Compliance

Turn runtime safety decisions into replayable regulatory evidence.

Statutory Conformance & Incident Reconstruction

The Limits of Narrative Compliance

European regulation now reaches directly into the operational decision loop. The EU Machinery Regulation, the EU AI Act, and NIS2 each require an operator to demonstrate what an autonomous system decided, when it decided it, and against what boundary, long after the moment has passed.

Standard compliance workflows answer those mandates in prose. Incident notifications, technical files, and post-mortem audit trails are reconstructed weeks later from scattered logs. Two assessors reading the same narrative arrive at two different conclusions because neither can re-execute the underlying decision.

When the evidence is a story, the regulator grades the prose. Engineering-grade conformance requires a record that replays.

Conformity evidence as a byproduct of operation.

KAIROS records every boundary evaluation at the millisecond it occurs: the normalized inputs, the remaining stability margin, the preflight action preview, and the signed policy that governed the call, sealed into a hash-bound envelope. A Notified Body, regulatory auditor, or CSIRT can re-run that envelope offline and arrive at the identical numerical verdict. The compliance dossier accumulates automatically as the system runs.


The evidence chain

Four audit primitives across every domain.

Whether the assessor is a Notified Body reviewing a robot's technical file, an AI Office auditor inspecting agent oversight, or a CSIRT verifying a 24-hour incident notice, every KAIROS deployment produces the same four verifiable artifacts.

01 / 04 · Pre-deployment baseline

Policy & Calibration

Cryptographic proof of the boundary in force.

Artifact
Signed policy bundle and calibration manifest locking the safety floor, normalization profile, and action-gating rules.
Verification
Every runtime evaluation binds the policy digest and calibration hash into its envelope, proving which rules governed the system at that moment.

02 / 04 · Runtime evaluation record

Decision Envelope

Every verdict recorded at the moment of evaluation.

Artifact
Structured decision envelope capturing normalized telemetry inputs, stability margin, preflight action preview, and explicit reason codes.
Verification
Deterministic evaluation guarantees that two independent reviewers re-running the same input trace arrive at the identical numerical margin.

03 / 04 · Exception & escalation authority

Oversight Receipt

Verifiable human intervention without alert fatigue.

Artifact
Cryptographically signed override token bound to the specific evaluation request digest, operator identity, policy version, and expiration window.
Verification
Proves when an autonomous action was halted, when a human operator was paged, and who authorized any non-standard exception.

04 / 04 · Assessor & CSIRT verification

Replay Bundle

Self-contained evidence a regulator can re-run offline.

Artifact
Self-contained replay package containing input trajectories or telemetry windows, calibration manifest, envelope timeline, and reproducibility hashes.
Verification
A Notified Body, regulatory auditor, or CSIRT can re-run the cohort via the standalone verification runner and confirm every boundary decision independently.

Regulatory intersection

Three statutory regimes. One evidence substrate.

Where European safety, AI governance, and cyber-resilience mandates intersect with KAIROS runtime artifacts, domain adapters, and published statutory briefings.

Physical AI & Robotics

EU Machinery Regulation

Regulation (EU) 2023/1230 · ISO 10218 · ISO 13482

Applies 20 January 2027

Pulls self-evolving control policies and learning-based robotics into mandatory third-party conformity assessment and continuous operational decision logging.

Mandates
Annex III §1.2.1 (safety boundaries and decision recording for self-evolving behavior), §1.3.7 (moving parts), and Annex IV (Technical File).
Evidence gap
Static design-time risk assessments cannot bound a learned VLA or RL policy whose behavior evolves or encounters distribution shift in the field.
KAIROS artifact
Pre-actuation kinematic envelopes, access-guarded single-look neural policy certifications (CMP-001), closed-loop safety and operability ledgers across 1,800 scenarios (SAF-001), and 1-year operational decision logs.

Autonomous Agents & High-Risk AI

EU AI Act

Regulation (EU) 2024/1689 · High-Risk AI Systems

Applies 2 August 2026

Requires continuous risk management, automatic event logging, verifiable human oversight, and documented robustness for high-risk and agentic AI deployments.

Mandates
Article 9 (Risk management), Article 11 & Annex IV (Technical documentation), Article 12 (Record-keeping), Article 14 (Human oversight), Article 15 (Robustness), and Article 43 (Conformity assessment).
Evidence gap
Chain-of-thought tokens and probabilistic guardrail scores provide no reproducible boundary proof when an autonomous agent executes external tool calls.
KAIROS artifact
Continuous session posture ledger, pre-execution tool-call preview, bounded self-correction tracking, and cryptographically signed human override receipts.

Critical Infrastructure & Finance

NIS2 Directive & DORA

Directive (EU) 2022/2555 · Regulation (EU) 2022/2554

Applies 18 October 2024

Imposes strict 24-hour early-warning and 72-hour incident notification clocks on essential entities and financial institutions from the moment of awareness.

Mandates
NIS2 Article 23 (24h early warning, 72h notification, 1-month final report) and DORA Chapter III (ICT-related incident classification and reporting).
Evidence gap
Forensic teams spend days stitching together fragmented SIEM queries, firewall flows, and endpoint alerts while the statutory reporting clock runs.
KAIROS artifact
Pre-indexed zone signal timelines, 60-second explanation records pinned to source event IDs, MITRE ATT&CK mappings, and downstream blast-radius frames.

Briefings in preparation

  • DORAOperational resilience reporting alongside NIS2
  • ISO 13482Personal care and collaborative robot deployments
  • OCSF 1.xNormalized telemetry contracts for cyber adapters

Scope a Conformity & Compliance Review

AnankeLabs works with robotics manufacturers, autonomous agent teams, and regulated infrastructure operators to map statutory evidence obligations directly onto KAIROS runtime envelopes and offline validation bundles.

Select a domain on the right to scope an evaluation under the EU Machinery Regulation (2023/1230), the EU AI Act (2024/1689), or NIS2 and DORA incident-reporting workflows.

Request received. We'll be in touch.