Prove your AI is governed
Audit-ready reports in minutes, not weeks
UbiComply verifies your AI systems against ISO/IEC 42001, the NIST AI RMF and the EU AI Act from one shared control library, and seals the evidence behind every verdict. Anything uncertain goes to a person.
Weeks of chasing evidence: Minutes of verified proof
Manual audit preparation means spreadsheets, screenshots and sign-offs chased across a dozen places, then redone for every framework. UbiComply collects, verifies and seals the same evidence once, and keeps it current.
- ScatteredEvidence lives in inboxes, shared drives and people’s memory.
- VerifiedEach document and repository file is fingerprinted, mapped to a control in all three frameworks and given a verdict with its reasoning.
- ChainedEvery change joins a hash-chained audit log, so tampering shows.
- SealedAudit-ready reports for each framework in minutes. Re-verify an unchanged system in under a minute.
Scattered
Evidence lives in inboxes, shared drives and people’s memory.
Verified
Each document and repository file is fingerprinted, mapped to a control in all three frameworks and given a verdict with its reasoning.
Chained
Every change joins a hash-chained audit log, so tampering shows.
Sealed
Audit-ready reports for each framework in minutes. Re-verify an unchanged system in under a minute.
Illustration: scattered evidence files are verified, fingerprinted, chained and sealed into one audit-ready report.
What changes
Automation removes the busywork. Your experts still make the calls.
See a sealed report built from your evidence.Book a demo
| Area | Manual programme | With UbiComply |
|---|---|---|
| Evidence | Chased by email, tracked in spreadsheets | Pulled from your repositories, ML platforms, documents and tools as it arrives |
| Framework mapping | Redone by hand for each framework | One shared control library, native to all three frameworks |
| Verification | Sampled in interviews, varies by assessor | All 38 controls on every run, each verdict cited. Same inputs, same verdicts |
| Report assembly | Weeks of copy and paste per audit | Audit-ready reports for each framework, on demand, in minutes |
| Staying current | An annual scramble | Continuous monitoring, scheduled re-verification and drift alerts |
| Integrity | Files in shared drives | SHA-256 fingerprints and a hash-chained audit log |
What applies to your AI, and when
ISO/IEC 42001, the NIST AI RMF and the EU AI Act ask for the same practices: know your AI systems, assess their risks and impacts, keep the records, and keep a person in charge.
- NIST AI RMF 1.0 publishedNIST AI RMF
- ISO/IEC 42001 publishedISO/IEC 42001
- NIST Generative AI Profile (AI 600-1)NIST AI RMF
- EU AI Act enters into forceEU AI Act
- Prohibited practices and AI literacy applyEU AI Act
- General-purpose AI model obligations applyEU AI Act
- General application, including Article 50 transparencyEU AI Act
- Machine-readable marking for existing generative systemsEU AI Act
- High-risk systems under Annex IIIEU AI Act
- High-risk systems under Annex IEU AI Act
Select a date
It reaches beyond the EU
Covers any provider whose AI, or its output, is used in the EU.
Art. 2(1)
Records are kept 10 years
Report serious incidents in 15 days, or 2 days in the most severe cases.
Arts. 18, 73
Standards are converging
EN 18286, for the AI Act, maps to 42001 Annex A: work carries over.
EN 18286:2026 · not in the OJ, July 2026
US policy aligns
US federal agencies must oversee high-impact AI; NIST shows how.
OMB M-25-21 · NIST AI RMF, voluntary
EU dates follow Article 113 of Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744. Not legal advice.
From repository to sealed report, in five steps
No agent to install. Your team stays in charge of every decision.
Connect
Connect GitHub, GitLab or Bitbucket, your ML platforms and your ticketing tools, then upload policies, model cards and records. Documents in PDF, DOCX, XLSX, PPTX, HTML and CSV are read and matched to controls.
github.com/acme/credit-scoring
- model card
- weights (3)
- training scripts
- eval suite
- CI tests
Inventory
Record each AI system, model and dataset. Discovery pre-fills the record and suggests an EU AI Act risk class with its reasoning; your team confirms the class and sets the intended use.
credit-scoring
Scores consumer credit applications
- Minimal
- Transparency
- High-risk
- Prohibited
Annex III 5(b) · creditworthiness
Suggested by UbiComply · confirmed by your team
Verify
Every control in the shared library is checked against your code, documents and model evaluations. Each gets a verdict, a rationale and the evidence it relied on, and readiness updates for all three frameworks. Anything uncertain goes to a person.
Minutes- A.6.2.8Pass
- A.7.4Partial
- A.5.2Needs review
- A.9.2Pass
Govern
Treat risks, complete impact assessments and FRIAs, attest policies, pass lifecycle gates and close nonconformities. Every decision is written to the audit log.
Assigned to: risk manager
design → develop
awaiting sign-offReport
Generate each framework’s own reports: the Statement of Applicability, a NIST AI RMF profile, the Annex IV technical-documentation pack and more. Share them through a read-only portal for your auditor.
On demand · re-verify in under a minuteStatement of Applicability
Then it keeps watch. Systems are re-verified on the schedule you set, a regression raises a drift alert, and a serious incident starts its Art. 73 reporting clock.
