> ## Documentation Index
> Fetch the complete documentation index at: https://docs.forge.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Compliance

> Map current Forge evidence to AI governance and security frameworks.

<Frame caption="Compliance">
  <img src="https://mintcdn.com/forge-93b579e9/qWsC-LZodDrBBlxW/images/screenshots/compliance.png?fit=max&auto=format&n=qWsC-LZodDrBBlxW&q=85&s=99f5a3e4e059cd043ad8bb7710fa7ef0" alt="Forge compliance showing framework posture, controls, evidence, status, and risk" width="3430" height="1910" data-path="images/screenshots/compliance.png" />
</Frame>

Compliance views map current Forge evidence to the requirements and controls in
external frameworks. Each framework item shows its assessment status, why Forge
assigned that status, and the evidence or unresolved risk behind it.

<Note>
  Forge provides evidence mapping and posture assessment. It does not provide
  certification, legal advice, or a regulatory attestation.
</Note>

## Assessments

Forge evaluates framework items from current:

* Findings and inventory entities.
* Runtime and source coverage.
* Policies and policy hits.
* Governance evaluations and resolved workflows.
* Manual evidence.
* Time-bound risk acceptances.

An item is `pass`, `partial`, `fail`, `unknown`, or `accepted`. Evidence links
state whether a record satisfies, evidences, violates, or resolves the item.
Unknown remains distinct from pass when Forge lacks an evidence path.

Framework summaries show readiness, evidence coverage, open risk pressure, and
the number of items that still need evidence. Refreshing creates or reuses a
versioned snapshot based on the framework catalog and current input set.
Snapshots can be exported as JSON, CSV, or PDF.

## Frameworks

Forge includes:

* NIST AI RMF.
* EU AI Act.
* ISO/IEC 42001.
* OWASP LLM Top 10, Agentic Top 10, and AI Vulnerability Scoring System.
* MITRE ATLAS.
* Cisco AI Security Framework.
* AIUC-1.
* IBM AI Risk Atlas.
* CSA AI Controls Matrix.
* SOC 2 Trust Services Criteria.
* GDPR and CCPA/CPRA.
* HIPAA Security Rule.
* PCI DSS.

Framework versions and source links are shown in Forge because catalogs and
regulations evolve independently.

## Manual evidence

Manual evidence attaches an external artifact or platform record to one
framework item. It records an evidence type, trust label, title, locator,
justification, creator, and optional expiration. Revoking it removes the record
from future active assessments without rewriting previous snapshots.

## Risk acceptance

A risk acceptance records a justification, owner, expiration, and optional
scope to a specific platform resource. An active acceptance changes the
applicable assessment status to `accepted`; it does not convert the underlying
evidence into a pass. Acceptances can be revoked before expiration.

## Related pages

<CardGroup cols={2}>
  <Card title="Inventory" icon="boxes" href="/observe/inventory">
    Review the AI assets, identities, configurations, and risks used as
    evidence.
  </Card>

  <Card title="Policies" icon="shield-check" href="/secure/overview">
    Understand the controls and policy decisions mapped into assessments.
  </Card>

  <Card title="Privacy" icon="lock" href="/secure/privacy">
    Configure evidence and security-record retention.
  </Card>

  <Card title="Audit Log" icon="list-checks" href="/secure/audit-log">
    Review the administrative history behind governance evidence.
  </Card>
</CardGroup>