and logging
●Supported
Append-only, hash-chained audit trail for blocks, violations, and admin actions, sealed by signed checkpoints
Incident response
●Supported
Automated incident creation, kill switches, and Slack/webhook notifications
02 / Framework
EU AI Act
European regulation establishing rules for AI systems, requiring transparency, human oversight, and risk management.
Human oversight (Article 14)
●Supported
Human-in-the-loop approval workflows, kill switches, and agent pause controls
Transparency and traceability (Article 13)
●Supported
Full execution trace logging with cryptographic verification
Risk management (Article 9)
●Supported
Policy engine with semantic classification, anomaly detection, and cost governance
Data governance (Article 10)
●Supported
PII detection and scrubbing, row-level data isolation
03 / Framework
ISO 27001
International standard for information security management systems (ISMS).
A.9 Access Control
●Supported
Role-based access control, API key management, organization-scoped resources
A.12 Operations Security
●Supported
Runtime enforcement, rate limiting, cost budgets, and automated policy evaluation
Kill switches, approval workflows, incident response, and cost governance
§ FAQ
Frequently asked questions
Common questions about Execlave's compliance coverage for AI agent workloads.
Does Execlave generate SOC 2 compliance evidence automatically?
Yes. Execlave generates SOC 2 evidence reports from your actual runtime data — active policies, execution traces, audit logs, and team configurations. Reports map to Trust Services Criteria including access control, change management, monitoring, and incident response, so your auditor can use them in your SOC 2 Type II audit. Execlave does not issue an audit opinion. No manual questionnaires required.
How does Execlave support EU AI Act Article 14 human oversight requirements?
Execlave provides human-in-the-loop approval workflows, a kill switch whose pause takes effect server-side in single-digit milliseconds (measured: p50 2.9 ms, p99 5.4 ms — see /benchmarks) and blocks the agent's next action synchronously, and agent pause controls. These support Article 14 human oversight requirements. All oversight actions are logged in the immutable audit trail for compliance evidence.
What HIPAA controls does Execlave cover for AI agent workloads?
Execlave supports four HIPAA Technical Safeguard requirements with evidence: access controls via RBAC and API key scoping (§164.312(a)), audit controls via append-only, hash-chained logs of blocks, violations, and admin actions (§164.312(b)), PHI de-identification via automated PII/PHI detection and scrubbing in trace payloads, and integrity controls via cryptographic hash-chain verification (§164.312(c)).
Does Execlave support GDPR data protection by design requirements?
Yes. Execlave supports GDPR Article 25 (Data Protection by Design) through row-level data isolation, encryption at rest and in transit, and a self-hosted deployment option. Article 5 (Data Minimization) is covered by PII detection, auto-redaction, and configurable data retention policies. Article 30 (Records of Processing) is supported by comprehensive trace records.
How does Execlave map to ISO 27001 information security controls?
Execlave maps to four ISO 27001 Annex A control groups: A.9 Access Control (RBAC, API key management, org-scoped resources), A.12 Operations Security (runtime enforcement, rate limiting, cost budgets), A.12.4 Logging and Monitoring (append-only audit logs, hash-chain verification), and A.16 Incident Management (automated incident creation, kill-switch response).
What is the NIST AI RMF and how does Execlave align with it?
The NIST AI Risk Management Framework provides guidelines for trustworthy AI across four functions: Govern, Map, Measure, and Manage. Execlave aligns with all four: centralized policy engine (Govern), semantic classification and risk scoring (Map), execution analytics and metrics (Measure), and kill switches, approval workflows, and cost governance (Manage).
Generate your first compliance report
Execlave generates framework-specific compliance reports with per-control gap analysis. Available on all plans.