Walk through it on your own repository
Book a demoThe record your auditor asks for
Reports for each framework, generated on demand from the record the engine verified, and a read-only portal your auditor opens without an account.
ISO/IEC 42001
- Internal Audit Report
- Risk Register
- Statement of Applicability
- ISO/IEC 42001 Audit Report
NIST AI RMF
- NIST AI RMF Profile
EU AI Act
- Post-Market Monitoring Plan
- Fundamental Rights Impact Assessment
- Annex IV Technical Documentation
- controls in one shared library
- 38
- checklist items
- 190
- frameworks, all native
- 3
- report types
- 10
- to re-verify an unchanged system
- Under 1 min
Integrity specification
What stands behind every report, and what your auditor can check for themselves.
- Evidence
- SHA-256 on every file. Uploads that do not match are rejected.
- Audit log
- Hash-chained per organisation and verified on demand.
- Runs
- Temperature 0, fixed seed, run manifest. Offline replay, byte for byte.
- Access
- Row-level security per organisation. Auditor access is read-only and logged.
Certification decisions rest with accredited certification bodies. UbiComply makes your evidence certification-ready.
Two plans: One standard of evidence
Both include the complete three-framework platform. Enterprise adds scale, control and a dedicated team.
Premium
The complete three-framework platform for a single organisation.
Best for teams putting AI governance into practice.
- ISO/IEC 42001, NIST AI RMF and EU AI Act, all native
- AI inventory across code, ML platforms and documents
- Automated verification and continuous monitoring
- Evidence vault with SHA-256 fingerprints
- Framework-specific reports, audit packages and the auditor portal
- Jira, ServiceNow, Slack, Microsoft Teams and webhooks
Enterprise
The same platform, with the scale, control and support a regulated group needs.
Best for groups, service providers and regulated teams.
Everything in Premium, plus
- SSO with SAML, and SCIM provisioning
- Custom frameworks and controls
- Multi-entity console across subsidiaries and clients
- Private cloud or self-hosted, with data residency options
- Bring your own LLM
- Dedicated onboarding and customer success
Annual subscription · tailored to your programme.
Compare every feature
| Feature | Premium | Enterprise |
|---|---|---|
| In both plans | ||
| ISO/IEC 42001, NIST AI RMF and EU AI Act, all native | Included | Included |
| EU AI Act risk-classification assistance, the Annex IV pack and a FRIA workspace | Included | Included |
| AI inventory across code, ML platforms and documents | Included | Included |
| Automated verification and continuous monitoring | Included | Included |
| Drift alerts and scheduled re-verification | Included | Included |
| Evidence vault with SHA-256 fingerprints | Included | Included |
| Hash-chained audit log, with evidence expiry and renewal | Included | Included |
| Risk and impact assessments, policies, attestations, tasks and lifecycle gates | Included | Included |
| Internal audit, management review and corrective action | Included | Included |
| Framework-specific reports, audit packages and the auditor portal | Included | Included |
| Jira, ServiceNow, Slack, Microsoft Teams and webhooks | Included | Included |
| Multi-factor authentication and seven-role access control | Included | Included |
| Enterprise adds | ||
| SSO with SAML, and SCIM provisioning | Not included | Included |
| Custom frameworks and controls | Not included | Included |
| Multi-entity console across subsidiaries and clients | Not included | Included |
| Private cloud or self-hosted, with data residency options | Not included | Included |
| Bring your own LLM | Not included | Included |
| API and SDK, including verification from CI | Not included | Included |
| Audit-firm collaboration | Not included | Included |
| Dedicated onboarding and customer success | Not included | Included |
| Priority support with an SLA | Not included | Included |
Straight answers
Can UbiComply tell us whether a system is high-risk under the EU AI Act?
It suggests a risk class, confirmed by your team. Each system is walked through the Article 5 prohibitions, Annexes I and III, the Article 6(3) exceptions and the Article 50 transparency duties.
Does UbiComply make us EU AI Act compliant or ISO/IEC 42001 certified?
No software can do either. Accredited certification bodies certify, and each provider assesses its own AI Act conformity; UbiComply gives you certification-ready evidence for both.
What are the EU AI Act dates now?
High-risk rules come next: Annex III from 2 December 2027, Annex I from 2 August 2028 (Regulation (EU) 2026/1744). Prohibited practices risk fines up to 7% of worldwide turnover or 35 million euros (Article 99).
Do we need ISO/IEC 42001 certification first?
No. Use UbiComply to find gaps and build evidence before you engage a certification body, or to keep it current afterwards.
What does UbiComply access?
Only what you connect: repositories and ML platforms (read-only), documents you upload, and Jira, ServiceNow, Slack, Microsoft Teams or webhooks, which receive only the tasks and alerts you route to them.
How is our data isolated, and can we choose the model?
Postgres row-level security isolates each organisation. Enterprise lets you bring your own LLM, including a self-hosted model.
See it on one of your AI systems
A live walkthrough with our team: a verification run on a sample repository or yours, readiness across the frameworks you work to, and the reports your auditor will read.
What happens next
- We reply by email to find a time.
- We tailor the session to your frameworks and systems.
- You leave with a clear view of your next steps.