AOCL Compliance Suite

Audit-ready compliance reports built from VOLT decision evidence.

Overview

The AOCL Compliance Suite is an enterprise plugin that transforms VOLT decision evidence into auditor-ready compliance reports. It maps agent actions, tool invocations, and decision traces to the controls and requirements of seven major compliance frameworks, and includes interactive auditor tools (SoA Builder, Risk Classifier, DPIA, Auditor Portal).

The suite builds on the free Decision Evidence plugin. Where Decision Evidence captures and stores raw traces, the Compliance Suite formats, correlates, and exports that data for regulatory audits.

Tier: Enterprise Price: $599/year (annual subscription). Enterprise plugins are annual subscriptions; there is no one-time perpetual licence.

Supported Frameworks

The Compliance Suite generates reports for seven compliance frameworks:

SOC 2

Maps agent decision traces to Trust Services Criteria (TSC). Evidence bundles include:

• Processing integrity controls showing how agent outputs were verified
• Availability metrics for agent response times and uptime
• Confidentiality controls demonstrating data handling policies
• Change management records from agent version updates

HIPAA

Generates Security Rule documentation with:

• Access control records showing which agents accessed what data
• Audit trail completeness reports
• Transmission security evidence for data in transit
• Person or entity authentication records

GDPR

Produces Article 30 processing records including:

• Records of processing activities performed by AI agents
• Data subject access request (DSAR) response trails
• Consent and lawful basis documentation
• Data retention and deletion records

ISO 27001

Maps to Annex A controls with:

• Information security policy compliance evidence
• Asset management records for AI agent deployments
• Access control documentation
• Operations security monitoring data

EU AI Act

Addresses high-risk AI system requirements:

• Risk classification decision tree (free — Art.6/Art.5 classifier)
• Operator matrix — Provider/Deployer/Distributor/Importer obligations
• GPAI obligations — Art.52-56 (including 10²⁵ FLOPs systemic-risk threshold)
• Universal obligations — Art.4 AI literacy, Art.50 transparency
• QMS requirements — Art.17 (13 mandatory elements)
• Classification memo template (10-year retention per Art.18)
• Transparency records, human oversight, risk assessment
• Technical documentation (Article 11)

ISO/IEC 42001:2023

AI Management System — the first international standard for AI governance:

• 20 controls covering Clauses 4-10 (Context, Leadership, Planning, Support, Operation, Evaluation, Improvement)
• AI System Lifecycle Record (ASL) guidance
• Operational controls (Clause 8) auto-detected from AOCL L3/L7 evidence
• Monitoring (Clause 9) auto-detected from VOLT hash chain integrity + L8 verification

NIST AI RMF 1.0

Voluntary US framework for AI risk management:

• 22 controls across 4 functions: Govern, Map, Measure, Manage
• Measure function auto-populates from VOLT runs + L8 verification + chain integrity
• Manage function auto-populates from HITL events + incident envelopes
• Accepts ai_system_profile input for Map function
• Cross-reference mappings to EU AI Act, ISO 42001, SOC 2

Interactive Auditor Tools

Beyond formatters, the Compliance Suite includes hands-on tools for day-to-day compliance work:

• SoA Builder — Interactive Statement of Applicability for all 93 ISO 27001:2022 Annex A controls. Tri-state applicability (Applicable / N/A / Inherited), auto-detection for A.8 Technological Controls, bulk operations, export as JSON/CSV.
• EU AI Act Risk Classifier (FREE) — Guided decision tree for EU AI Act risk classification. Prohibited → High-Risk (Annex I/III) → GPAI → Limited → Minimal. Produces a classification memo with decision path.
• DPIA Form — GDPR Article 35 Data Protection Impact Assessment. 6 mandatory sections, interactive 5×5 risk matrix, lifecycle (Draft → DPO Review → Approved).
• Evidence Explorer v2 — Dual-pane control-anchored evidence navigator. Select any control → trace every piece of evidence from AEE envelope to VOLT hash to WARD receipt.
• PDF Report Engine — Auditor-grade reports with 3 redaction levels (internal / external / public). HTML + Markdown export.
• Auditor Portal — Time-bounded read-only workspace for external auditors. PBC auto-match against 30+ evidence keywords. Pre-populated working paper templates.
• HIPAA Risk Analysis — 54 safeguards (Administrative, Physical, Technical, Organisational) with Required/Addressable tracking, 5×5 likelihood/impact matrix.
• Compliance Monitor — Real-time posture, drift detection, cross-framework gap heatmap.
• Compliance Glossary — 25 searchable compliance terms (SoA, DPIA, PBC, CUEC, HITL, etc.) with Quox-specific context.

