Solutions
Find it by instrument, or by the industry you are in.
Four instruments are scored clause by clause today. The rest are evidenced rather than scored, and each page says which it is and what a deployment produces either way — because a readiness percentage against an instrument nobody encoded is a number with no denominator. A clause map is data, so any of them can be authored without waiting for a release.
Instruments we map clause by clause
DIFC Regulation 10
Every other instrument here was written for models or for processing in general, and agents were fitted to it afterwards. This one was written for autonomous systems, and it reaches the e...
clause map →EU AI Act
Regulation (EU) 2024/1689. Fourteen clauses mapped, scored only over the obligations that currently apply, with the ones deferred to December 2027 stated beside the number rather than fol...
clause map →GDPR
Regulation (EU) 2016/679. Eleven clauses mapped, including Art. 32(1)(d) — regularly testing the effectiveness of technical measures — which is the one almost nothing evidences because it...
clause map →NIST AI RMF
AI Risk Management Framework 1.0. Voluntary, which is exactly why the evidence matters: nobody is compelled to produce it, so producing it is a signal.
clause map →SR 11-7
Supervisory Guidance on Model Risk Management. Written in 2011 for models that produce numbers, and now read against systems that take actions — which is where the inventory question gets...
clause map →UK GDPR: automated decisions
On 5 February 2026 the Data (Use and Access) Act deleted Article 22 of the UK GDPR and replaced it with Articles 22A to 22D. The EU prohibits solely automated significant decisions and al...
clause map →Frameworks and guidance
Evidenced rather than scored, for two different reasons that are worth keeping apart. MAS FEAT and the UK approach have nothing to enumerate — one asks a firm to define its own fairness objective, the other delegates to existing regulators rather than creating a statute. DORA and ISO 42001 have numbered articles and controls, and a map for either is authoring work rather than engineering. Each page says which of the two it is, and what the platform contributes today.
Canada AIDA
The Artificial Intelligence and Data Act was part of Bill C-27, which died on the Order Paper when Parliament was prorogued in January 2025. So the obligations a Canadian agent estate act...
read →DORA
Regulation (EU) 2022/2554, in force since January 2025. An operational resilience regulation rather than an AI one, which is why it reaches agents at all: an agent's tools are ICT third p...
read →ISO/IEC 42001
The AI management system standard. Certifiable, which makes it the one buyers ask about most and the one where vendor claims are loosest — because a management system is a set of organisa...
read →MAS FEAT
Fairness, Ethics, Accountability and Transparency. Principles-based by design — a firm defines and justifies its own fairness objective — so the evidence that answers it is the justificat...
read →UK AI framework
The pro-innovation approach delegates AI to existing regulators — the FCA, the ICO, the MHRA — rather than creating a cross-cutting statute. So the binding obligations come from the secto...
read →By sector
Nine industries — eight regulated, and one that is not. Each page asks the same four questions in that sector's own vocabulary: the agents its teams are about to ship, the one gate that holds each of them, what its supervisor asks in writing, and which identifiers a deployment there actually verifies. The skeleton is shared on purpose — a buyer comparing their industry with the one next door should find the same questions answered, not nine brochures of differing confidence.
Software and AI-native platforms sits in this list on purpose. Nothing legally compels a platform company to govern its agents, and it is the audience shipping them fastest, into the most accounts, with the furthest reach. The obligation arrives through a customer's security questionnaire rather than through a statute — earlier, in practice, than most of the regulated deadlines on this page.
Capital markets
A trade is the rare action that cannot be undone by apologising. Front-office automation has always been governed by pre-trade limits; what has changed is that the thing hitting the limit...
read →Energy and utilities
Every other sector on this list can unwind a bad decision with a credit note. Here the action is physical, it is immediate, and the review afterwards is conducted by people who will ask w...
read →Financial services
The sector where an agent's actions move money, where three supervisors can have a view of the same workload, and where the question after an incident is not what the model scored but who...
read →Government
The sector that asks the outbound question first and does not accept a policy statement as the answer. Airgapped mode refuses to start if any setting selects a service outside your networ...
read →Healthcare
Clinical software has carried authorisation and audit for thirty years, and all of it assumes a person: a clinician signs, a pharmacist checks, a coder reviews. An agent works in the gaps...
read →Insurance
Claims is where multi-agent pipelines arrive first and where delegation gets dangerous quietly: an orchestrator hands work to a specialist, the specialist hands work onward, and nobody is...
read →Pharmaceuticals and life sciences
This sector has held the strictest record-keeping discipline in commercial software for thirty years, and every part of it assumes a person. An agent acting inside a GxP estate has to be ...
read →Software and AI-native platforms
Every other page here is written for somebody with a supervisor. This one is not. You are shipping agents into other people's accounts faster than any bank will this decade, at a scale no...
read →Telecommunications
Customer operations at volume, across markets, where the same workflow runs under several regimes and the retention window is set by whichever one applies to that subscriber.
read →An instrument we do not map is not an instrument we dismiss. Clause maps are YAML validated against the evidence registry at load, so a regulatory analyst can author one without a release. What we will not do is ship a page implying a mapping exists in order to appear in a search result.