> ## Documentation Index
> Fetch the complete documentation index at: https://docs.flowx.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Compliance

> EU AI Act, NIST AI RMF, and ISO 42001 mapped to your runtime — controls evaluated continuously, gaps surfaced automatically.

Compliance turns governance work into framework-specific status you can put in front of an auditor. Each framework's requirements are pre-mapped to Observatory controls; the controls evaluate continuously against your telemetry, evidence, and assessments.

***

## Frameworks covered

> [card] [EU AI Act](https://docs.flowx.ai/6.x/observatory/compliance/eu-ai-act.md)
>
> 18 requirements mapped, with scope by risk tier (minimal / limited / high).

> [card] [NIST AI RMF](https://docs.flowx.ai/6.x/observatory/compliance/nist-ai-rmf.md)
>
> 16 requirements across Govern, Map, Measure, Manage.

> [card] [ISO 42001](https://docs.flowx.ai/6.x/observatory/compliance/iso-42001.md)
>
> 12 requirements for AI management systems.

> [card] [Gap analysis & heatmap](https://docs.flowx.ai/6.x/observatory/compliance/gap-analysis-heatmap.md)
>
> Cross-framework view with prioritised remediation.

***

## How a control becomes a status

```mermaid theme={"dark"}
flowchart LR
    Framework[Framework requirement] --> Controls[Mapped Observatory controls]
    Controls --> Inputs{Inputs}
    Inputs --> Telemetry[Telemetry]
    Inputs --> Policy[Policy evaluations]
    Inputs --> Evidence[Approved evidence]
    Inputs --> Assessment[Assessment answers]
    Telemetry & Policy & Evidence & Assessment --> Status[Per-control status]
    Status --> Roll[Framework score]
```

Each requirement maps to one or more controls. Each control draws on the same operational inputs (telemetry, policies, evidence, assessments). Status is one of:

* **Met** — sufficient approved evidence within freshness window
* **Partial** — some evidence but gaps remain
* **Gap** — no current evidence
* **Out of scope** — risk tier doesn't trigger this requirement

***

## When to use the compliance views

| Audience | Page |
| - | - |
| Auditor preparing a review | The framework page they care about + the heatmap export |
| GRC team planning sprints | Gap analysis sorted by severity |
| Security team checking posture | Heatmap, scoped by risk tier |
| Engineering team during a release | Requirement detail for the one control that flipped to Gap |

***

## Cross-framework mapping

Many requirements overlap. Observatory's mapping engine recognises this — closing a gap in one framework often resolves a gap in another:

* EU AI Act Article 9 (risk management) overlaps with NIST RMF Govern-1.1 and ISO 42001 6.1.
* EU AI Act Article 12 (record-keeping) overlaps with NIST RMF Map-3.3 and ISO 42001 8.5.

The heatmap shows these overlaps; the gap analysis prioritises remediation by impact across frameworks.

***

## Related resources

> [card] [Evidence](https://docs.flowx.ai/6.x/observatory/governance/evidence.md)
>
> Where the artefacts that satisfy controls live.

> [card] [AI Registry](https://docs.flowx.ai/6.x/observatory/governance/ai-registry.md)
>
> Risk tier in the registry determines which requirements apply.


## Related topics

- [Compliance ROI](https://docs.flowx.ai/6.x/observatory/roi/compliance-roi.md)
- [Knowledge Base integration](https://docs.flowx.ai/6.x/docs/platform-deep-dive/integrations/knowledge-base-integration/knowledge-base-overview.md)
- [FlowX.AI 5.1.1 Release Notes (LTS)](https://docs.flowx.ai/release-notes/v5.x/v5.1.x-lts/v5.1.1-november-2025.md)
- [Policies](https://docs.flowx.ai/6.x/observatory/governance/policies.md)
- [FlowX.AI Data Search](https://docs.flowx.ai/6.x/docs/platform-deep-dive/core-extensions/search-data-service.md)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.