Compliance · conformance · certification

From runtime decision to framework control — one rail.

Auditors spend weeks digging through logs. KYE™ exports signed proof in minutes. Fetch a URL, verify offline, map to your controls — 266 mappings across 164 frameworks, automated. The KYE Compliance Mapping Rail™ binds every runtime control to the obligation it satisfies; the 5-tier KYE Conformant™ / KYE Certified™ badge ladder makes the claim public.

rule Frameworks science 133 fixtures verified Try the Viewer stairs L1–L5 ladder workspace_premium 5-tier ladder
Out-of-the-box coverage · live

164 frameworks, six categories, bijection-checked.

Every framework below has a per-requirement bijection map to the KYE™ runtime artefacts that enforce it. Pages regenerate from coverage-registry.json — the registry is the source of truth, the badge grid is the index.

SecuritySOC 2 SecurityISO 27001 SecurityNIST 800-207 SecurityNIST CSF SecurityFedRAMP SecurityNIS2 FinServPCI DSS FinServPSD2 / PSD3 FinServDORA AI GovEU AI Act AI GovISO 42001 AI GovNIST AI RMF AI GovUK AI AI GovUK AI Assurance DataGDPR / UK GDPR HealthcareHAARF v1.0 HealthcareMHRA MDR 2002 HealthcareMHRA PMS 2025 HealthcareMHRA SaMD & AI

Click any badge for the per-requirement bijection map. Coverage refreshes from the registry on every deploy — live dashboard →

Compliance frameworks

From AI governance to sector-grade authority control.

KYE Protocol™ provides a protocol-level evidence layer for regulated AI and automation. Use KYE Compliance Mapping Rail™ profiles to bind runtime controls and signed evidence packs to the specific obligations every framework imposes. KYE™ does not replace these frameworks — it produces the evidence they consume.

EU AI Act

KYE EU AI Act Profile™

Maps KYE™ entity, authority, capability, state, human oversight, and audit controls to EU AI Act obligations (Art. 9–18, 26, 50, 72, 73, 79).

  • KYE-EUAIACT-001 Entity accountability mapping
  • KYE-EUAIACT-002 AI system & AI agent registry
  • KYE-EUAIACT-003 Capability manifest + risk classification
  • KYE-EUAIACT-004 Human oversight decision gates
  • KYE-EUAIACT-005 Runtime authority decision logs
  • KYE-EUAIACT-006 Technical documentation evidence pack
  • KYE-EUAIACT-007 Corrective action & revocation trail
  • KYE-EUAIACT-008 Provider / deployer / operator role mapping
  • KYE-EUAIACT-009 High-risk workflow profile
  • KYE-EUAIACT-010 Post-market monitoring evidence hooks
Horizontal frameworks

10 horizontal frameworks. One evidence model.

  • ISO/IEC 42001 — AI management system inventory, responsibility mapping, risk/impact, lifecycle controls, oversight logs.
  • NIST AI RMF — Govern / Map / Measure / Manage evidence around actors, risks, controls, decisions, lifecycle.
  • ISO 27001:2022 — Access control, asset/entity inventory, privileged access, logging, incident evidence.
  • SOC 2 — Security, availability, confidentiality, change management, access reviews, audit evidence.
  • GDPR / UK GDPR — Role mapping, lawful authority trail, data access, automated decision governance, audit.
  • DORA — ICT third-party authority, operational resilience, incident response, auditability.
  • NIS2 — Cybersecurity governance, incident traceability, supply-chain controls, access authority.
  • PCI DSS 4.0 — Payment capability restrictions, credential state, wallet/payment authority, audit logs.
  • HIPAA — Healthcare entity access, minimum-necessary, emergency/break-glass, audit trails.
  • NIST 800-207 — Zero-Trust Architecture: identity, device, network, application, data telemetry.

All ten exposed via the KYE Compliance Mapping Rail™ schema (schemas/compliance-mapping.json) — one document binds a control to the KYE™ runtime events that produce its evidence.

KYE™ produces evidence; certifications remain the customer’s. KYE™ does not replace legal counsel, regulatory filings, conformity assessments, or notified-body involvement.

Conformance & Certification

Trust, but verify.

KYE™ implementations can be tested against open conformance suites and verified through the public KYE™ Certification Registry. Earn badges that prove protocol alignment across entity authority, state, delegation, decisions, audit trails, and evidence packs — with annual renewal, signed records, and public-key verification.

KYE Self-Tested™

Run the open conformance pack locally.

Free, vendor-published. Backed by a passing run of conformance-run.json.

KYE Self-Attested™

Sign + publish a declaration of conformance.

Self-audit + signed self-attestation.json. Quarterly renewal. Not equivalent to certified.

KYE Conformant™

Program-verified test run.

Variants: Core / Authority / Capability / Evidence / Recovery / Payments / Healthcare / EU AI Act. Annual renewal.

KYE Certified™

Reviewed by KYE™ program + listed in registry.

Signed certification-record.json · public verification URL · revocation tracking · 12-month renewal.

Govern the governance layer. KYE™ Self-Audit & Attestation Profile™ lets implementations continuously verify their own engines, decisions, audit trails, and Evidence Packs™. Five checks: Engine Health, Decision Replay, Audit-Trail Integrity, Evidence Completeness, Policy Coverage.

