AI compliance frameworks: a dossier for Qpoint policy and evidence mapping

As of: 2026-10-26. Prepared for: Qpoint design (AI governance product: network/eBPF observation of AI providers, models, coding agents/harnesses, MCP servers, users and data flows on endpoints, plus enforcement: provider allow/block lists, sensitive-data redaction, MCP server gating).

How to read this. Each framework has six parts: (a) identity and status, (b) native structure, (c) who asks for it, (d) how evidence works, (e) what Qpoint can and cannot evidence, (f) official crosswalks. Every claim is tagged with its source. V means verified on a primary source during this research. S means it rests on secondary sources (law firms, CPA firms, vendors) that agree with each other. K means it comes from stable background knowledge of a published text that I did not re-fetch. UNVERIFIED means I could not confirm it. Strength ratings in (e) are strong (Qpoint data can be the main evidence), partial (one input among several, or covers only the AI-usage slice) and none.

Headline changes since mid-2025 (the points most likely to be out of date in anyone's head):

1. OWASP published a 2026 LLM Top 10 on 3 Aug 2026 and re-ranked it. Excessive Agency moved to #3, and System Prompt Leakage became Hidden Context Exposure. The Agentic Top 10 (ASI01–ASI10) came out on 9 Dec 2025. OWASP also launched an Agent Control Standard (v0.1, Sep 2026), which is very close to what Qpoint does.
2. The EU AI Act "Digital Omnibus on AI" is law. It is Regulation (EU) 2026/1744, dated 8 Jul 2026, published in the Official Journal on 24 Jul 2026 and in force since 27 Jul 2026. Annex III high-risk obligations move to 2 Dec 2027 and Annex I obligations to 2 Aug 2028. Article 50 transparency was not delayed (2 Aug 2026), though Art. 50(2) marking has a grace period to 2 Dec 2026 for legacy systems. The Art. 4 AI-literacy duty was softened to "support".
3. CSA AICM is now v1.1 (Jun/Jul 2026), with 247 controls in 18 domains and a new AIUC-1 mapping. STAR for AI Level 2 has been live since Nov 2025, and STAR now carries the AIUC-1 trustmark (Jun 2026).
4. AIUC-1 is on its Q4-2026 release (15 Oct 2026). It has about 50 active requirements across domains A–F. Schellman (first accredited) and Coalfire are named auditors, and Cursor, Fin, ElevenLabs, Harvey, UiPath, KPMG and Sierra are certified.
5. NIST: AI RMF 1.0 is "being revised" with no new text yet. The Cyber AI Profile (IR 8596) is still a preliminary draft (Dec 2025). The SP 800-53 AI overlays project was renamed on 20 Oct 2026 from COSAiS to "Control Overlays for Super Intelligence Systems (COSIS)" after a 29 Sep 2026 executive order on terminology. No overlay has a public draft yet.
6. HITRUST CSF v11.9.0 (24 Sep 2026) added an OWASP Agentic Top 10 mapping and an "Agentic AI" factor to the AI Security Certification.
7. AICPA has issued no AI-specific SOC 2 criteria or points of focus. The 2017 TSC with the 2022 points of focus is still the operative text.
8. EU CRA reporting obligations went live on 11 Sep 2026, through ENISA's Single Reporting Platform. Full application is 11 Dec 2027.

1. OWASP Top 10 for LLM Applications (2026) and OWASP Top 10 for Agentic Applications (2026)

(a) Identity and status

• Issuer: OWASP GenAI Security Project (the former OWASP LLM Top 10 project).
• LLM Top 10: the current edition is "OWASP Top 10 for LLM Applications 2026", released 3 Aug 2026 and formally unveiled 1–2 Sep 2026 alongside the Agent Control Standard. V: resource page dated 3 Aug 2026; list S The 2025 edition (Nov 2024) is still the one shown on the genai.owasp.org/llm-top-10/ landing page, so expect customers and auditors to cite either. V
• Agentic Top 10: "OWASP Top 10 for Agentic Applications for 2026", released 9 Dec 2025 under the Agentic Security Initiative. V date; list S
• Kind of thing: a risk taxonomy with community consensus and incident-weighted ranking. It is not a control framework and has nothing to certify against.
• Also new: the OWASP Agent Control Standard (ACS) v0.1 (donated in Sep 2026). It defines "guardian agent" enforcement points, an observability layer that traces agent events over OpenTelemetry and OCSF, and an Agent Bill of Materials (AgBOM) in CycloneDX, SPDX or SWID. Later versions are planned to add deny and modify enforcement across MCP and A2A. S: CSA research note; repo github.com/GenAI-Security-Project/agent-control-standard This is the OWASP artifact closest to Qpoint's product shape and worth tracking directly.

(b) Native structure

LLM Top 10, 2026 (with each entry's 2025 position). The order agrees across the CSA research note and Imperva. I could not open the OWASP PDF, so the order is S.

The 2025 list, for reference V: LLM01 Prompt Injection, LLM02 Sensitive Information Disclosure, LLM03 Supply Chain, LLM04 Data and Model Poisoning, LLM05 Improper Output Handling, LLM06 Excessive Agency, LLM07 System Prompt Leakage, LLM08 Vector and Embedding Weaknesses, LLM09 Misinformation, LLM10 Unbounded Consumption.

Agentic Top 10, 2026 S: consistent across many secondary sources; the OWASP page itself only names "Agent Behavior Hijacking", "Tool Misuse and Exploitation" and "Identity and Privilege Abuse" as highlights:

Watch for old numbering. An early-2025 draft of the agentic threat list put Memory Poisoning at #1, and it is still cited. S The unit of requirement is one risk entry, each with a description, example attack scenarios, prevention and mitigation strategies, and references.

