Compliance
An audit-ready evidence pack, mapped to the controls you report on.
Your governed decisions become proof for the EU AI Act, GDPR and SOC 2 controls you report on: human oversight, record-keeping and transparency, each backed by a signed Decision Dossier. Below is a sample pack from a vendor-payment workflow. See what auditors expect for AI agent actions.
Compliance evidence pack
Vendor payments
Your governed decisions, mapped to named controls — downloadable proof for risk and compliance.
- Decisions recorded
- 8
- Actions blocked
- 0
- Actions escalated
- 4
- Human-oversight events
- 5
- Signed records
- 8
EU AI Act
Art. 14 Human oversight | Decionis escalates risky actions to a human and records overrides instead of executing autonomously. High-risk AI decisions must allow effective human oversight and intervention. | 5 |
Art. 12 Record-keeping | Every decision is signed into a Decision Dossier and preserved in the Execution Ledger. Automatic logging of events over the system's lifetime. | 8 |
Art. 13 Transparency | Each dossier states which policy version applied and the reason for the verdict (reason codes). Operation must be transparent enough to interpret outputs. | 8 |
GDPR
Art. 22 Automated decision-making | Escalation and override paths put a human in the loop before consequential actions. Right to human intervention in solely automated decisions. | 5 |
Art. 30 Records of processing | The Execution Ledger is an organisation-wide record of every governed decision. Maintain records of processing activities. | 8 |
Art. 5(2) Accountability | Signed, verifiable dossiers provide tamper-evident proof of each decision. Demonstrate compliance with the processing principles. | 8 |
SOC 2
CC6.1 Who may act | The keys that may ask Decionis to decide for you at the period end, the agent keys among them, and the people in your organisation. Logical access to act on your systems is limited to identities you authorized. | — |
CC6.2 Access granted | The keys you issued and the membership changes you made during the period, each recorded when it happened. New access is authorized and registered before it is granted. | — |
CC6.3 Who may approve, and access removed | The people who may approve your escalations and your policy releases at the period end, and the keys revoked during the period. Access is changed or removed as roles change, on least privilege. | — |
CC7.2 Agent actions monitored | Every action your agents sent was decided against your policy before it ran, and each decision is a signed Decision Dossier in your Decision Ledger. System activity is monitored and the record of it is kept. | 8 |
CC7.3 Escalations evaluated | The escalations raised during the period, how the people you named resolved them, and those still open at the period end. Events that need attention are evaluated and resolved. | 4 |
CC8.1 Policy changes | Every change to your policy during the period, each an immutable new version, and how many an approver other than the author signed off. Changes are authorized, tested and approved before they take effect. | — |
Every figure is backed by a signed, verifiable Decision Dossier. Generated in shadow mode — no live system was changed.