Regulatory Crosswalk · AI Governance · BFSI

Obligations mapped to controls — 7 frameworks, 40 requirements

EU AI Act, SR 26-2, RBI MRM Guidance, NIST AI RMF, DPDP Act 2023, SEBI, and ISO 42001 — each obligation linked to the Zytra module that addresses it and the evidence output it generates.

Framework	Obligation	Article / §	Applies to	Status	Zytra Module	Evidence Output
EU AI Act — High-Risk Systems (Art. 9–15) · Applies to high-risk AI providers & deployers under Annex III · Mandatory from 2 Dec 2027 (Annex III) / 2 Aug 2028 (Annex I product-related)
EU AI Act	Risk management system — continuous, iterative process throughout AI system lifecycle	Art. 9	High-risk AI providers & deployers (Annex III)	Production-ready	Risk Atlas · Assessment Engine	Risk tiering report · Control effectiveness scores
Regulatory status Mandatory — Annex III high-risk systems from 2 Dec 2027; Annex I product-related high-risk from 2 Aug 2028 Effective date 2 Dec 2027 (Annex III) / 2 Aug 2028 (Annex I product-related) Source EU AI Act, OJ L 2024/1689, Art. 9 Zytra coverage Continuous risk management loop: discovery scan, automated risk tiering, control assignment, residual scoring, board-level heat map. Evidence exported as PDF or OSCAL.
EU AI Act	Data governance — training, validation, testing data meet quality criteria; relevant biases identified	Art. 10	High-risk AI providers (Annex III)	Production-ready	Discovery · AI Asset Registry	AIBOM · Data lineage report
Regulatory status Mandatory — Annex III high-risk providers from 2 Dec 2027 Effective date 2 Dec 2027 Source EU AI Act, Art. 10 Zytra coverage Discovery crawls model registry and agent mesh to generate AI Bill of Materials (AIBOM). Data lineage and training dataset provenance tracked per model asset.
EU AI Act	Record-keeping — automatic logging of events, incidents, and periods of use throughout operational lifetime	Art. 12	High-risk AI providers & deployers (Annex III)	Production-ready	Evidence Ledger · Audit Trail	Hash-chained event log · Tamper-evident audit trail
Regulatory status Mandatory — Annex III high-risk systems from 2 Dec 2027; Annex I product-related high-risk from 2 Aug 2028 Effective date 2 Dec 2027 (Annex III) / 2 Aug 2028 (Annex I product-related) Source EU AI Act, Art. 12 Zytra coverage Append-only structured event log with SHA-256 hash chain. Every inference, override, and governance decision recorded. 7-year retention. Exportable as PDF or OSCAL with regulator-ready evidence pack.
EU AI Act	Transparency & information provision — deployers receive sufficient information to ensure compliant use	Art. 13	High-risk AI deployers (Annex III)	Production-ready	Risk Atlas · Evidence Ledger	Model card · Risk transparency report
Regulatory status Mandatory — Annex III high-risk deployers from 2 Dec 2027 Effective date 2 Dec 2027 Source EU AI Act, Art. 13 Zytra coverage Auto-generated model cards per asset. Risk transparency reports include capability statements, known limitations, and intended use scope. Exportable for supply-chain sharing.
EU AI Act	Human oversight — systems designed and deployed to enable effective human oversight and intervention	Art. 14	High-risk AI deployers (Annex III)	Production-ready	Continuous Monitoring · Aval Guardrails	Override log · Human-in-loop gate evidence
Regulatory status Mandatory — Annex III high-risk deployers from 2 Dec 2027 Effective date 2 Dec 2027 Source EU AI Act, Art. 14 Zytra coverage Human-in-loop gates configurable per risk tier. Aval enforces policy at runtime — outputs requiring human review are flagged and routed. Override decisions logged in evidence ledger with timestamp and approver identity.
EU AI Act	Accuracy, robustness & cybersecurity — appropriate levels of accuracy, resilience to attacks and adversarial inputs	Art. 15	High-risk AI providers (Annex III)	Production-ready	Aval Guardrails · FinProof Harness	Benchmark results · Adversarial test report
Regulatory status Mandatory — Annex III high-risk providers from 2 Dec 2027 Effective date 2 Dec 2027 Source EU AI Act, Art. 15 Zytra coverage Aval evaluated on FinProof v1 (6,171 entries; 5,389 adversarial) and AgentHarm benchmark. 0.5% false-positive rate at 11.6ms on RTX 4090. Signed test reports exportable per Art. 15 conformity documentation requirements.