(c) Who asks and why

• AppSec and product-security teams use it as threat-model scaffolding.
• Pen-test and red-team firms use it as a test-case catalogue.
• Buyer security questionnaires ask "how do you address the OWASP LLM Top 10?"
• Other frameworks reference it: AIUC-1 crosswalks to both lists, HITRUST v11.9 maps the agentic list, and CSA AICM cites OWASP.
• It is not demanded by regulators or auditors directly. It is the shared vocabulary that the other frameworks borrow.

(d) How evidence works

• There is no attestation and no certification. Evidence is a mapping of each risk to controls plus test results (red-team reports, scans) and runtime telemetry.
• A buyer typically wants a per-item table ("risk → our control → proof").

(e) What Qpoint can evidence

Never covered: model training, model internals, UI/UX trust design, and downstream application code.

(f) Crosswalks

• The 2026 LLM Top 10 "maps risks to NIST, MITRE ATLAS, CWE, and the OWASP Top 10 for Agentic Applications". V, resource page
• OWASP published a GenAI Security Industry Framework Crosswalk (1 Sep 2026). V, listed; contents not inspected
• Third-party crosswalks: AIUC-1 maps to both lists at threat level V; HITRUST CSF v11.9 maps the Agentic Top 10 V.
• OWASP↔MITRE ATLAS: there is no standalone official MITRE crosswalk. The mapping lives inside the OWASP 2026 document V claim; S detail.
• ATLAS has been updated for agents (context and memory poisoning, agent config tampering, tool-based exfiltration, early 2026). Current counts conflict across sources (around 16 tactics, 84–114 techniques). UNVERIFIED counts

Sources: https://genai.owasp.org/llm-top-10/ · https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/ · https://genai.owasp.org/2026/09/01/owasp-genai-security-project-unveils-2026-top-10-for-llm-applications-new-agent-control-standard-and-sponsors-as-community-tops-30000-members/ · https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/ · https://genai.owasp.org/2025/12/09/owasp-genai-security-project-releases-top-10-risks-and-mitigations-for-agentic-ai-security/ · https://labs.cloudsecurityalliance.org/research/csa-research-note-owasp-genai-top10-2026-agent-control-stand/ · https://www.imperva.com/blog/owasp-llm-top-10-2026-what-changed/ · https://cycode.com/blog/owasp-top-10-agentic-applications/ · https://docs.modulos.ai/frameworks/owasp-top-10-agentic

2. NIST AI Risk Management Framework (AI RMF 1.0, NIST AI 100-1), the Generative AI Profile (NIST AI 600-1) and the NIST AI cybersecurity work

(a) Identity and status

• AI RMF 1.0 was published on 26 Jan 2023. It is voluntary and final. NIST's page now says: "The AI RMF 1.0 is being revised as part of the White House AI Action Plan." No revised draft has been published. V
• A concept note for an AI RMF Profile on Trustworthy AI in Critical Infrastructure was released on 7 Apr 2026. V
• NIST AI 600-1, Generative AI Profile: final, 26 Jul 2024. No revision was found. V date; S no-revision
• Kind of thing: a risk-management framework, voluntary and outcome-based. It cannot be certified against.
• Cyber AI Profile, NIST IR 8596: a CSF 2.0 Community Profile. The initial preliminary draft is dated 16 Dec 2025, and comments closed 30 Jan 2026. It has three focus areas: Secure (securing AI system components), Defend (AI-enabled cyber defence) and Thwart (thwarting AI-enabled attacks). Working sessions ran Apr–May 2026, and no initial public draft or final had been published as of this check. V
• SP 800-53 control overlays for AI. The project was formerly COSAiS. On 20 Oct 2026 NIST renamed it "SP 800-53 Control Overlays for Super Intelligence Systems (COSIS)", citing the 29 Sep 2026 Executive Order "Inaugurating the Era of Super Intelligence" (reported as EO 14434). The order tells agencies to use "Super Intelligence/SI" instead of "AI" in non-statutory documents. V: CSRC page; EO existence V via whitehouse.gov search results; EO number S
  • Milestones: concept paper on 14 Aug 2025, then an annotated outline for the predictive overlay on 8 Jan 2026 (feedback by 13 Feb 2026). There is no initial public draft of any overlay yet. V
  • Planned overlays: Generative SI (LLM assistant), Predictive SI, Single-agent, Multi-agent, and Security controls for SI developers. V The predictive outline assumes the SP 800-53B moderate baseline is already in place. S
  • Design implication: US federal artefacts after October 2026 may say "SI" where they used to say "AI". Keep AI RMF identifiers as they are, because previously issued documents were not altered. V

(b) Native structure

AI RMF: 4 functions → 19 categories → 72 subcategories (GOVERN 6 categories with 19 subcategories, MAP 5 with 18, MEASURE 4 with 22, MANAGE 4 with 13). K

AI 600-1 lists 12 GenAI risks K; S agrees on the count:

1. CBRN Information or Capabilities
2. Confabulation
3. Dangerous, Violent or Hateful Content
4. Data Privacy
5. Environmental Impacts
6. Harmful Bias and Homogenization
7. Human-AI Configuration
8. Information Integrity
9. Information Security
10. Intellectual Property
11. Obscene, Degrading and/or Abusive Content
12. Value Chain and Component Integration

It also gives about 200 suggested actions, each keyed to an AI RMF subcategory (format like GV-1.6-001).

(c) Who asks and why

• US federal agencies and contractors (OMB AI memos reference it).
• US state laws: Colorado's AI Act and a Texas statute give an affirmative defence or safe harbour for conformance with a recognised framework such as the AI RMF. S
• Enterprise risk, GRC and model-risk teams, and boards wanting a common language.
• Buyer questionnaires ("do you align to NIST AI RMF?").