Evidence Mapping

The Compliance Suite maps VOLT events to framework controls automatically. Each VOLT trace contains:

• The originating agent and its configuration at execution time
• Tool invocations with input parameters and outputs
• Decision points where the agent chose between options
• Timing data for each step in the trace
• Policy evaluations that were applied

The evidence mapper analyses these traces and tags each relevant data point with the corresponding control identifiers from the target framework. A single trace may satisfy controls across multiple frameworks simultaneously.

Features

Compliance Export

Export complete audit trails in any supported format. Each export produces a structured document with:

• Executive summary
• Detailed findings mapped to specific controls
• Evidence samples with trace references
• Gap analysis identifying controls without sufficient evidence
• Remediation recommendations for identified gaps

The free tier supports JSON export only. The enterprise tier adds all five framework formats plus custom export templates.

Trace Replay

Re-execute any historical trace with modifications. Use cases include:

• Debugging production issues — replay a failing trace to identify the root cause
• Policy testing — replay a trace with modified policies to verify new rules work correctly
• What-if analysis — change input parameters and observe how agent behaviour differs

Replay preserves the original trace for comparison. Maximum replay retention is 90 days.

Trace Comparison

Side-by-side comparison of two or more traces. The comparison view highlights:

• Timing deltas between corresponding steps
• Decision differences where agents chose different paths
• Content changes in tool outputs
• Policy evaluation differences

This is particularly useful for comparing agent behaviour across software versions or after policy changes.

Multi-Agent Correlation

Track handoffs across multi-agent workflows. The correlation engine:

• Links traces that share a conversation or objective ID
• Generates swimlane visualisations showing the journey across all participating agents
• Identifies bottlenecks where handoffs introduced delays
• Maps the complete decision chain from initial request to final output

Scheduled Compliance Jobs

Automatically generate compliance reports on a schedule. Supports weekly, monthly, or custom intervals. Up to 10 scheduled jobs can run concurrently.

Each scheduled job specifies:

• Target framework
• Date range for evidence collection
• Output format and destination
• Notification recipients

Evidence Bundles

Download complete evidence packages for auditors. Each bundle includes:

• Trace samples (up to 100 per bundle)
• Policy decision records
• Verification results
• A manifest listing all included evidence with checksums

Compliance Dashboard

Real-time compliance posture visibility showing:

• Coverage percentage per framework (how many controls have sufficient evidence)
• Gap trends over time
• Recent compliance events
• Upcoming scheduled report dates

Free vs Enterprise

Configuration

The Compliance Suite integrates with four backend services:

Requirements

• QuoxCORE 1.0.0 or later
• QuoxAgent 1.0.0 or later
• AOCL Core 1.0.0 or later
• Active enterprise licence

Activation

Activate through the QuoxCORE plugin settings page. The licence is validated against the QuoxAgent instance. Once activated, all Compliance Suite features appear in the Decision Evidence view.

Report Formatters

Each compliance framework has a dedicated formatter that understands the structure and language of its target standard:

• SOC 2 formatter — outputs Trust Services Criteria mappings, scope statement, management attestation template, Type I/II guidance
• HIPAA formatter — produces Security Rule section references, BAA assessment, addressable-vs-required guidance
• GDPR formatter — generates Article 30 record format, Art.15-21 data subject rights, Art.28 processor assessment, ROPA guidance, 6 legal bases
• ISO 27001 formatter — maps to Annex A control numbers (93 controls, 2022 revision)
• EU AI Act formatter — operator matrix, GPAI obligations (Art.52-56), universal obligations, QMS (Art.17), classification memo, Article 11 technical documentation
• ISO 42001 formatter — AI Management System (Clauses 4-10), AI System Lifecycle Record guidance
• NIST AI RMF formatter — 4 functions (Govern/Map/Measure/Manage), AI system profile, cross-framework mappings

All formatters produce both human-readable reports and machine-parseable structured data.

See Also

• Decision Evidence — Free plugin for capturing decision traces
• VOLT Protocol — The verifiable operations ledger that supplies evidence data
• AOCL System — Agent Orchestration Control Layers architecture
• Safety & Security — QuoxCORE security model