EU AI Act — GPAI Model Providers (Art. 53–55) · Applies to general-purpose AI model providers only · Most BFSI deployers are NOT subject to Art. 53–55 directly
GPAI scope note: Art. 53–55 imposes obligations on providers of general-purpose AI models (e.g., foundation model vendors). Banks and financial institutions that deploy GPAI models — but do not train or distribute them — are subject to Art. 9–15 as deployers, not to Art. 53–55. Obligations in this section apply if your institution provides a GPAI model to third parties.
EU AI Act	GPAI model documentation — technical documentation, copyright summaries, training data disclosure	Art. 53	GPAI model providers only (not BFSI deployers)	Prototype	Discovery · Evidence Ledger	GPAI technical documentation pack
Regulatory status Mandatory for GPAI model providers — from 2 Aug 2025 Effective date 2 Aug 2025 Source EU AI Act, Art. 53; Annex XI (technical documentation) Zytra coverage Prototype: Zytra can generate structured technical documentation from model registry metadata and AIBOM data. Third-party evaluation of documentation completeness pending. Relevant for BFSI institutions operating fine-tuned models distributed internally or to clients.
EU AI Act	Systemic risk assessment — adversarial testing, incident reporting, cybersecurity measures for high-capability GPAI	Art. 55	GPAI providers of systemic-risk models only	Prototype	Assessment Engine · FinProof Harness	Systemic risk assessment report · Adversarial test results
Regulatory status Mandatory for providers of GPAI models with systemic risk — from 2 Aug 2025 Effective date 2 Aug 2025 Source EU AI Act, Art. 55; Annex XII Zytra coverage Prototype: red-team adversarial testing pipeline via FinProof harness. Structured incident reporting flow built. Third-party evaluation of Art. 55 systemic risk assessment completeness pending Q1 2027.
SR 26-2 / CA 26-2 (Fed, OCC, FDIC — Apr 2026) · Applies to statistical and traditional AI models in US banking · Footnote 3 explicitly excludes GenAI and agentic AI from new requirements
SR 26-2 Footnote 3: GenAI and agentic AI are explicitly excluded from the incremental requirements introduced by SR 26-2. Banks govern those systems under existing MRM practices (SR 11-7). All SR 26-2 rows in this table apply to statistical and traditional AI models only. Zytra's agentic security and guardrail capabilities address the SR 11-7 gap for GenAI separately.
SR 26-2	Model inventory — comprehensive, current inventory of all models in use	§III.A	Statistical / traditional AI models (US banking)	Production-ready	Discovery · AI Asset Registry	Model inventory report · AIBOM
Regulatory status Mandatory — Fed/OCC/FDIC supervised institutions from 17 Apr 2026 Effective date 17 Apr 2026 Source SR Letter 26-2 / CA 26-2, §III.A Zytra coverage Discovery crawls API endpoints, agent mesh, model registries, and cloud resources to build continuous model inventory. Auto-updated per scan. SHA-256 hash on each snapshot for audit integrity.
SR 26-2	Model risk tiering — classify models by inherent risk based on materiality and complexity	§III.B	Statistical / traditional AI models (US banking)	Production-ready	Risk Atlas · Assessment Engine	Risk tiering report · Tier classification evidence
Regulatory status Mandatory — from 17 Apr 2026 Effective date 17 Apr 2026 Source SR Letter 26-2, §III.B Zytra coverage Assessment engine auto-classifies models as Critical / High / Medium / Low / Minimal using materiality signals (customer impact, revenue exposure, regulatory scope) and complexity signals (architecture, data sensitivity, autonomy level). Tier decisions traceable in evidence ledger.
SR 26-2	Model development & validation — pre-implementation validation proportionate to model risk tier	§III.C	Statistical / traditional AI models (US banking)	Production-ready	Governance SDK · Evidence Ledger	Validation gate evidence · CI/CD policy check log
Regulatory status Mandatory — from 17 Apr 2026 Effective date 17 Apr 2026 Source SR Letter 26-2, §III.C Zytra coverage Governance SDK embeds policy gates in CI/CD pipeline. Each gate checks model risk tier, validation status, and approval requirements before deployment. Gate outcomes written to evidence ledger with signed timestamps.