(d) How evidence works

• Self-assessment. There is no certification or accredited auditor. Organisations build a current-state and target-state profile, map controls to subcategories, and keep artefacts (policies, inventories, risk registers, monitoring records).
• Internal audit or third parties may give an "alignment assessment", which is advisory only.
• Evidence expectation: documented processes plus records showing they run.

(e) What Qpoint can evidence

Never covered:

• GOVERN 2–5 (people, culture, diversity, stakeholder engagement).
• MAP 1–3 and MAP 5 (context, categorisation, impacts on society).
• MEASURE 2 trustworthiness testing (bias, validity, explainability).
• 600-1 risks: CBRN, Confabulation, Environmental, Bias, Obscene and Information-Integrity content.

(f) Crosswalks

• NIST's AI Resource Center (airc.nist.gov) hosts crosswalks, including AI RMF ↔ ISO/IEC 42001 (community-submitted; reportedly Microsoft-contributed, 72 rows, one per subcategory, hosted without endorsement) and AI RMF ↔ ISO/IEC 23894. Other crosswalks cover OECD and the EU AI Act. S; airc page not fetched
• AI 600-1 is mapped by CSA AICM (official download) V and by AIUC-1 at function level V.
• IR 8596 is organised on CSF 2.0 outcomes V, so it inherits CSF's mappings to SP 800-53 and others.

Sources: https://www.nist.gov/itl/ai-risk-management-framework · https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf · https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-generative-artificial-intelligence · https://csrc.nist.gov/pubs/ir/8596/iprd · https://csrc.nist.gov/projects/cosais (now titled COSIS) · https://csrc.nist.gov/csrc/media/Projects/cosais/documents/COSAiS-Predictive-AI-annotated-outline-Jan2026.pdf · https://www.whitehouse.gov/presidential-actions/2026/09/inaugurating-the-era-of-super-intelligence/ · https://www.nccoe.nist.gov/news-insights/comment-save-date-now-nist-cyber-ai-profile-preliminary-draft-workshop

3. SOC 2 (AICPA Trust Services Criteria)

(a) Identity and status

• Criteria: 2017 Trust Services Criteria for Security, Availability, Processing Integrity, Confidentiality, and Privacy (With Revised Points of Focus – 2022). The current download page is dated 30 Sep 2023. V
• Issuer: AICPA Assurance Services Executive Committee (ASEC). The examination is performed under the attestation standards (AT-C 105/205) and the SOC 2 Guide.
• Kind of thing: attestation criteria that a licensed CPA firm uses to give an opinion. It is not a certification.
• AI-specific guidance: none.
  • The AICPA has issued no AI-specific TSC, no AI points of focus and no authoritative AI addendum, and no exposure draft proposes them. S: CSA research note Aug 2026; several CPA firms The AICPA download page shows no newer version or AI guidance. V
  • The only AICPA AI document of 2026 is the Forensic & Valuation Services Guidelines for Responsible Use of AI. It is non-authoritative and about CPAs' own use of AI. S
  • The 2026 attestation proposals (AT-C 105/205/210 revisions plus sustainability sections) don't touch the TSC. S
  • Practice reality: "the criteria didn't change, but the examination did". Auditors fold AI into CC3, CC6, CC7, CC9 and PI1. S
• AI-flavoured SOC 2 route: CSA's STAR for AI Level 2 "SOC 2 + AICM" attestation (route a6). Guidance for CPAs on STAR/STAR for AI attestation was published in Mar 2026. V route; S guidance

(b) Native structure

The unit is a criterion, illustrated by points of focus. Points of focus are not required. K/S

That is 33 common criteria (CC1–CC5 follow COSO 2013's 17 principles). The additional categories are A1.1–1.3 (Availability), C1.1–1.2 (Confidentiality), PI1.1–1.5 (Processing Integrity) and P1–P8 (Privacy, 18 criteria). Security (the CCs) is mandatory; the others are optional per engagement.

(c) Who asks and why

• Buyers' vendor-risk and procurement teams ask for the SOC 2 Type 2 report of every SaaS vendor. It is the US enterprise default.
• The company's own auditors and board.
• Increasingly, buyers append AI questionnaires and expect AI subprocessors (LLM providers) to be listed. S
• For Qpoint this works two ways:
  1. Customers will demand Qpoint's own SOC 2, because Qpoint becomes a vendor in their CC9.2 and possibly a subservice organisation.
  2. Customers use Qpoint as a control inside their own SOC 2 scope, for example "we monitor and restrict employee use of unapproved AI services".

(d) How evidence works

• Type 1 covers design at a point in time. Type 2 covers design and operating effectiveness over a period, typically 3–12 months.
• The auditor tests controls by inquiry, observation, inspection and re-performance, and samples from complete populations.
• System-generated reports count as "information produced by the entity" (IPE), so the auditor must establish completeness and accuracy: query parameters, the full population, timestamps and tamper-evidence.
• Exceptions are reported. Management writes the system description; the auditor issues an opinion.
• Design implication: Qpoint exports should be IPE-grade, meaning reproducible queries, full-population CSVs, period-bounded, hashed or immutable, and showing policy version at time of event.

(e) What Qpoint can evidence (for the customer's SOC 2)

Never covered: CC1 (tone at the top, board oversight, HR), CC2.2–2.3 (communications), CC8 change management of the customer's own models, availability, and physical security.

