Kyoto AI RMF NIST AI 100-1 Compliance Engine
System: Loading...
Tier: --
Live Demo Mode
Interactive Compliance Demo Live Kyoto Cloud

NIST AI 100-1 Compliance Audit & Evidence Engine

Continuous AI governance, automated code-level scanning, and machine-readable regulatory compliance. Auditing an enterprise RAG assistant against all 72 NIST AI RMF subcategories.

Audited Target: demo-rag-app (FastAPI + LangChain)
AI Backbone: gemini-1.5-flash (Google Vertex AI)
Risk Profile: MODERATE TIER
Baseline Score: 11.1% Met (8 of 72 Subcategories)
πŸ’‘
Why is the baseline score 11.1%? (Fail-Closed Architecture)
Automated technical scans (pip-audit dependency vulnerability analysis, Fairlearn demographic bias probes, and prompt-injection defenses) have already verified 8 technical controls. Under NIST AI RMF 1.0 guidelines, organizational governance, policy sign-offs, and human accountability cannot be assumed by code alone. Follow the 4-step interactive journey below to experience how human attestations and evidence verification work!

Recommended Demo Journey: 4 Quick Steps

Experience how developers, compliance officers, and auditors collaborate on AI governance
Interactive Walkthrough
Step 1 β€’ Technical Scans
🧭 Inspect 72 Controls
Filter across GOVERN, MAP, MEASURE, and MANAGE. View automated technical scans like MAP 4.1 with pip-audit SHA-256 evidence.
Step 2 β€’ Governance Docs
πŸ“œ Review AI Policies
Read the 9 auto-generated governance policies tailored to this RAG system: System Card, AI Use Policy, and Incident Response Playbook.
Step 3 β€’ Live Simulation
✍️ Sign GOVERN 1.1
Simulate human compliance sign-off. Enter your name, commit with SHA-256, and watch the readiness dials increment live!
Step 4 β€’ Compliance Exports
πŸ“¦ Audit Deliverables
Preview the standalone Executive HTML brief, FDA-style AI Nutrition Label, CycloneDX 1.6 ML-BOM, and NIST OSCAL 1.1 JSON.
0%
Overall
0 / 72 Met
0%
Govern
0 / 19 Met
0%
Map
0 / 18 Met
0%
Measure
0 / 22 Met
0%
Manage
0 / 13 Met
Subcategories Breakdown
--
MET / PARTIAL / GAP
Evidence Records
--
Cryptographically Hashed (SHA-256)
Target Architecture
--
Provider / Model Profile
Ledger Integrity
VALIDATED
Last Snapshot: Now
πŸ›οΈ Auditor Deliverables & Compliance Hub 5 Regulatory Standards
Instant 1-click preview and download of regulatory audit deliverables generated from this snapshot
Executive HTML Executive Summary

Self-contained styled report with maturity charts and executive attestation sign-offs.

πŸ‘οΈ Preview HTML
Transparency AI Nutrition Label

FDA-style consumer transparency card detailing datasets, bias audits, and guardrails.

πŸ‘οΈ Preview Label
CycloneDX 1.6 ML-BOM (JSON)

Machine-readable ML Bill of Materials: model components, FAISS vector index, SHA-256 hashes.

πŸ“₯ Download JSON
NIST OSCAL 1.1 OSCAL Profiles

Open Security Controls Assessment Language Assessment Results & Component Definitions.

πŸ“₯ Assessment Results
Ed25519 Signed Evidence Bundle

Complete cryptographic .ZIP archive with digital signature manifest and all audit logs.

πŸ“¦ Download ZIP
Priority Next Compliance Actions
Ranked by risk tier weight, category impact, and missing evidence
Subcategory Function Statement & Priority Rationale Est. Effort Action
Loading next actions...
Compliance Readiness History
Historical trajectory from workspace/ledger_history.jsonl
Timestamp (UTC) Action Actor Readiness Subcategory Counts (Met / Partial / Gap)
Loading progression history...
Project Setup & Archetype Interview
Configure system scope, risk tiers, and tailor canonical AI RMF subcategories
Unique system identifier for the compliance ledger and attestation certificates.
Tailors mandatory subcategories and risk thresholds.
Loading NIST AI RMF subcategories...
Workspace Docs
Loading documents...
Select a document
Document Review Attestation: Sign compliance attestation citing this document as formal evidence.
Comprehensive Compliance Artifacts & Export Engine
Generate machine-readable standards (OSCAL, CycloneDX) and executive audit deliverables
Executive Deliverable
Executive Compliance Summary
Stand-alone styled HTML report with functional maturity breakdowns, leadership attestation sign-offs, and risk matrices.
πŸ‘οΈ View HTML Report
NIST OSCAL 1.1
Machine-Readable Profiles
Complete NIST Open Security Controls Assessment Language exports: Component Definitions, Assessment Results, and POA&M.
πŸ“₯ Component Definition (JSON) πŸ“₯ Assessment Results (JSON) πŸ“₯ Plan of Action & Milestones (JSON)
CycloneDX 1.6
Machine Learning BOM
Standardized Software/ML Bill of Materials containing model architecture, datasets, dependencies, and SHA-256 hashes.
πŸ“₯ Download ML-BOM (JSON)
Consumer Transparency
AI Nutrition Label
FDA-style model facts card disclosing training datasets, bias audits, autonomy boundaries, and safety guardrails.
πŸ‘οΈ View Nutrition Label
Cryptographic Bundle
Signed Evidence Bundle
Complete cryptographic archive containing all evidence artifacts, compliance ledger, manifest, and SHA-256 signatures.
πŸ“¦ Download Bundle (.ZIP)