SR 26-2	Model monitoring — ongoing performance monitoring proportionate to model risk tier	§III.D	Statistical / traditional AI models (US banking)	Production-ready	Continuous Monitoring · Evidence Ledger	Performance monitoring report · Drift alerts
Regulatory status Mandatory — from 17 Apr 2026 Effective date 17 Apr 2026 Source SR Letter 26-2, §III.D Zytra coverage Continuous monitoring tracks model performance metrics, data drift, and outcome distributions. Alerts routed to model owner and risk committee. Monitoring cadence configurable per tier. Historical monitoring reports exportable for MRM committee review.
SR 26-2	Model governance — policies, procedures, and internal controls for model risk management	§III.E	Statistical / traditional AI models (US banking)	Production-ready	Risk Atlas · Evidence Ledger	Policy documentation · Issue tracking log
Regulatory status Mandatory — from 17 Apr 2026 Effective date 17 Apr 2026 Source SR Letter 26-2, §III.E Zytra coverage Policy framework mapped to risk atlas controls. Issues tracked from discovery through resolution with owner assignment and timeline. GRC workflow automation routes approvals to model risk committee. Signed evidence ledger records committee decisions.
SR 26-2	Board & senior management oversight — board-level AI risk appetite, committee reporting	§IV	Statistical / traditional AI models (US banking)	Production-ready	Risk Atlas · Evidence Ledger	Board risk pack · Residual risk heat map
Regulatory status Mandatory — from 17 Apr 2026 Effective date 17 Apr 2026 Source SR Letter 26-2, §IV Zytra coverage Board-ready risk pack: residual risk heat map by domain, control effectiveness scores, open issue summary, and monitoring trend lines. Auto-generated from evidence ledger. One-click export as PDF or OSCAL. Committee approvals recorded in signed ledger.
RBI Draft Guidance on Model Risk Management (Jun 2026) · Applies to all RBI-regulated entities deploying AI/ML models · Final guidance pending — comments closed 24 Jul 2026
RBI MRM	Model governance framework — board-approved MRM policy, roles, and accountability structure	§3.1	All RBI-regulated entities (banks, NBFCs)	Production-ready	Risk Atlas · Evidence Ledger	Governance framework documentation · Committee approval log
Regulatory status Draft guidance — final pending post-24 Jul 2026 comment period Effective date Final date TBD; implementation expected H1 2027 Source RBI Draft Guidance on Model Risk Management, Jun 2026, §3.1 Zytra coverage Governance framework documentation auto-generated from risk atlas and control assignments. Board approval workflows built into evidence ledger. Role-based access control with committee sign-off tracking.
RBI MRM	Model inventory — complete, current list of all models with risk classification	§3.2	All RBI-regulated entities	Production-ready	Discovery · AI Asset Registry	Model inventory · Risk classification report
Regulatory status Draft — final pending Effective date TBD Source RBI Draft MRM Guidance, §3.2 Zytra coverage Auto-discovery populates inventory including model purpose, owner, risk tier, validation status, and deployment environment. Continuous — not point-in-time. API and agent mesh crawl ensures GenAI and agentic models are captured alongside traditional models.
RBI MRM	Model development standards — documentation, testing, and sign-off requirements pre-deployment	§4.1	All RBI-regulated entities	Production-ready	Governance SDK · Evidence Ledger	Development documentation · Pre-deployment gate log
Regulatory status Draft — final pending Effective date TBD Source RBI Draft MRM Guidance, §4.1 Zytra coverage SDK policy gates enforce pre-deployment documentation checklist: model card complete, risk assessment filed, validation evidence on record, approver sign-off obtained. Gate failures block deployment and log to evidence ledger.
RBI MRM	Model validation — independent validation proportionate to model risk tier	§5.1	All RBI-regulated entities	Production-ready	Assessment Engine · Evidence Ledger	Validation report · Independent assessment evidence
Regulatory status Draft — final pending Effective date TBD Source RBI Draft MRM Guidance, §5.1 Zytra coverage Assessment engine runs automated validation tests against risk atlas controls. Results signed and timestamped in evidence ledger. Supports independent validation workflows: validator assigned separately from model developer, with conflict-of-interest gate in approval chain.
RBI MRM	Model monitoring — ongoing performance and drift monitoring with escalation thresholds	§6.2	All RBI-regulated entities	Production-ready	Continuous Monitoring · Evidence Ledger	Monitoring dashboard · Drift alert log
Regulatory status Draft — final pending Effective date TBD Source RBI Draft MRM Guidance, §6.2 Zytra coverage Configurable escalation thresholds per model tier. Drift alerts routed to model owner with SLA clock. Monitoring evidence auto-exported for RBI inspection on demand. Historical trend data retained 7 years.
