The rules keep moving, the frameworks overlap, and proving what your AI actually did lands on people who already have a day job. Brutor answers from the one place the AI actually runs, the request path: every decision the gateway makes is sealed as signed evidence, each AI System’s obligations are worked out from what you declare about it, and the evidence exports in a form your auditor can check without trusting us.
This is the Compliance console on a live system: the Brutor Demo System, a loan pre-screening agent that is high risk under the EU AI Act, and the fraud-screening agent it depends on. Pick a framework at the top and every page shows that framework’s view of the same sealed evidence.
GDPR, HIPAA, SOC 2, DORA, NIS2 and most sector rules were written before AI, but cover it too. Your existing obligations simply acquired a new surface: every prompt, every tool call, every agent action.
same obligations, new surfaceThe EU AI Act, ISO/IEC 42001, the NIST AI RMF, Colorado’s AI Act. Depending on your role and risk tier: classify each AI System, keep automatic logs, keep a human in the loop, tell people they are talking to an AI.
new obligations, a new unit of accountThe second kind changes what you account for: the unit is no longer the model or the app but the AI System, with an owner, a purpose, a risk tier and a role. In Brutor it is a real object, which is why the same registry answers “what AI are we running?”, “who is accountable for it?” and “which rules apply to it, from when?”.
The frameworks word it differently, but they keep asking an AI System the same three questions: what did it do, who was in the loop, and can you prove the record is honest? So Brutor builds one evidence substrate on published standards, and reads every framework from it. Adding a jurisdiction is a catalog entry, not a new product.
Enable the frameworks you are audited against, then give each AI System its compliance profile: who operates it, where, what data it touches, whether it talks to people or decides about them, and the facts each framework needs, such as the EU AI Act risk tier and your role. Every save is sealed as a declaration, so “what did you say this system was, and when?” has an answer.
Eleven frameworks, honestly labeled. The EU AI Act, ISO/IEC 42001, SOC 2, HIPAA and GDPR catalogs are checked against the published instruments. DORA, NIS2, the NIST AI RMF, Colorado, Korea and Brazil are there too, flagged in amber until they are, with a note to verify before relying on them. Each carries its retention floor and its incident deadlines.
Risk travels along dependencies. The demo’s fraud screener is declared minimal risk on its own. It contributes to a credit decision, so it is evaluated at high, the tier of the system that depends on it, and the console says why.
Each time the gateway decides (a tool call executed, a model call blocked by a guardrail, an action held for a human, a run stopped), it writes a sealed action record: canonical JSON, signed with standard COSE, naming the AI System, the contract version in force, the verdict and the effect. A log that only keeps successes cannot prove its gates ever fired, so refusals are sealed too.
Nothing personal enters the record. No user id, no API key, no session, no secrets, no health data: content appears only as digests. That one rule is what keeps the evidence erasable under GDPR and safe under HIPAA.
Framework tags ride along. The compliance tags you already use (such as eu_ai_act.high or a SOC 2 criterion) are stamped on the record as it is written, so each framework’s view filters the same log.
A signature proves who signed a record. It does not prove the signer kept every record, or did not quietly rewrite history. So every record is appended to one append-only Merkle log per tenant, the same structure Certificate Transparency uses, and its checkpoints are registered with independent witnesses.
Built on published standards, not a vendor format. RFC 8785, COSE (RFC 9052), SCITT (RFC 9943) and its receipts (RFC 9942), RFC 6962 logs and RFC 3161 timestamps. An auditor can check integrity with any COSE or SCITT library, the brutor-verify command line tool, or a verifier page that runs in the browser.
Grades never go up. A checkpoint is standalone until an independently operated witness countersigns it. A witness you run yourself makes it self-witnessed, never witnessed, which is exactly what the demo shows. Portable evidence bundles package the records, their proofs and receipts for a regulator, and list what is missing rather than leaving it out.
Brutor works out each system’s obligations from its declared profile, dated against the instrument, and shows each obligation against evidence statements: “every governed action produced a sealed record, 57 of 60”, never a rounded percentage. Each statement names its basis and states its own limit, what it does not show.
Four bases, never blended. Recomputed from the log, the ledger and the configuration. Judged by a governed model over a disclosed sample, with human agreement stated beside it. Indicator: movement worth a look, never a threshold. Declared: an operator statement, sealed but never counted as met. Missing inputs read not evaluable or undetermined, never met.
On every AI System, too. Each system’s own page has a Compliance tab: its sealed declaration, which obligations apply today and which arrive when, and how many sealed records stand behind them.
Two obligations every AI regulation shares: a person must be able to oversee the system, and people must know when they are dealing with an AI. Brutor records both as evidence, not as a checkbox.
Oversight, measured. Who is assigned, whether they can stop a run and suspend the system, and how many held decisions a human actually decided. The demo reads 17 of 300: not met, because most held loan decisions expired with nobody deciding. That is the finding a regulator would want to see, so the console shows it. Judged checks go through a blind review queue, with the model’s answer hidden until a person has graded it.
Transparency, sealed. The User Portal shows an AI-interaction notice before the first turn, in eight languages, and seals a record each time it does. Content-level marking such as watermarking is not provided; generated output carries an X-Brutor-AI-Generated header, and the console says so.
Daily rollups, weekly grades and monthly Evidence Reports per framework and per system, each sealed, bundled and computed under a named catalog version. Hand one over and it can be checked offline, by anyone.
Incidents, with their clocks. Open an incident and Brutor computes each framework’s reporting deadline for its classification (the EU AI Act’s 15, 10 and 2 days, GDPR’s 72 hours, DORA’s 4 hours, 72 hours and 30 days) and shows them as they approach. Deadlines are shown, not enforced, and every change is sealed.
And for the people running it, each AI System also gets an assurance report for management: whether it stayed inside the bounds its approvers signed. See how agents are assured.
The evidence is only as good as the controls it records. Every one of them runs in the request path, on every routed call, scoped per team and per AI System.
Access per team, app and agent, with every agent carrying its own identity rather than a shared key.
Guardrails for PII, secrets, prompt injection and toxic content, in both directions, blocked or redacted.
Argument, semantic and agent policies that read what a call would actually do, and hold it for a human where you say so.
A residency profile checked before a model or tool is reached, with every refusal and its reason on the record.
Never “compliant”. Nothing Brutor produces says compliant, certified, guaranteed or tamper-proof. It says sealed, witnessed, recomputed, met (n of m), not met, not evaluable, declared. And none of it is legal advice.
What a gateway cannot observe, it does not claim. Risk management, quality management, conformity assessment and CE marking are organizational duties; Brutor evidences them by pointer and declaration only. Integrity is not completeness: a record proves an action it covers was not altered, never that there was no action it does not cover.
Traffic routed through the gateway only. AI used outside it (Copilot seats, ChatGPT, a vendor’s built-in AI) appears in the AI Asset Registry as observed, inventoried and costed, clearly marked. Every asset you bring behind the gateway converts from policy-and-vendor-trust into enforced and evidenced.
Read next: Built-in compliance: why it does not have to slow you down, and how Brutor assures each AI agent day to day.
