Which policy enforces this control?
The Compliance Center maps every framework control to the Raidu policy that enforces it, across EU AI Act, HIPAA, NIST AI RMF, and other frameworks.
Solutions · Compliance and Risk
Where is the evidence for this control?
It is already written down. Framework controls mapped to live Raidu policies, with tamper-evident records linked per control.
Runs inside your AWS, GCP or Kubernetes install.
Last reviewed
Illustrative. No customer data.
The difference
Their way, and ours.
Their wayRaidu
A spreadsheet filled in the week before the audit.Controls mapped to running policies.
Evidence gathered on request.Evidence written as decisions happen, linked per control.
Aligned with the framework.Control, policy, record, for each line.
What you get asked
And the record that answers it.
Where is the proof?
Each control links directly to the tamper-evident records that prove it ran. Records are SHA-256 hashed, linked so any change shows, and stored write-once. An export is available per control or per framework.
What changes on 2 December 2027?
Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744, requires high-risk AI systems to record their own events from 2 December 2027 (Annex III). Every call through Tower is already written to a tamper-evident record, linked so any change shows.
Products
What covers this.
The product
See the screens.
Product windows from the films, with sample data. No customer data.
The record
The control, and its evidence.
Every framework control links to the policy that enforces it and the records that prove it ran, tamper-evident and ready for export.
- Control
- Art. 12 transparency and logging
- Mapped policy
- TRANSPARENCY-001
- Evidence
- 3 records linked
- Required from
- 2 December 2027
- Export
- Export ready
sha256 fb7c62ba1eb42233a2a0ed290efaa67e…
recomputed in your browser
published with the recordfb7c62ba1eb42233a2a0ed29…
Hash matches
The clock
The dates that apply.
1 January 2027
Colorado AI Act (SB 26-189) becomes operative. High-risk AI systems must meet its transparency and audit requirements.
Colorado SB 26-189
13 May 2027
Full DPDP obligations commence. Penalties up to ₹250 crore per instance under India's Digital Personal Data Protection Act.
DPDP Gazette G.S.R. 843(E) to 846(E)
2 December 2027
EU AI Act (Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744) requires high-risk AI systems to record their own events. Every call through Tower already meets this requirement.
Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744, Annex III
Common questions
Answered straight.
Which frameworks does this help with?
Raidu keeps the decision records that AI and data rules such as the EU AI Act, NIST AI RMF and India’s DPDP Act ask organisations to produce. Raidu’s own assurance is a SOC 2 Type II report (Security, Availability and Confidentiality), ISO/IEC 27001:2022 certification for the ISMS of the Tower platform and supporting cloud infrastructure, and independent assessments as HIPAA compliant and GDPR compliant.
Is the control coverage real or illustrative?
Every control is mapped to at least one Raidu policy. Evidence for technical controls is collected automatically. Evidence for process controls (policies, plans, and reviews) is uploaded and kept on the same record. Both types are linked per requirement, not per framework.
How do we export evidence for an audit?
From the Compliance Center, pick a control or a framework and export a tamper-evident package. Records are linked so any change shows, and the export is ready for an auditor to review.
What is SR 26-2?
SR 26-2 is the Federal Reserve’s model risk guidance, which superseded SR 11-7 on 17 April 2026. It leaves generative and agentic AI outside its model risk scope but expects banks’ own governance to cover them; Raidu keeps the record that governance relies on.
Does the framework coverage include AI agents?
Yes. Requirements across domains including data and privacy, security, safety, reliability, accountability and society are mapped to Raidu policies, with evidence linked per requirement.