(f) Crosswalks

• AICPA publishes mappings of the 2017 TSC to ISO/IEC 27001, NIST CSF, NIST SP 800-53, COBIT and others. Whether the ISO mapping covers 27001:2022 Annex A is UNVERIFIED; the file name references the 2017 TSC, and the overlap is about 80% per secondary sources. S
• AIUC-1 publishes a SOC 2 crosswalk at criteria level. V
• CSA's STAR for AI has a SOC 2 + AICM attestation path. V
• HITRUST maps to SOC 2 through its "SOC 2 + HITRUST" reporting. K

Sources: https://www.aicpa-cima.com/resources/download/2017-trust-services-criteria-with-revised-points-of-focus-2022 · https://labs.cloudsecurityalliance.org/research/csa-research-note-soc2-ai-controls-gap-20260830-csa-styled/ · https://www.aprio.com/insights-events/soc-2-and-ai-in-2026-the-criteria-didnt-change-but-the-examination-did-ins-article/ · https://www.brightdefense.com/news/aicpa-advances-2026-attestation-changes-for-soc-2/ · https://cloudsecurityalliance.org/star/ai/

4. AIUC-1 (Artificial Intelligence Underwriting Company standard for AI agents)

(a) Identity and status

• Issuer: the Artificial Intelligence Underwriting Company (AIUC). First launched on 22 Jul 2025. V
• Releases are quarterly: 1 Oct 2025, 15 Jan 2026, 15 Apr 2026, 15 Jul 2026 and 15 Oct 2026 (Q4-2026, current). The next is due 15 Jan 2027. V
• Kind of thing: a certification standard for AI agents and products (security, safety and reliability). It combines an accredited third-party audit of controls with AIUC-run technical testing (red-teaming, typically 1,000–5,000 scenarios) and quarterly re-tests.
• The certificate covers named agents or products, not the whole company. It is valid 1 year, with the standard version locked for that year. V
• Auditors: Schellman, described as the first accredited AIUC-1 auditor (announced 3 Feb 2026; one guide says accreditation dates from 1 Nov 2025). Coalfire is also named on aiuc-1.com. AIUC issues the certificate. V/S
• Certified (per aiuc-1.com, Oct 2026): Cursor, Fin (Intercom), ElevenLabs, Harvey, UiPath, KPMG (one of its products) and Sierra (17 Sep 2026). MSCI is listed as an adopter, not as certified. V
• CSA STAR integration (30 Jun 2026): STAR Registry listings can carry the "AIUC-1 AI Agent Trustmark". V
• Insurance tie-in: AIUC's model links certification to underwriting of AI-agent liability. It is the only framework here built with an insurer's lens. K/S

(b) Native structure

• Six domains, each split into requirements (ids such as A001), each split into controls (ids such as D003.4).
• Requirements are Mandatory or Optional.
• Controls are tagged core or supplemental, and Q4-2026 added developer-vs-deployer guidance.

The table below is the active requirement list as of Q4-2026 V: standard.aiuc-1.com domain pages:

That makes about 50 active requirements (my count from the domain pages; AIUC doesn't state a total). Q4-2026 also added open-weight model controls: source, integrity and licence verification, regression testing after fine-tuning or quantisation, and cyber-misuse capability assessment after modification. V

(c) Who asks and why

• Enterprise buyers of AI agents (procurement and security due diligence) ask vendors for it as the agent-specific complement to SOC 2.
• Insurers and underwriters, which is AIUC's thesis.
• The agent vendors themselves seek it as a sales accelerator.
• For a Qpoint customer (an AI deployer), AIUC-1 is mostly a thing they ask their AI vendors for, not something they certify. The exception is customers who ship their own agents.

(d) How evidence works

• Four steps: scoping → AIUC technical evals (red-team) → accredited auditor reviews control evidence → AIUC certifies. V
• Typical evidence: policies (ToS, privacy policy and DPA for A001 S), configuration, logs, test reports, and quarterly re-test results.
• It is a hybrid of attestation-style audit and product testing.

(e) What Qpoint can evidence

Two use-cases here: (i) a customer that builds or deploys an agent and seeks AIUC-1, and (ii) a customer using Qpoint data to verify a certified vendor's claims in their environment.

Never covered: model behaviour testing (AIUC's own evals), output content safety and failure-plan documentation.

(f) Crosswalks (14, official, on standard.aiuc-1.com/crosswalks)

• EU AI Act (article level), NIST AI RMF (function level), ISO 42001 (clause level), MITRE ATLAS (mitigation level), CSA AICM (control level), OWASP LLM Top 10 and OWASP Agentic Top 10 (threat level), OWASP AIVSS, IBM AI Risk Atlas, Cisco AI Security & Safety Framework, NYC LL144, Colorado AI Act, California SB 53, and SOC 2 (criteria level). V
• In the other direction, CSA's AICM v1.1 includes an AICM→AIUC-1 mapping. V

Sources: https://www.aiuc-1.com/ · https://standard.aiuc-1.com/ · https://standard.aiuc-1.com/data-and-privacy/ · https://standard.aiuc-1.com/security/ · https://standard.aiuc-1.com/safety/ · https://standard.aiuc-1.com/reliability/ · https://standard.aiuc-1.com/accountability/ · https://standard.aiuc-1.com/society/ · https://standard.aiuc-1.com/changelog.md · https://standard.aiuc-1.com/crosswalks/index · https://www.schellman.com/blog/news/schellman-becomes-the-first-accredited-auditor-for-aiuc-1 · https://cloudsecurityalliance.org/press-releases/2026/06/30/csa-extends-leadership-into-agentic-ai-with-addition-of-aiuc-1-certification-to-star-registry · https://help.drata.com/en/articles/17312936-aiuc-1-version-updates-which-version-you-ll-see-and-when

