Built against the frameworks your compliance team already answers to
NIST AI RMF, the EU AI Act, ISO/IEC 42001, the OWASP Agentic Top 10 — Bairav's registry, policy layer and evidence model are designed against these frameworks directly, not bolted on afterward as a separate compliance exercise.
Verdict first, action second, audit trail third.
Where this lands against the frameworks you already report to
Bairav's evidence model is built against reference frameworks your compliance team already answers to — the ledger, registry, and policy layer are the concrete answers underneath those abstract requirements.
NIST AI RMF 1.0
Four functions- Expects
- Govern, map, measure and manage AI risk on an ongoing basis.
- Bairav operationalizes it as
- Named policies with an enforcement state, agent discovery, four-factor risk scoring, and block/approve/flag/notify actions tied to an accountable owner.
EU AI Act
Deployer obligations- Expects
- Logging, human oversight, documented risk management, and transparency about AI in use.
- Bairav operationalizes it as
- An append-only action ledger, approval gates that pause high-impact actions for a named reviewer, and a registry that includes bring-your-own and embedded agents.
ISO/IEC 42001
AI management system- Expects
- Named accountability, documented operational controls, and ongoing performance evaluation.
- Bairav operationalizes it as
- A required owner and department on every agent, policies as the documented control set, and continuous coverage, intervention and SLA tracking.
OWASP Agentic Top 10
Applied at classification- Expects
- Named agentic risks — goal-hijack, PII exposure, excessive agency — assessed per entity.
- Bairav operationalizes it as
- Findings marked on the agent's record at classification, visible to whoever signs off the approval.
Bairav's audit and control model is designed against NIST AI RMF, the EU AI Act, and ISO/IEC 42001 — a design claim, not an attestation. We don't claim SOC 2 or ISO 42001 certification, and neither should anyone who conflates the two.
Bring your auditor to the demo
The most useful session is the one where someone who will have to defend this asks the questions.