Compliance & assurance
Mapped to the frameworks your auditors already use
ApexClaw contributes technical controls and evidence objects against published frameworks. It states control coverage and it states gaps. It does not claim certification, and no badge on this site represents a third-party assessment.
What each word on this site means
These four are not synonyms, and the difference between the third and the fourth is the one most often blurred in this market.
| Term | What it means here | Who asserts it |
|---|---|---|
| Mapped control | A technical control we assert addresses a specific requirement, named requirement by requirement. | ApexClaw |
| Evidence-backed coverage | That control emits a signed, checkable artifact — not a description of a control, an output of it. | ApexClaw, verifiable by the reader |
| Conformity readiness | The evidence an assessor would request is assembled, versioned and reproducible. It is preparation for assessment, not the result of one. | ApexClaw |
| Certification | An accredited body assessed the system against a standard and issued a certificate. | An accredited third party — none held |
Mapped means we assert the control addresses the requirement. Evidence-backed means the control emits an artifact a reader can verify. Conformity readiness means the evidence an assessor would request is assembled. Certification means an accredited third party assessed the system and issued a certificate — ApexClaw holds none, and displays none.
Frameworks covered
No certification badge appears on this site
There is no third-party certificate to display. Relevant ISO/IEC 27001 control families — access control, cryptography, logging and monitoring, and operations security — are mapped where they touch agent execution, and those mappings are assertions by ApexClaw, not an assessment of any customer's information security management system.
The evidence objects these mappings rest on
A mapping is only as good as the artifact underneath it. These are the artifacts, with their verdicts.
Signed, hash-linked evidence
ProvenEach decision, authorization, outcome, refusal and configuration change is written as a signed record in a hash-linked chain. The record carries the request identity, the policy version, the decision, the approver where one exists, timestamps and the execution result.
Offline independent verification
ProvenEvidence is verified by a portable verifier with no database, no signing key, no network and no product installation on the path. Deliberately altered evidence — an edited amount inside a signed body, a stripped signature, a broken chain link, a checkpoint re-signed by the writer's own key — is refused, and a verifier that cannot run reports an instrument failure rather than a refusal.
Limitation · The verifier was written by the same party as the system it checks. Verifying with it confirms signatures, linkage and key separation; it is not a substitute for an independent implementation of the documented record format.
EU AI governance evidence mapping
CandidateA requirement-by-requirement map from EU AI Act obligations to the specific technical control and the specific evidence object that supports it, stating coverage and stating gaps.
Limitation · Candidate, not proven: the validator checks structure and traceability. It cannot check that a legal reading is correct, and this map has not been reviewed by anyone with legal competence. It is engineering evidence, not legal advice.
Reproducible conformance method
CandidatePer-check verdicts of pass, fail, not-exercised, inconclusive or void, with a controlled cause for every non-verdict, positive controls, must-fail vectors, the exact checker and corpus versions, and artifact digests — so that an all-green result means something only when the checker was demonstrably capable of failing.
Limitation · Reproducible by design. Not yet reproduced by an independent party, which is the only thing that would move this to proven.
Questions auditors ask first
Is ApexClaw certified against ISO/IEC 42001?
No. ApexClaw holds no certification against any standard, and no page on this site displays a certification badge. It maps controls and produces evidence that supports a certification effort run by an accredited body.
Can ApexClaw make our organisation compliant?
No product can. Compliance is a property of an organisation's processes, governance and documentation as assessed by a competent authority or body. ApexClaw supplies technical controls and evidence objects that address specific requirements within that effort.
Are the mappings independently reviewed?
Not currently. Every mapping on this site is an assertion by ApexClaw. Where a mapping is backed by an artifact, that artifact is checkable by the reader, which is a weaker guarantee than independent review and is described as such.
Does the founder's W3C role imply endorsement?
No. ApexClaw's founder chairs a W3C Community Group. Participation in a community group is not endorsement: the W3C does not certify ApexClaw and does not endorse it.