Compliance Mapping
Wytness is designed to help organisations meet regulatory requirements for AI agent oversight. Below is a mapping of specific regulatory articles to Wytness controls.
Note
Wytness provides the technical controls and audit trail infrastructure. Your compliance team maps these to your organisation's specific obligations and risk framework.
EU AI Act
The EU AI Act (effective August 2025) requires providers of high-risk AI systems to implement logging, transparency, and quality management controls. Wytness addresses the following articles:
| Article | Requirement | Wytness Control |
|---|---|---|
| Art. 12 — Record-keeping | High-risk AI systems shall be designed to allow automatic recording of events (logs) relevant to the identification of risks. | Every agent action is logged with structured context across five layers: identity, authorization, action, data flow, and outcome. Hash-chained and signed for integrity. |
| Art. 13 — Transparency | High-risk AI systems shall be designed to ensure their operation is sufficiently transparent. | The prompt and response fields capture what the user asked and what the agent answered. The reasoning_summary field captures why the agent took each action. Response text is automatically PII-redacted before storage, with optional pseudonymization for reversible protection. |
| Art. 13 — Human oversight | High-risk AI systems shall be designed to be effectively overseen by natural persons. | The hitl_approved field tracks human-in-the-loop approvals. The Agent Registry assigns a human operator to each agent. The dashboard provides real-time oversight. |
| Art. 14 — Human oversight | High-risk AI systems shall be designed to be effectively overseen by natural persons. | The hitl_approved field tracks human-in-the-loop approvals. The dashboard provides real-time oversight. Anomaly alerts enable proactive intervention. |
| Art. 17 — Quality management | Providers shall put a quality management system in place. | The complete audit trail, chain verification, anomaly detection, and export capabilities constitute a quality management system for agent operations. |
| Art. 6 + 71 — Classification & Registration | Classify AI systems by risk level and register high-risk systems. | The Agent Registry provides 4-tier risk classification (minimal, limited, high, prohibited — aligned with EU AI Act), Annex III category mapping, approval workflow, and exportable compliance reports. |
GDPR
| Article | Requirement | Wytness Control |
|---|---|---|
| Art. 5(2) — Accountability | The controller shall be responsible for, and be able to demonstrate compliance with, the principles. | Append-only, tamper-evident audit trail with 7-year retention (long-term retention with a soft-delete recovery window; per-bucket Azure Blob immutability_policy is available on customer-hosted storage). Cryptographic proof of record integrity via hash chain and Ed25519 signatures (chain breaks surface as anomalies in your dashboard). Automatic PII redaction by default, with optional pseudonymization using customer-held keys for data minimisation by design. |
| Art. 25 — Data protection by design | The controller shall implement appropriate technical measures designed to implement data-protection principles. | HMAC-based pseudonymisation (recommended by Art. 25) runs inside the SDK, in the customer's own process, before any event leaves their environment; the decryption keys are customer-held, so Wytness cannot reverse it. Emails, phone numbers, payment cards, SSNs and AU TFNs are detected automatically. Names, addresses and other free-text values are pseudonymised once the customer declares those fields (pii_fields) — a regex cannot reliably identify a name, so that declaration is the control that covers them. |
| Art. 15 & 17 — Access and erasure | The data subject has the right to obtain access to their personal data and to have it erased. | The Subject lookup page (Compliance → Subject lookup) computes a subject's pseudonym token in the operator's browser and finds every audit event that references it — the secret and the raw value are never sent to Wytness. A redaction run on the Privacy page then scrubs the matched events from the live event store and reachable archive copies, targeted by token. |
| Art. 22 — Automated decisions | The data subject has the right not to be subject to a decision based solely on automated processing. | Every automated decision is logged with context: who authorised it, what data was used, what the outcome was. hitl_approved tracks human involvement. |
