Compliance · seven frameworks
AI compliance, by framework
Quox is not certified or attested for any of these frameworks. It is the evidence layer underneath yours: it helps you produce and prove the records each framework asks for, to an auditor, offline.
Pick your framework
Seven frameworks, in plain words
Each page explains one framework for a first-timer, says honestly what it is (law, certifiable, attestation or voluntary), and shows where a witnessed record helps and where the work stays yours.
SOC 2 Type II
A licensed CPA firm gives an opinion on your controls. Not a certificate.
Trust Services Criteria · CC1 to CC9
ISO 27001:2022
An information security management system an accredited body can certify.
93 Annex A controls · SoA Builder
GDPR
The EU personal data law. Records, security and impact assessments.
Art. 30 and 32 · DPIA per Art. 35
HIPAA
The US health data law. There is no HIPAA certificate.
Security Rule 164.312 · 54-safeguard risk analysis
EU AI Act
Obligations on AI systems by risk tier, including logging and human oversight.
Reg. 2024/1689 · risk classifier included
ISO/IEC 42001:2023
The certifiable standard for running AI responsibly as a management system.
AI management system
NIST AI RMF 1.0
US guidance for managing AI risk. No certificate exists.
govern · map · measure · manage
The tooling and the evidence
What turns a record into something an auditor can use
The seven framework pages are free references. The Compliance Suite is the enterprise plugin that builds the reports, and the three tools below ship inside it.
Compliance Suite
Turns the witnessed record into auditor-ready reports across the seven frameworks, with a SoA and DPIA builder in the product.
The other side of the tableFor auditors
What an auditor can verify without a Quox account, offline, without taking your word for it.
In-product toolSoA Builder
Build the ISO 27001 Statement of Applicability: which controls apply, why, and what evidences each one.
In-product toolRisk classifier
Place an AI system in an EU AI Act risk tier and see which obligations follow.
In-product toolDPIA builder
Draft a GDPR Article 35 data protection impact assessment from what your agents actually do.
The honest line
What Quox is, and is not, in compliance
Quox is one layer of your programme. The examination, the certificate and the legal judgement all stay with the people who issue and own them.
Quox is
- The evidence layer underneath your programme: a witnessed, hash-chained record made as governed agents work.
- A way to produce the records each framework asks for, and to hand an auditor evidence they verify offline.
- Self-hosted, so the record of what your agents did lives on your servers, where you will be asked for it.
Quox is not
- Certified, attested or accredited for any of these frameworks, and never a replacement for the body that is.
- A guarantee of compliance. Most controls in every framework are people, process and policy, and stay yours.
- Legal advice. Your counsel, your auditor and your regulator decide what applies to you.
Retention is the question every framework leaves partly to you. Our guide to how long to keep AI agent logs walks through how to choose. The EU AI Act page and the HIPAA page cover the two laws here with their own record-keeping rules.
Questions people actually ask
Compliance: the FAQ
Is Quox certified for SOC 2, ISO 27001 or ISO 42001?
No. Quox holds no certificate or attestation for any framework on this page. Those come from an accredited certification body or a CPA firm, never from a tool. Quox is the evidence layer that helps you produce and prove the records they examine.
Which framework should I start with?
Start with the one a customer, a contract or a regulator is already asking you for. Law (GDPR, HIPAA, the EU AI Act) applies whether or not you choose it. SOC 2 and ISO 27001 are usually what buyers ask for. ISO 42001 and the NIST AI RMF are AI-specific and fit alongside them.
Are the framework pages free?
Yes. The seven framework pages are free references, written for a first-timer. The Compliance Suite, which builds the reports and ships the SoA, risk classifier and DPIA tools, is the enterprise plugin.
Self-hosted · free · governed
Start with the record, then pick the framework
Every framework asks for evidence that exists on the days an auditor might look. Record continuously from day one, and the framework you pick next is easier.