5. CSA AI Controls Matrix (AICM) and STAR for AI

(a) Identity and status

• Issuer: Cloud Security Alliance.
• AICM v1.0: released 9 Jul 2025, updated 30 Oct 2025, with 243 control objectives.
• AICM v1.1 is current. The artifact page gives 22 Jun 2026 and the CSA blog is dated 14 Jul 2026. It has 247 control objectives across 18 domains, synced to CCM v4.1, and the AI-CAIQ grew to 320 questions. V
• Kind of thing: a controls matrix, a superset of the Cloud Controls Matrix (CCM). Assessment runs through STAR for AI.
• STAR for AI V:
  • Level 1, self-assessment (a1): submit an AI-CAIQ to the STAR Registry.
  • Level 1, Valid-AI-ted (a2): automated AI scoring of the AI-CAIQ, giving a badge.
  • Level 2, launched 20 Nov 2025: requires a Valid-AI-ted AI-CAIQ plus a third-party route. The routes are ISO 27001 + AICM (a3), 27001 + 42001 + AICM (a4), 42001 + AICM (a5) or SOC 2 + AICM attestation (a6).
  • First Level 2 holders were Microsoft and Zendesk. Oracle SaaS is listed from Jan 2026.
  • STAR also displays the AIUC-1 trustmark (Jun 2026).

(b) Native structure

The unit is a control objective (for example AIS-15). Each one carries:

• control type (AI-specific, AI-related or cloud-only; v1.0 split them roughly 37 / 183 / 22 S),
• applicability and ownership across the shared-responsibility roles: Model Provider (MP), Orchestrated Service Provider (OSP), Application Provider (AP), AI Customer (AIC), Cloud Service Provider (CSP) V,
• architectural relevance,
• LLM lifecycle relevance,
• threat category.

Each role has its own implementation and auditing guidelines. V

The 18 domains. These are the 17 CCM v4 domains plus Model Security. The names come from CCM v4 lineage K. Multiple sources confirm Model Security, Universal Endpoint Management, Logging and Monitoring, and Interoperability & Portability as AICM domains S, and v1.1 renamed IVS to Infrastructure Security (I&S) V.

AI-specific controls named by CSA include AIS-15 (prompt injection), MDS-13 (secure model serialization), DSP-24 (training-data relevance), SEF-04 (AI incident-response testing) and STA-09 (service bill of materials). V

(c) Who asks and why

• Cloud and AI buyers' vendor-risk teams. The AI-CAIQ is the AI equivalent of the CAIQ questionnaire that many enterprises already accept.
• Regulated industries wanting one matrix that maps to ISO 42001, the EU AI Act and NIST.
• Vendors seeking a STAR for AI listing as a market signal.
• The shared-responsibility tagging is what makes AICM useful for Qpoint's customers: they are "AI Customers" (AIC) and sometimes "Application Providers" (AP).

(d) How evidence works

• Level 1 is self-attestation (AI-CAIQ answers, optionally scored by Valid-AI-ted).
• Level 2 is a third-party ISO certification audit by an accredited certification body with AICM in scope, or a CPA SOC 2 attestation with AICM criteria added (CSA guidelines for CPAs, Mar 2026).
• Auditors use the per-role auditing guidelines.

(e) What Qpoint can evidence (CCM-lineage IDs; check exact numbering against the v1.1 spreadsheet, UNVERIFIED at ID level)

Never covered: Model Provider-owned controls (most of MDS, training-data DSP-24), datacenter and HR controls.

(f) Crosswalks (official downloads)

• ISO/IEC 42001:2023, BSI AIC4, NIST AI 600-1 (and AI RMF), the EU AI Act, and AIUC-1 (new in v1.1), each with gap analysis. ISO 27001 is named as mapped. V
• CCM v4.1 itself maps to ISO 27001/27002/27017/27018, NIST 800-53, PCI DSS, CIS and others. K

Sources: https://cloudsecurityalliance.org/artifacts/ai-controls-matrix/ · https://cloudsecurityalliance.org/artifacts/ai-controls-matrix-v1-1 · https://cloudsecurityalliance.org/blog/2026/07/14/ai-controls-matrix-v1-1-strengthening-the-foundation-for-trustworthy-ai · https://labs.cloudsecurityalliance.org/research/csa-research-note-aicm-v1-1-update-20260730-csa-styled/ · https://cloudsecurityalliance.org/star/ai/ · https://cloudsecurityalliance.org/articles/cloud-security-alliance-announces-availability-of-star-for-ai-level-2-and-valid-ai-ted-for-ai · https://cloudsecurityalliance.org/artifacts/aicmv1-1-implementation-guidelines-for-model-providers-mp

6. ISO/IEC 42001:2023 (AI management system) and its companions 42005 and 42006

(a) Identity and status

• ISO/IEC 42001:2023, Information technology, Artificial intelligence, Management system, first edition, Dec 2023, from ISO/IEC JTC 1/SC 42. It is final.
• Kind of thing: a certifiable management-system standard (Annex SL harmonised structure).
• Amendment status: no amendment or revision found. S
  • Sources disagree on whether 42001 was among the 31 standards that got the Feb 2024 "climate action" amendment (clauses 4.1/4.2). AFNOR's list omits it, and one law firm says 42001 was published with the text already included. UNVERIFIED
  • iso.org returned 403 to automated fetch, so the catalogue was not checked directly.
  • Implementation guidance, ISO/IEC 42003, is reported as an early work item. S
• ISO/IEC 42005:2025, AI system impact assessment guidance, published May 2025. S: SCC database
• ISO/IEC 42006:2025, requirements for bodies auditing and certifying 42001 (it adds to ISO/IEC 17021-1), published Jul 2025. S
  • European co-operation for Accreditation (EA) voted on 20 Nov 2025 to make 42006 mandatory for accrediting AIMS certification bodies. ANAB lists it as required. S
• Certification ecosystem 2026 S:
  • BSI holds ANAB, UKAS and RvA accreditation (ANAB in Mar 2026).
  • Other ANAB-accredited certification bodies are reportedly Schellman, A-LIGN, Coalfire, SGS, DEKRA, TÜV and ControlCase (Aug 2026). Check the ANAB directory.