RBI MRM	Model risk reporting — board and senior management reporting on AI risk exposure	§7.1	All RBI-regulated entities	Production-ready	Risk Atlas · Evidence Ledger	Board risk report · Residual risk summary
Regulatory status Draft — final pending Effective date TBD Source RBI Draft MRM Guidance, §7.1 Zytra coverage Board reporting pack: residual risk by domain, open issue count and age, validation coverage rate, monitoring alert summary. Generated from live evidence ledger — not manual compilation. Exportable as PDF for board pack and as OSCAL for GRC integration.
NIST AI RMF 1.0 (Jan 2023) · Voluntary framework — four functions: GOVERN, MAP, MEASURE, MANAGE
NIST AI RMF	GOVERN 1.1 — Policies, processes, procedures, and practices are in place to address AI risks	GOVERN 1.1	All AI deployers (voluntary)	Production-ready	Risk Atlas · Evidence Ledger	Policy framework documentation · Control mapping
Regulatory status Voluntary framework — widely used as baseline for regulatory alignment Effective date Published Jan 2023; current version 1.0 Source NIST AI RMF 1.0, GOVERN 1.1 Zytra coverage Risk atlas provides the policy-to-control mapping GOVERN 1.1 requires. Each risk domain has assigned controls, owners, and implementation evidence. Framework crosswalk maps atlas controls to NIST AI RMF subcategories for audit alignment.
NIST AI RMF	MAP 1.1 — Context is established for the AI risk assessment to take place	MAP 1.1	All AI deployers (voluntary)	Production-ready	Risk Atlas · Discovery	Risk context report · Deployment pattern tags
Regulatory status Voluntary Effective date Jan 2023 Source NIST AI RMF 1.0, MAP 1.1 Zytra coverage Discovery establishes deployment context: purpose, affected stakeholders, capability pattern (RAG, agent, classifier), data inputs, and output modality. Context captured in asset registry and used to filter atlas to relevant risks per deployment.
NIST AI RMF	MAP 3.5 — Likelihood, impact, and prioritization of AI risks are documented and communicated	MAP 3.5	All AI deployers (voluntary)	Production-ready	Risk Atlas · Assessment Engine	Risk register · Inherent risk scores · Priority matrix
Regulatory status Voluntary Effective date Jan 2023 Source NIST AI RMF 1.0, MAP 3.5 Zytra coverage Assessment engine scores each risk on impact (4 dimensions) × likelihood (4 factors). Inherent risk matrix produces Critical/High/Medium/Low classification. Priority matrix exported for stakeholder communication and GRC tool integration.
NIST AI RMF	MEASURE 2.3 — AI system performance or assurance criteria are measured	MEASURE 2.3	All AI deployers (voluntary)	Production-ready	Continuous Monitoring · Aval Guardrails	Performance metrics · Benchmark test results
Regulatory status Voluntary Effective date Jan 2023 Source NIST AI RMF 1.0, MEASURE 2.3 Zytra coverage Aval measured on FinProof v1 (0.5% FPR, 11.6ms on RTX 4090) and AgentHarm benchmark. Continuous monitoring tracks live performance metrics. Signed benchmark results exportable as MEASURE 2.3 assurance evidence.
NIST AI RMF	MANAGE 1.3 — Responses to the AI risks deemed unacceptable are prioritized and managed	MANAGE 1.3	All AI deployers (voluntary)	Production-ready	Risk Atlas · Assessment Engine	Risk treatment plan · Remediation tracking log
Regulatory status Voluntary Effective date Jan 2023 Source NIST AI RMF 1.0, MANAGE 1.3 Zytra coverage Risk atlas flags Critical and High residual risks for treatment. Assessment engine generates recommended control actions. Remediation tracking: owner assigned, timeline set, implementation evidence required before closure. Unacceptable residual risks trigger escalation workflow to risk committee.
DPDP Act 2023 (India) · Notified 13 Nov 2025 · Consent Manager provisions: 13 Nov 2026 · Processing obligations / rights / penalties: 13 May 2027
DPDP Act	Consent — free, specific, informed, unconditional consent before processing personal data	§6	Data fiduciaries processing personal data of Indian residents	Planned	Privacy Controls	Consent audit log · Withdrawal evidence
Regulatory status Notified 13 Nov 2025; processing obligations effective 13 May 2027 Effective date 13 May 2027 (processing obligations) Source Digital Personal Data Protection Act 2023, §6; MeitY notification Nov 2025 Zytra coverage Planned: consent management integration for AI inference pipelines processing personal data. Consent Consent Manager provisions active from 13 Nov 2026 — Zytra roadmap targets Q4 2026 for consent audit log and withdrawal tracking.