| Art. 30 — Records of processing | Each controller shall maintain a record of processing activities. | The audit event store is a comprehensive record of all processing activities performed by AI agents, with timestamps, data classifications, and outcomes. |
| Art. 35 — DPIA | The controller shall carry out an assessment of the impact of the envisaged processing operations. | Wytness data supports Data Protection Impact Assessments by providing complete records of what data agents accessed and how it was classified. |
SOC 2
| Control | Criteria | Wytness Implementation |
|---|---|---|
| CC6.1 | Logical access controls — the entity implements logical access security measures. | JWT bearer auth (bcrypt password hashes) for dashboard. X-API-Key for SDK ingest. Per-org Ed25519 signing keys mean Wytness cannot impersonate any customer. RBAC on all infrastructure resources. Managed identity for service-to-service auth. |
| CC6.3 | Role-based access — the entity authorises access based on job function. | Least-privilege role assignments on all infrastructure components. Per-service credentials with no wildcard permissions. |
| CC7.2 | System monitoring — the entity monitors system components for anomalies. | Real-time anomaly detection on every event — behavioural rules (new tool, frequency spike, error rate, restricted data, off-hours activity, new destination, session anomaly) and chain-integrity rules (signature, chain, missing keys). Platform-level monitoring for infrastructure metrics. |
| CC7.3 | Detection of changes — the entity detects changes that could impact security. | Ed25519 signatures detect any modification to audit records. Hash chaining detects insertions, deletions, or reordering. new_tool rule detects agent behaviour changes. |
ISO 27001
| Control | Requirement | Wytness Implementation |
|---|---|---|
| A.12.4 | Logging and monitoring — event logs recording user activities, exceptions, and security events shall be produced, kept, and regularly reviewed. | Append-only signed event log with 7-year retention. Dashboard provides real-time review. Anomaly alerts surface exceptions automatically. |
| A.12.4.3 | Administrator and operator logs — system administrator and operator activities shall be logged. | All agent actions are logged regardless of privilege level. The human_operator_id field identifies the responsible person. |
| A.18.1 | Compliance with legal and contractual requirements — all relevant requirements shall be explicitly identified. | 7-year audit-log retention meets most legal retention requirements. CSV/JSONL export for legal discovery. Customer-hosted storage (Business+) can opt into Azure Blob immutability_policy on the customer's own bucket for full legal-hold treatment. |
| A.18.1.3 | Protection of records — records shall be protected from loss, destruction, falsification. | Ed25519 signatures detect falsification. Append-only storage with a soft-delete recovery window makes accidental destruction operationally reversible, and every event is Ed25519-signed and hash-chained so any tampering is cryptographically detectable (Azure Blob immutability_policy is available on customer-hosted storage for stronger guarantees). Accepted events are written to a durable event store and archived to geo-redundant blob storage for the 7-year retention period; if the event store is briefly unavailable, events are buffered in durable spillover storage and replayed automatically, and events that fail processing are held in a dead-letter store with a 90-day inspection window. Hash chaining detects loss. |
Compliance Reporting
The platform supports legal-grade data export for auditors and regulators:
| Feature | Detail |
|---|---|
| Evidence Packs | One-click compliance evidence for SOC 2, EU AI Act, and ISO 27001. Auto-fills control mappings, agent inventory, chain verification, anomaly report, and cryptographic proof. Print to PDF for auditors. |
| CSV export | Date-range filtered, per-agent filtered, with all event fields |
| JSONL export | Machine-readable format with full event JSON including signatures |
| Chain verification report | On-demand integrity check: total events, valid/broken status, break point |
| Anomaly history | Full history of all detected anomalies with timestamps and severity |
| Retention guarantee | 7-year retention while subscribed, with a soft-delete recovery window; on cancellation your full history is handed over as signed Evidence Packs before deletion. Customer-hosted storage (Business+) can opt into Azure Blob immutability_policy on the customer's own bucket. |
Tip
For legal terms including our Data Processing Agreement and sub-processor list, visit the Trust Centre.
Need help with compliance mapping?
Contact Sales