(b) Native structure K

• Clauses 4–10 are the requirements ("shall"):
  • 4 Context (incl. 4.3 scope and 4.4 the AIMS)
  • 5 Leadership (5.2 AI policy, 5.3 roles)
  • 6 Planning (6.1.2 AI risk assessment, 6.1.3 AI risk treatment plus Statement of Applicability, 6.1.4 AI system impact assessment, 6.2 objectives)
  • 7 Support (resources, competence, awareness, communication, 7.5 documented information)
  • 8 Operation (8.1 operational planning and control, incl. externally provided processes; 8.2–8.4 risk assessment, treatment and impact assessment in operation)
  • 9 Performance evaluation (9.1 monitoring, 9.2 internal audit, 9.3 management review)
  • 10 Improvement (nonconformity and corrective action)
• Annex A (normative), 9 objectives, 38 controls:

• Annex B gives implementation guidance, Annex C lists AI objectives and risk sources, and Annex D covers use across sectors.
• The organisation selects controls through the SoA (exclusions must be justified). The role-agnostic design covers AI providers, producers and users.

(c) Who asks and why

• Enterprise buyers, especially in the EU and in finance, ask vendors for it as the "ISO 27001 for AI".
• It is a prerequisite for CSA STAR for AI Level 2 (a4/a5).
• Organisations use it to show "presumption-like" governance maturity towards the EU AI Act. A harmonised QMS standard under the AI Act is separate (CEN-CENELEC JTC 21); 42001 is not a harmonised standard.
• Deployers (AI users) certify too, scoping the AIMS to their use of AI.

(d) How evidence works

• Third-party certification by an accredited certification body (ISO 17021-1 + 42006).
• Audit stages:
  • Stage 1 is a documentation and readiness review: scope, AI policy, risk and impact assessment, SoA.
  • Stage 2 looks for implementation evidence over time: records, monitoring results, internal audit, management review.
• After that comes a 3-year certificate with annual surveillance audits.
• Auditors sample records and expect objective evidence that each SoA control is operating.

(e) What Qpoint can evidence

(f) Crosswalks

• Official ISO: ISO/IEC 42001 Annex D references other management-system standards. There is an informal alignment with ISO/IEC 27001 through the shared Harmonized Structure, which allows an integrated management system. ISO/IEC 23894 provides AI risk-management guidance. K
• NIST AI RMF ↔ 42001 crosswalk is on NIST AIRC (community-submitted). S
• CSA AICM → 42001 is an official download. V
• AIUC-1 → 42001 is official at clause level. V
• HITRUST's AI Security Certification references 42001 among its sources. S

Sources: https://www.iso.org/standard/42001 (403 to automated fetch) · https://scc-ccn.ca/standardsdb/standards/8188107 (42005) · https://scc-ccn.ca/standardsdb/standards/8187573 (42006) · https://www.bsigroup.com/en-GB/insights-and-media/media-centre/press-releases/2026/march/bsi-secures-anab-accreditation-to-certify-isoiec-42001/ · https://brightdefense.com/news/iso-42006-raises-the-bar-for-iso-42001-certifiers · https://www.afnor.org/en/decryptions/climate-and-decarbonization/climate-game-changer-standards-management/

7. EU Artificial Intelligence Act, Regulation (EU) 2024/1689, as amended by the Digital Omnibus on AI, Regulation (EU) 2026/1744

(a) Identity and status

• Kind of thing: law (an EU regulation, directly applicable).
• AI Act: in force since 1 Aug 2024.
• Digital Omnibus on AI:
  • The Commission proposed it on 19 Nov 2025.
  • Trilogue agreement came around 7 May 2026, Parliament adopted it on 16 Jun 2026 and the Council on 29 Jun 2026.
  • Regulation (EU) 2026/1744 of 8 July 2026 was published in the OJ on 24 Jul 2026 and entered into force on 27 Jul 2026. EUR-Lex lists it as in force. V regulation existence and date; S adoption steps and entry-into-force date
  • The separate Digital Omnibus on data, GDPR and NIS2 (COM(2025) 837, which holds the single incident-reporting entry point) is not adopted. As of Oct 2026 trilogues had reportedly not started. S

(b) Native structure. Risk tiers, roles, key articles and the current timeline

Risk tiers:

• Prohibited (Art. 5).
• High-risk (Art. 6): Annex I products (Art. 6(1)) and Annex III use-cases (Art. 6(2)), with an Art. 6(3) derogation.
• Transparency-risk (Art. 50).
• General-purpose AI models (Chapter V, Arts. 51–56, with "systemic risk" GPAI on top).
• Minimal risk.

Roles (Art. 3): provider, deployer, importer, distributor, authorised representative and product manufacturer. A deployer becomes a provider under Art. 25 if it puts its name on a high-risk system, makes substantial modifications or changes its intended purpose.

