Regulators now hold you accountable for what your AI agents do.
Your auditor will ask for evidence that each agent meets each obligation, and for new evidence whenever the agent or the rule changes. Vijil generates the tests, the runtime observation and the compliance report for each of your agents, so the evidence keeps up with both.
The compliance clock is already running
Some of these rules already apply. The rest have dates. Each links to the regulator’s own text.
EU AI Act
Prohibited practices and the rules for general-purpose AI already apply. Duties for high-risk systems, which include AI used in hiring, credit and education, apply from 2 December 2027. Fines for prohibited practices reach 7% of worldwide annual turnover.
NYC Local Law 144
An employer may not use an automated employment decision tool unless an independent bias audit was done within the past year, with a summary of the results published.
Enforced since 5 July 2023NYC DCWP
GDPR
People have the right not to be subject to a decision based solely on automated processing that significantly affects them (Article 22). Fines reach 4% of worldwide annual turnover.
Applies since 25 May 2018Regulation (EU) 2016/679
CCPA regulations
California’s regulations on automated decisionmaking technology apply to businesses that use it to make significant decisions about consumers.
Comply from 1 January 2027California Privacy Protection Agency
Colorado SB 26-189
Colorado repealed its AI Act in May 2026, before it took effect, and replaced it. The new law requires notice when automated decision-making technology is used in a consequential decision, and an explanation after an adverse one.
Duties begin 1 January 2027Colorado General Assembly
Taiwan AI Basic Act
A framework law of 20 articles. Within two years, the government must review and amend the laws and rules that put its principles into effect.
In force since 14 January 2026Laws & Regulations Database of the ROC
Compliance for agents is a systems problem, not a paperwork problem
Auditors demand evidence
A policy says what an agent should do. An auditor asks what it did, against each obligation, and wants the record that shows it. A questionnaire filled in at launch is not that record.
Evidence has to be continuous
An agent changes whenever someone updates its model, adds a tool or edits its prompt. Keeping evidence current takes systems that watch what each agent does and trace that behavior to what the agent is made of.
The rules keep moving
This year the EU moved its high-risk deadline by sixteen months, and Colorado repealed its AI Act before it took effect and passed a new one. Each new rule, and each change to an old one, needs new tests.
Vijil generates the evidence system for each agent
A consulting team builds a compliance test suite by hand, for one agent and one regulation, over months. Vijil generates it from the regulation and the agent’s own purpose, and generates a runtime tap that records what the agent does against the same rules. When a rule changes, Vijil regenerates both.
InventoryVijil Discover
A row for every agent running in your environment, and an identity for each one you keep, so the evidence can name the agent it describes. Discover
Tests and reportVijil Diamond
Generates the test suite for each agent from the approved rules, runs it, and writes the compliance report your auditor reads. Diamond
ObservationVijil Dome
Checks the agent’s inputs and outputs against the same policy in production, and records every decision as OpenTelemetry traces. Dome
Regulations and standards we cover today
Each framework tests how the agent behaves against its named clauses. Choose one or several for a run, and the run produces a compliance report.
- International standard
ISO/IEC 42001
AI management-system controls: consistency, data quality, fairness and governance.
United StatesNIST AI RMF
The Measure and Manage functions: safety, security, privacy, fairness and accountability.
Canada, federally regulated financial institutionsOSFI E-23
Model risk management: data quality, robust outputs, explainability and escalation.
- Taiwan
Taiwan AI Basic Act
Its principles and harm-prevention duties: autonomy, data governance, safety, transparency, fairness and accountability.
SingaporeSingapore PDPA
The Personal Data Protection Act and the regulator’s AI guidance: data protection, purpose limitation, accuracy and explaining AI decisions.
Added within days, when they matter to you
- GDPR, including Article 22 on decisions made solely by automated processing
- California’s regulations on automated decisionmaking technology
- NYC Local Law 144 on automated employment decision tools
- Colorado SB 26-189, the automated decision-making law that replaced the Colorado AI Act
- Any regulation, standard or internal policy you can write down
Vijil extracts the rules from the text you give it. Your team approves them, and the tests follow.
SmartRecruiters proves its hiring agents compliant before its customers ask
Field note · SmartRecruiters“Our enterprise customers demand trust verification before deploying AI in hiring workflows. Vijil helps us ship AI agents in six weeks instead of six months while dramatically lowering compliance costs.”
Michal Nowak, Senior Vice President, Engineering, SmartRecruiters
Vijil built test suites for the Winston hiring agents across four frameworks, and ran them in a test engine deployed in SmartRecruiters’ own AWS VPC. Read the story
From inventory to evidence, for every agent in scope
- 0+00 · Inventory
Find the agents in scope
Vijil Discover finds the agents running in your environment, in the cloud, in Kubernetes, on endpoints and in GitHub. Register the ones in scope and each gets an identity based on the SPIFFE standard, so every piece of evidence names the agent it describes.
- 1+00 · Obligations
Turn each regulation into rules
Upload the regulation, the standard or your own policy. Vijil extracts each requirement as a rule, and your team approves or rejects every rule before it counts.
- 2+00 · Test suite
Generate the tests for each agent
Vijil Diamond compiles the approved rules, the agent’s purpose and the people it serves into a test suite built for that agent. A hiring agent and a support agent get different tests.
- 3+00 · Report
Run them and produce the report
The suite runs against the live agent. The compliance report maps each obligation to the tests that check it, the results, and the conversations behind every finding.
- 4+00 · Observation
Watch the agent in production
Vijil Dome checks the agent’s inputs and outputs against the same policy as it runs, and sends every decision to your observability stack as OpenTelemetry traces and metrics.
- 5+00 · Again, on every release and every rule change
Run it on Vijil’s hosted console, or inside your own network: a VPC, on-premises or air-gapped.
A compliance report your auditor can verify
Each run produces a compliance report for one agent and one framework. It names the agent and the evaluation, maps each obligation to the prompts that tested it, counts how many passed and failed, and names the weakest obligations. The evaluation ID retrieves every response and detector score behind the report.
These pages are from a real run: Diamond’s EU AI Act harness on Vijil’s sample travel agent, without Dome, on 14 October 2026. 314 of the 1,415 prompts got no scoreable response, and the report says so.
Download the sample report (PDF)
See it on one of your agents in two weeks, free
Bring one agent and the regulation that worries you most. In two weeks you have:
- The agent registered, with its identity
- The regulation turned into rules your team has approved
- A test suite generated for the agent, and its results
- A compliance report you can hand to your auditor
A person reads every request and replies within one business day.