Modulos Named in the Inaugural Gartner® Magic Quadrant™ for AI Governance PlatformsRead the

Press Release

Answer every framework from the same controls

Modulos maps each control to every framework that asks for it, assesses it on a schedule and tests it against production. When a test fails, the control reopens in every framework it serves.

Request a demoSee the frameworks

The Modulos framework library 1.0.32: 26 frameworks and 958 controls, 454 of them shared by two or more frameworks. A sample organization answers to five of them. Every Monday at 09:00 one job assesses all five, and shared controls are assessed once. During the week an agent test fails and reopens a control in EU AI Act, a drift test fails in EU AI Act and NIST AI RMF, and a data test fails in EU AI Act and GDPR. On Friday the drift test passes again.

Library 1.0.32, real framework mappings and controls. The organization, its scope and the test results are illustrative.

Your frameworks multiply faster than your team

Each new regulation or standard tends to arrive as another spreadsheet, and the same control gets documented again for every framework that asks for it.

Evidence is collected in the weeks before an audit and describes the system on that day. When the model or its data changes afterwards, nothing in the spreadsheet notices.

Implement a control once and reuse it wherever it applies

The framework library maps each control to the requirements it answers in every framework. Explain an AI system's automated decisions once, and the same control, with the same evidence, counts toward the EU AI Act, NIST AI RMF, Colorado SB 26-189 and California's ADMT rules. Adding a framework later starts from the controls you already run.

MCF-171 Transparent Automated Decision-MakingImplemented once for the Claims triage assistant
MCF-32 Data Bias AssessmentImplemented once for the Claims triage assistant
MCF-66 Production Data Quality MonitoringImplemented once for the Claims triage assistant
MCF-260 Response to information security incidentsImplemented once for the Claims triage assistant
OCF-141 Audit reporting and recordsImplemented once for the whole organization
Real mappings from framework library 1.0.32. 454 of its 958 controls serve two or more frameworks.

The agent reads your evidence and scores each control

The Control Assessment Agent reads the evidence attached to a control, gives it a readiness score, and lists the gaps it found with a citation for each one. When you upload new documents, an agent proposes which controls they support before anything is saved.

Your team reviews the findings and decides the control status.

MCF-53 Technical Documentation · Claims triage assistantMonday 21 Sep, 09:14

Is the technical documentation for this AI system complete, current and kept under version control?

Evidence read

  • model-card-v3.mdCited for scope and intended use
  • system-architecture.pdfCited for components and data flow
  • training-data-sheet.xlsxProposed mapping to this control

Control Assessment Agent

78% readiness

  • The model card has no version history or change log.model-card-v3.md, section 1
  • The data sheet does not state a retention period for training data.training-data-sheet.xlsx, tab Sources

Add a dated change log to the model card and record the retention period in the data sheet.

The score and findings are for your team to review. The control status stays yours to set.

Job

EU AI Act · Claims triage assistant

Control assessment · Weekly · Monday 09:00

Monday 21 Sep, 09:00
  1. Art. 9Risk management system14 controlsAssessed
  2. Art. 10Data and data governance11 controlsAssessed
  3. Art. 11Technical documentation6 controlsAssessed
  4. Art. 12Record-keeping5 controlsRunning
  5. Art. 14Human oversight8 controlsQueued
  6. Art. 15Accuracy, robustness and cybersecurity12 controlsQueued

31 of 56 control steps done in this run, for one AI system. Illustrative data.

Assess a whole framework on a schedule

A job can cover one control, one requirement or an entire framework. Pick a cadence once (daily, weekly, monthly or quarterly) and the job expands into one assessment for every control in scope. Each run is dated, and you can start one by hand whenever an audit comes up.

A failed test reopens the control it proves

Metric tests in Runtime Inspection read live values from your monitoring and check them against a threshold. When a test fails, every control it is linked to moves from executed back to not executed, the reason goes into the activity log, and the control owner is notified. Evidence attached to an executed control stays locked, so the record shows what was true at the time.

MCF-67 Production Data Drift MonitoringMetric test · daily 06:00
  1. Mon 31 AugExecutedEvidence attached and locked
  2. Tue 22 SepTest failedDrift above the threshold on the new channel
  3. Tue 22 SepNot executedControl owner and test assignee notified
  4. Thu 24 SepEvidence refreshedRetrained model, new baseline
  5. Fri 25 SepExecutedSet by the control owner after the 06:00 pass

Activity logTest Drift metric failed. Status updated from executed to not executed in control MCF-67.

Reopened in EU AI Act, NIST AI RMF. Illustrative data.

Hand your auditor the current state of every framework

Each framework shows how many of its controls are assessed, the average readiness and the date of the last run. Export an AI system or a single control as a PDF report with its status, owner, frameworks, tests and evidence list.

FrameworkControls with a scoreReadiness
EU AI Act2 reopened115 of 12875%
NIST AI RMF71 of 8073%
ISO/IEC 42001104 of 11673%
ISO/IEC 27001147 of 16470%
GDPR1 reopened58 of 6674%
Status Fri 25 Sep, 06:00Illustrative data

Control report

MCF-67 Production Data Drift Monitoring

Status
Executed
AI system
Claims triage assistant
Frameworks
EU AI Act, NIST AI RMF
Tests
Drift metric, daily
Evidence
4 items, locked
PDF

Framework content checked against the source text

Requirements in the library quote the regulation or standard they come from, and framework releases go through automated content checks against those sources. For the EU AI Act, you set your role and risk class, then preview which requirements come into or leave scope before anything changes.

How Modulos covers the EU AI Act

Requirement text, as cited

High-risk AI systems shall be designed and developed in such a way that they achieve an appropriate level of accuracy, robustness, and cybersecurity, and that they perform consistently in those respects throughout their lifecycle.

EU AI Act, Article 15(1), consolidated text

EU AI Act scope preview

Role: deployer · Risk class: high-risk

  • + 38 requirements come into scope
  • − 12 provider-only requirements leave scope

Nothing changes until you apply it. Illustrative counts.

Frameworks in the library

The controls behind these frameworks are mapped to each other and maintained as the rules change. Library 1.0.32 holds 26 frameworks, 729 requirements and 958 controls.

Bring the framework you answer to

Tell us which framework is next on your list. We show how its requirements map to controls you may already run, and how assessments and runtime tests would keep them current.

Request a demoSee how risk is priced

Discovery, governance, risk and agents