Timeline as it stands on 26 Oct 2026 S: FPF, Gibson Dunn, Jones Walker, CSA; consistent:

Other Omnibus changes relevant here S:

• Art. 4 now obliges providers and deployers to support the development of AI literacy (it used to say "ensure"). It explicitly does not require guaranteeing any individual's level, and a new Art. 4(2) gives the Commission and Member States a guidance role.
• A new Art. 4a allows processing of special-category data for bias detection across all AI systems, not just high-risk ones, where strictly necessary.
• Simplified documentation and QMS now extend to small mid-caps (<750 staff, ≤€150m turnover).
• The AI Office has exclusive competence over GPAI-based systems from the same provider group.
• The 2 Dec 2027 date fixes the earlier "stop-the-clock" proposal (which tied application to standards readiness) to a calendar date. S

Deployer obligations (the Qpoint customer's role in most cases):

• Art. 4, AI literacy (above). It applies to all AI systems, including ChatGPT, Copilot and coding agents. Art. 99 sets no specific fine; national rules may.
• Art. 26, high-risk deployers (from 2 Dec 2027 for Annex III):
  • use per instructions (26(1));
  • assign competent human oversight (26(2));
  • ensure input data is relevant and representative where under the deployer's control (26(4));
  • monitor operation and inform the provider or authorities of risks and serious incidents (26(5));
  • keep automatically generated logs under their control for ≥6 months (26(6));
  • inform worker representatives before workplace use (26(7));
  • public-authority registration (26(8));
  • use provider information for the DPIA (26(9));
  • inform affected persons (26(11)).
• Art. 27, fundamental-rights impact assessment (public bodies and certain credit/insurance deployers).
• Art. 50(3)–(4), from 2 Aug 2026: deployers must inform people exposed to emotion-recognition or biometric categorisation, disclose deepfakes, and disclose AI-generated text published on matters of public interest (unless human-edited under editorial responsibility). Art. 50(1)–(2) are provider duties: chatbot disclosure and synthetic-content marking.
• Art. 86, right to explanation for decisions based on high-risk systems.

Penalties (Art. 99): up to €35m or 7% for Art. 5 breaches, €15m or 3% for most other operator obligations (incl. Art. 26 and Art. 50), and €7.5m or 1% for misleading information. K; S

(c) Who asks and why

• Regulators: national market-surveillance authorities, the AI Office for GPAI, and DPAs where personal data is involved.
• EU customers' legal and compliance teams, who need to know which AI systems they deploy, in which tier, and whether anything falls into prohibited or Annex III territory. Examples: AI used in HR screening (Annex III point 4) or in credit scoring.
• Works councils (Art. 26(7)).
• Buyers asking vendors for AI Act readiness statements.

(d) How evidence works

• Providers of high-risk systems: conformity assessment (internal control under Annex VI, or notified body under Annex VII), technical documentation (Annex IV), QMS (Art. 17), CE marking, EU declaration of conformity and EU database registration.
• Harmonised standards (CEN-CENELEC JTC 21) were not ready, which was a stated reason for the delay. S
• Deployers: no certification. They need documented compliance available to authorities on request: AI-system register and classification rationale, literacy programme records, oversight assignments, logs (≥6 months), FRIA where required, and transparency notices.

(e) What Qpoint can evidence

Never covered: FRIA content, classification judgement, technical documentation, model development and training data (Art. 10), and transparency notices.

(f) Crosswalks

• No official Commission crosswalk to standards exists. Harmonised standards are pending at CEN-CENELEC JTC 21 S. The GPAI Code of Practice (Jul 2025) is the official GPAI compliance instrument K.
• Unofficial and industry crosswalks: CSA AICM→EU AI Act (official CSA download) V; AIUC-1→EU AI Act at article level V; NIST AIRC hosts EU AI Act-related crosswalks S.

Sources: https://eur-lex.europa.eu/eli/reg/2026/1744/oj · https://eur-lex.europa.eu/eli/reg/2024/1689/oj · https://fpf.org/blog/the-ai-act-implementation-timeline-what-changes-under-the-ai-omnibus/ · https://www.gibsondunn.com/eu-ai-act-omnibus-agreement-postponed-high-risk-deadlines-and-other-key-changes/ · https://www.joneswalker.com/en/insights/blogs/ai-law-blog/yes-august-2-still-matters-the-eu-approved-a-high-risk-ai-delay-but-most-trans.html · https://labs.cloudsecurityalliance.org/research/csa-research-note-eu-ai-act-high-risk-deadline-omnibus-20260/ · https://ertico.com/digital-omnibus-on-ai-enters-into-force · https://usercentrics.com/knowledge-hub/eu-digital-omnibus-package/ (data/GDPR omnibus status). digital-strategy.ec.europa.eu returned 403 to automated fetch.

8. EU Cyber Resilience Act (CRA), Regulation (EU) 2024/2847

(a) Identity and status

• Kind of thing: law (product cybersecurity regulation, with CE marking).
• Dates:
  • Entered into force 10 Dec 2024. K
  • Conformity-assessment body (notified body) provisions apply from 11 Jun 2026. K
  • Art. 14 reporting obligations have applied since 11 Sep 2026. ENISA's Single Reporting Platform (SRP) went live the same day. S: Crowell, McCann FitzGerald, Irish NCSC, CSA note
  • Full application is 11 Dec 2027. S
• Reporting applies to products already on the market (Art. 69(3)). K
• The Digital Omnibus (data/NIS2) proposal would fold CRA reporting into a wider single entry point, but it is not adopted. S

(b) Native structure

• Obligations fall on manufacturers (Art. 13–14), importers and distributors (Art. 19–20) and open-source software stewards (Art. 24).
• Annex I sets essential requirements: Part I covers product security properties; Part II covers vulnerability handling, including an SBOM, coordinated vulnerability disclosure and security updates.
• Product classes: default (self-assessment), important Class I/II (Annex III) and critical (Annex IV).
• Art. 14 reporting:
  • actively exploited vulnerabilities and severe incidents: early warning within 24 h, notification within 72 h;
  • final report within 14 days of a fix for vulnerabilities, or 1 month for incidents.
• Scope: "products with digital elements", meaning hardware and software including remote data processing solutions integral to the product. Pure SaaS is out of scope (NIS2 covers it). K
• AI link: CRA Art. 12. High-risk AI systems that meet CRA essential requirements are presumed to meet AI Act Art. 15 cybersecurity requirements. S