Conformance maturity ladder

Five rungs, contiguous — from schema-valid to reality-coupled.

The KYE™ Conformance Maturity Levels (L1–L5) are the procurement-facing depth gradient that sits on top of the binary KYE Conformance Pack™. The pack answers “does the fixed fixture set pass?”; the ladder answers “how deep does enforcement reach at this deployment?” The rungs are contiguous — a deployment claims a level only when every capability of that level and every level below it is satisfied. No level-skipping.

L1 · Schema-valid
L1
Every emitted artefact validates against its locked KYE™ schema and every identifier conforms to the KYE™ ID format.
L2 · Entity + delegation captured
L2
Entity resolution and the full delegation chain are recorded in the evidence layer, not reconstructed later.
L3 · Admissibility enforced
L3
Action Admissibility™ is gated at runtime before the action runs — fail-closed when the decision point is unreachable.
L4 · Finality replayable
L4
Authority Finality™ and the Replay-Proof™ are HSM-signed and derivable from the published public keys alone — banking-grade.
L5 · Reality-coupling + contestability + revocation
L5
Full cascading revocation, delegated auditability + contestability surfaces, and reality-coupling drift wired into runtime effect.

L4 is the rung a Tier-1 bank’s GRC team asks for first: signed, sealed finality whose proof recomputes from public keys with zero trust in the runtime that produced it.

Try it live

Verify a sample evidence pack in your browser.

Below is the Evidence Pack™ Viewer that ships at widgets.html. Verify the signature offline, replay the bound decision, walk the audit chain, project to SOC 2 / ISO 27001 / EU AI Act / PSD3 / DORA. No signup, no install.

Trust & assurance

Built to be handed to your audit team on day one.

Open spec. Reference implementation. Conformance fixture pack. Cryptographic proof bundles. Nine-framework control mapping. RFC 7807 error envelope. Quantitative SLA tiers. The artefacts a Tier-1 bank’s GRC team needs are in the repo, not in a sales deck.

Endpoints
87
Routed in the reference Gateway. Every state-changing endpoint accepts Idempotency-Key and emits an audit event with a shared correlation_id.
Profiles · normative
15
Core, Gateway, Federation, Credentials, Attestation, Signals, Transparency, Conformance, Treasury, Custody, Healthcare, Telemetry, Capability, Recovery, Payments — plus 3 payment overlays.
Conformance fixtures
37
Each fixture is a deterministic black-box test the auditor replays against any conformant Gateway. conformance-report.json emits machine-readable evidence.
Control mappings
266
SOC 2 · ISO 27001:2022 · PCI DSS 4.0 · PSD2/PSD3 · DORA · NIS2 · EU AI Act · NIST 800-207 · HIPAA. Each row cites the KYE™ artefact + the Gateway endpoint that produces it.
SLA tiers
3
Tier-1 Bank (p99 ≤ 50 ms, 1k rps), Tier-2 Mid-market, Tier-3 Reference. Quantitative claims backed by signed conformance reports.
Tests · all green
220+
KYE Reference Gateway™ · ePDP · PEP · TS / Python / Go SDKs · webhook vectors · schema validations · 22 OPA Rego + Cerbos policy fixtures at parity.
Mapped to SOC 2 · ISO 27001:2022 · PCI DSS 4.0 · PSD2/PSD3 · DORA · NIS2 · EU AI Act · NIST 800-207 · HIPAA

KYE™ produces evidence; certifications are the customer’s. The repo ships a complete control-mapping document. For each KYE™ artefact (entity record, delegation, scope, credential, attestation, audit event, proof bundle, signal, transparency receipt, capability grant, recovery proof, break-glass grant, compromise report, state transition) it lists which control is satisfied and the exact endpoint to extract it.

Banking-grade

Production posture

  • Append-only audit chain with point-in-time replay (POST /v1/audit/point-in-time)
  • Ed25519-signed proof bundles — verifiable with public keys alone
  • Cascading stop signals (entity → delegations → payment authorities → access rights → capability grants — in milliseconds)
  • Break-glass authority with mandatory post-hoc review and time-cap
  • Key rotation gated by break-glass grant (POST /v1/keys:rotate)
  • Idempotency keys + signed webhooks + replay window + dead-letter
  • Fail-closed PEP for high-risk actions on PDP unreachable
  • Reference Rego sPDPs (22/22 passing)
Open governance

What ships open

  • Vocabulary, ID format, schemas, OpenAPI — Apache 2.0
  • KYE Reference Gateway™, three SDKs, conformance fixtures — Apache 2.0
  • Reason-codes registry, control mappings, threat model — in the repo
  • Proprietary mechanisms are separate — the open contract is and will remain royalty-free for any conformant implementation
  • Trademark policy lets you say “KYE Protocol™-compatible” once you pass the conformance pack
  • Discussions repo for RFCs, profile proposals, integration patterns

Ready to see your AI agents flagged?

Start in shadow mode. We’ll deliver your first Evidence Pack™ in 4–8 weeks.

rocket_launch Apply for pilot → science Try the sandbox →