Compliance framework mappings for AI agents
How Praesidia controls and audit evidence map to the frameworks your assessors ask about — SOC 2, the EU AI Act, ISO/IEC 42001, NIST AI RMF, GDPR, and the OWASP Top 10 for LLM applications.
These mappings support your assessment and do not constitute certification. Each page lists the requirement, what Praesidia provides, and the evidence you can produce — plus the responsibilities that stay on your side.
SOC 2
How Praesidia agent identity, guardrails, and tamper-evident audit trails map to SOC 2 criteria CC6, CC7, and CC8, with exportable evidence.
Read the mapping EU AI ActEU AI Act (Regulation (EU) 2024/1689)
How Praesidia controls and exportable evidence map to EU AI Act Articles 9, 12, 14, 26, 72 and 73 for AI agents, with the plan for each. Not a certification.
Read the mapping ISO/IEC 42001ISO/IEC 42001:2023
How Praesidia agent inventory, guardrails, tamper-evident logs and Advanced-tier risk classification map to ISO/IEC 42001 clauses 6 to 9 and Annex A.
Read the mapping NIST AI RMFNIST AI Risk Management Framework 1.0
How Praesidia inventory, runtime controls, audit trail and Advanced-tier risk classification map to NIST AI RMF Govern, Map, Measure, and Manage.
Read the mapping GDPRGeneral Data Protection Regulation (EU) 2016/679
How Praesidia PII redaction, erasure workflow, data residency, and audit trail map to GDPR Articles 5, 17, 25, 28, 30, 32, 33, and 35 for agents.
Read the mapping OWASP LLM Top 10OWASP Top 10 for LLM Applications 2025
How Praesidia guardrails, per-tool authorization, non-human identity, budgets, and audit trail map to OWASP LLM01 to LLM10 (2025) for AI agents.
Read the mappingHow to use these mappings
Start with the framework your auditor, customer or regulator names. Each mapping page lists the requirement in the framework's own terms, the Praesidia control that addresses it, the evidence you can export, and the work that stays with your organization, such as policies, risk assessments and staff training.
Where frameworks overlap, one control often serves several of them. A tamper-evident audit trail appears in the SOC 2, EU AI Act, ISO/IEC 42001 and GDPR mappings, and guardrails appear in all six. Collect that evidence once and reference it in each review.
A mapping shows where a control can contribute. It does not decide whether a requirement is met in your environment; your assessor does. For the reasoning behind the controls, read the AI agent governance guide and the audit trail guide, which explains what record-keeping under EU AI Act Article 12 asks for.