DPDP Act	Data fiduciary obligations — accuracy, completeness, and purpose limitation for processed data	§8	Data fiduciaries processing personal data	Production-ready	Evidence Ledger · Continuous Monitoring	Data processing log · Purpose limitation audit trail
Regulatory status Notified Nov 2025; processing obligations effective 13 May 2027 Effective date 13 May 2027 Source DPDP Act 2023, §8 Zytra coverage Evidence ledger tracks every AI inference that involves personal data: input data category, processing purpose, model used, output disposition. Purpose limitation enforced at policy gate level via SDK. In-tenant deployment ensures data does not leave the institution's cloud boundary.
DPDP Act	Data principal rights — right to access, correction, erasure, and grievance redressal	§12–13	Data fiduciaries processing personal data	Planned	Privacy Controls	Rights request log · Erasure confirmation
Regulatory status Rights provisions effective 13 May 2027 Effective date 13 May 2027 Source DPDP Act 2023, §12–13 Zytra coverage Planned: data subject rights workflow — access requests, correction workflows, and erasure pipelines integrated with AI model inputs and outputs. Target: Q2 2027 ahead of effective date.
DPDP Act	Data Protection Board — complaint mechanism and regulatory inquiry response capability	§16	Significant data fiduciaries	Production-ready	Evidence Ledger	Regulatory inquiry pack · Processing evidence export
Regulatory status Board established; complaint mechanism operative from notification date Effective date 13 Nov 2025 (board provisions) Source DPDP Act 2023, §16 Zytra coverage Evidence ledger generates on-demand regulatory inquiry packs: all AI processing events for a named data principal, with timestamps, purpose declarations, and control evidence. Exportable as PDF for Data Protection Board submissions.
DPDP Act	Exemptions — research, statistical, and archival purposes; national security carve-outs	§17	Research, statistical, and public-interest processors	Production-ready	Risk Atlas	Exemption classification record · Legitimate interest assessment
Regulatory status Notified Nov 2025 Effective date 13 Nov 2025 Source DPDP Act 2023, §17 Zytra coverage Risk atlas includes exemption classification for each AI use case: research/statistical/archival exemption claims documented with supporting rationale and reviewed annually. Legitimate interest assessments stored in evidence ledger.
SEBI Circular on AI/ML in Securities Market (2024) · Applies to SEBI-registered intermediaries using AI/ML for trading, surveillance, and client-facing systems
SEBI	Risk management — AI risk governance framework for market intermediaries	§3	SEBI-registered intermediaries using AI/ML	Production-ready	Risk Atlas · Assessment Engine	Market risk classification · Control effectiveness report
Regulatory status Mandatory for SEBI-registered intermediaries — in force Effective date Per SEBI circular date Source SEBI Circular on Algorithmic and AI Trading, §3 Zytra coverage Risk atlas includes SEBI-specific risk domain for market integrity, algorithmic risk, and manipulation detection. Assessment engine scores AI trading systems against SEBI risk criteria. Control effectiveness scores exportable for SEBI inspection.
SEBI	Algorithm accountability — explainability and auditability of AI/ML models used in trading	§4	SEBI-registered intermediaries	Production-ready	Governance SDK · Evidence Ledger	Algorithm audit log · Explainability report
Regulatory status Mandatory — in force Effective date Per SEBI circular date Source SEBI Circular, §4 Zytra coverage Algorithm accountability: SDK wraps trading model inference with structured audit events — inputs, outputs, confidence scores, and policy check results. Hash-chained log satisfies SEBI explainability and auditability requirements. Exportable per order or batch.
SEBI	Surveillance — real-time monitoring for market manipulation and anomalous AI behaviour	§5	SEBI-registered intermediaries	Production-ready	Continuous Monitoring · Aval Guardrails	Real-time alert log · Anomaly detection report
Regulatory status Mandatory — in force Effective date Per SEBI circular date Source SEBI Circular, §5 Zytra coverage Aval detects policy violations in real time at 11.6ms. Continuous monitoring layer tracks volume anomalies, drift, and out-of-pattern AI behaviour. Alerts routed to compliance and risk teams. Alert log retained and exportable for SEBI surveillance submissions.
