kolm / compliance
Every framework that governs AI in production asks for the same three things: what model ran, what it did, did it stay inside its lane. A .kolm answers all three by construction: artifact CID, input/output hashes, K-score and gate, HMAC chain, replay months later. This page maps that to the frameworks themselves.
GOVERN · MAP · MEASURE · MANAGE. 31 subcategories mapped to specific fields in the .kolm manifest, receipt JSONL, and kolm CLI verbs. Reviewed against the July 2024 GenAI profile.
The HIPAA compliance pack (/compliance-packs) ships 18-identifier Safe Harbor verifier, BAA workflow, and the receipt schema covered counsel actually accepts.
Receipts as the model log: conceptual soundness from provenance, performance monitoring from K-score per-month, replay from input_sha + output_sha. See the bank case study for what an examiner actually accepted.
Clause-by-clause mapping is on the May calendar. The AI management system requirements (planning, support, operation, performance evaluation, improvement) map cleanly to the kolm runtime and audit log; we are writing the table now.
Article 12 (record-keeping), Article 13 (transparency), Article 15 (accuracy + robustness + cybersecurity), Article 17 (quality management). Same receipt+manifest spine, restated against the high-risk obligations. Drafting against the final consolidated text.
Not AI-specific, but every buyer's procurement reviewer asks. We are pulling the relevant CC + A.5 / A.8 / A.12 / A.14 controls and pointing at the corresponding kolm artifacts. SOC 2 Type II is on the company itself at /soc2.
Each mapping table answers the same shape for every control:
If a control is not covered by the artifact spine, we say so explicitly. Examples: human-in-the-loop oversight (MG-3.x) is governance you implement, not something a manifest field can satisfy. We do not claim otherwise.
We do not certify your compliance. We do not write your policies. We do not stand between you and your auditor.
What we do: ship the artifacts that turn "did the model behave" from an asserted answer into a replayable one. Your compliance team and your auditor decide whether the evidence satisfies the framework. We give them something to point at that is not vibes.
compliance@kolm.ai if you want a framework added to this page.