SEBI	Audit trail — complete, tamper-evident trail of all AI-driven trading decisions	§6	SEBI-registered intermediaries	Production-ready	Evidence Ledger · Audit Trail	Hash-chained audit trail · Trade decision log
Regulatory status Mandatory — in force Effective date Per SEBI circular date Source SEBI Circular, §6 Zytra coverage Append-only structured log captures every AI-driven trading decision: model, inputs, output, confidence, policy check outcome. SHA-256 hash chain provides tamper evidence. 5-year retention. On-demand export for SEBI inspection teams.
ISO/IEC 42001:2023 (AI Management System) · Voluntary standard — certifiable by accredited bodies
ISO 42001	Context of the organization — AI system boundaries, interested parties, and internal/external issues	§4.1	Organizations implementing AI management system	Production-ready	Risk Atlas · Discovery	AI portfolio context document · Stakeholder map
Regulatory status Voluntary international standard — certifiable Effective date Published Dec 2023; current version 2023 Source ISO/IEC 42001:2023, §4.1 Zytra coverage Discovery maps AI system boundaries: every model, agent, and pipeline with its interfaces, data inputs, and output dependencies. Stakeholder map generated from organizational roles in asset registry. Context document auto-generated for §4.1 audit readiness.
ISO 42001	Leadership & commitment — top management demonstrates AI governance leadership and resources	§5.1	Organizations implementing AI management system	Production-ready	Risk Atlas · Evidence Ledger	Board commitment log · Resource allocation evidence
Regulatory status Voluntary — certifiable Effective date Dec 2023 Source ISO/IEC 42001:2023, §5.1 Zytra coverage Evidence ledger captures board-level AI governance decisions: policy approvals, risk appetite statements, resource allocations, and committee minutes. Signed timestamps provide §5.1 leadership commitment evidence for certification audits.
ISO 42001	Risk & opportunity assessment — systematic identification and evaluation of AI risks and opportunities	§6.1	Organizations implementing AI management system	Production-ready	Risk Atlas · Assessment Engine	Risk assessment report · Opportunity register
Regulatory status Voluntary — certifiable Effective date Dec 2023 Source ISO/IEC 42001:2023, §6.1 Zytra coverage Assessment engine systematically evaluates inherent risk × control effectiveness = residual risk per domain. Opportunity register tracks where AI deployment can create value within risk tolerance. Full §6.1 risk assessment exportable as structured report for certification body review.
ISO 42001	AI system impact assessment — process for assessing impact of AI systems on individuals and society	§8.4	Organizations implementing AI management system	Production-ready	Assessment Engine · Evidence Ledger	Impact assessment report · Harm mitigation log
Regulatory status Voluntary — certifiable Effective date Dec 2023 Source ISO/IEC 42001:2023, §8.4 (AI system impact assessment) Zytra coverage Assessment engine evaluates individual and societal impact dimensions per AI system: bias, fairness, safety, privacy, and autonomy effects. Impact assessment report covers affected populations, harm pathways, and mitigation measures. Stored in evidence ledger with periodic review schedule.
ISO 42001	Monitoring, measurement, analysis & evaluation — performance against AI management objectives	§9.1	Organizations implementing AI management system	Production-ready	Continuous Monitoring · Evidence Ledger	Performance dashboard · Measurement evidence pack
Regulatory status Voluntary — certifiable Effective date Dec 2023 Source ISO/IEC 42001:2023, §9.1 Zytra coverage Continuous monitoring tracks KPIs against AI management objectives. Measurement results stored in evidence ledger with analysis summaries. §9.1 evidence pack auto-generated: objective, metric, result, trend, and evaluation conclusion per measurement period.
ISO 42001	Improvement — continual improvement of AI management system based on evaluation results	§10.1	Organizations implementing AI management system	Planned	Risk Atlas · Governance SDK	Improvement action log · Corrective action evidence
Regulatory status Voluntary — certifiable Effective date Dec 2023 Source ISO/IEC 42001:2023, §10.1 Zytra coverage Planned: closed-loop improvement workflow — assessment results trigger corrective action items, assigned to owners, tracked to closure. Improvement action log feeds back into risk atlas control effectiveness scores. Target: Q2 2027.

See how your controls map

Upload your current control framework and Zytra maps it against all 40 obligations — showing gaps, owners, and missing evidence.

Request a mapping session Explore the governance platform