(c) Who asks and why

• EU market-surveillance authorities, CSIRTs and ENISA.
• Customers procuring software sold in the EU.
• Relevance to AI tooling comes in three layers:
  1. AI coding agents, desktop AI apps, CLI harnesses and distributable MCP servers are products with digital elements. Their manufacturers carry CRA duties, and agent-written code gets no exemption. S
  2. Software manufacturers who use coding agents still carry Annex I secure-development and SBOM duties for what they ship.
  3. Qpoint's own endpoint/eBPF agent is a product with digital elements placed on the EU market. Qpoint itself must meet the CRA by 11 Dec 2027 and report exploited vulnerabilities now. Whether its blocking or enforcement functions push it into an Annex III "important" class (e.g., network-security or firewall-like categories) needs legal analysis. UNVERIFIED

(d) How evidence works

• Manufacturers do a conformity assessment by product class: self-assessment (module A) for default products, harmonised standards or third-party assessment for important and critical classes.
• They also produce technical documentation, an EU declaration of conformity, an SBOM, vulnerability-handling records and Art. 14 reports through the SRP.

(e) What Qpoint can evidence (for customers who are software manufacturers)

• Partial: an inventory of AI agents, models and MCP servers used in the development environment, i.e. an "AI-tooling BOM" feeding the dev-toolchain record. Detection of which agent touched which repos and destinations. Redaction preventing secrets leaking to AI providers, which supports Annex I Part I confidentiality.
• Partial: incident-detection signals (e.g., an agent compromise or anomalous exfiltration) feeding the 24 h / 72 h reporting clock.
• None: product SBOMs, vulnerability handling of the shipped product, conformity assessment and CE marking.

(f) Crosswalks

• Harmonised standards are in development by CEN-CENELEC K. The CRA↔AI Act link is statutory (Art. 12) S.
• No AI-framework crosswalk to the CRA was found. UNVERIFIED

Sources: https://www.crowell.com/en/insights/client-alerts/its-live-the-cyber-resilience-act-reporting-is-mandatory-as-of-today-11-september-2026 · https://www.mccannfitzgerald.com/knowledge/data-privacy-and-cyber-risk/cyber-resilience-act-reporting-obligations-apply-from-11-september-2026 · https://ncsc.gov.ie/cra/ · https://labs.cloudsecurityalliance.org/wp-content/uploads/2026/09/CSA_research_note_cra_single_reporting_platform_20260916-csa-styled.pdf · https://www.taylorwessing.com/fr/insights-and-events/insights/2025/12/artificial-intelligence-in-the-regulatory-jungle-of-cybersecurity-law · https://inquisitiveminds.bristows.com/post/102lxlm/does-the-cyber-resilience-act-outlaw-ai-vibe-coding · https://www.hunton.com/privacy-and-information-security-law/eu-digital-omnibus-introduces-a-single-reporting-point-for-cybersecurity-incidents

9. HITRUST CSF and HITRUST AI assessments

(a) Identity and status

• Issuer: HITRUST Alliance.
• CSF v11.9.0 was released on 24 Sep 2026 (advisory HAA 2026-005). V
  • It adds a mapping to the OWASP Top 10 for Agentic Applications 2026 with a selectable compliance factor, and an "Agentic AI" selectable factor for the AI Security Certification.
  • It updates AI Security content, refreshes the SP 800-53 Rev 5.2.0 mapping, adds post-quantum crypto considerations, and grows the e1 baseline to 44 statements (i1 stays at 182).
  • From 31 Dec 2026, new e1 and i1 assessments must use v11.9.0 (HAA 2026-006). S/V
  • The previous release was v11.8.0 (May 2026; added LLM and AI mappings). S
• Kind of thing: a certifiable controls framework. HITRUST issues the certifications after testing by an Authorized External Assessor and quality review by HITRUST.
• HITRUST AI Security Assessment & Certification was launched Dec 2024 and introduced as a compliance factor in CSF v11.4.0. V/S
  • It covers up to 44 AI requirement statements at v11.4.0 V: help page. A recent HITRUST press release reportedly cites 55 harmonised AI controls tied to v11.9. UNVERIFIED — treat 44 as the documented figure
  • Tailoring by model type: rule-based 27, predictive 36–40, generative 41–44. V
  • Topics: access to the AI system (7), development of AI software (6), model robustness (5), AI supply chain (4), and 3 each for threat management, governance and oversight, legal and compliance, logging and monitoring, documenting and inventorying, and filtering and sanitizing. Encryption and resilience have 2 each. V
  • Eligibility is AI application and platform providers. AI users and customers cannot certify, and "a SaaS user can't certify on behalf of its provider". V: help page
  • The help page says it is add-on only (with e1, i1 or r2). The current product page says "added to e1, i1, or r2 … or standalone". V Conflict: confirm with HITRUST.
  • Validity follows the paired assessment: 1 yr (e1/i1) or 2 yr (r2). V
• HITRUST AI Risk Management Assessment: 51 controls harmonised with ISO/IEC 23894:2023 and the NIST AI RMF. It is a self-assessment or validated by an external assessor, but not a certification. S, on HITRUST pages
• The help page says AI usage requirements are slated for CSF v12, and ISO/IEC 42001 is being considered for v12. v12 has not been released as of this check. V statement; status S

(b) Native structure

• The CSF is organised into 14 control categories (00–13) and 19 assessment domains, built from requirement statements at implementation levels.
• Assessments come in three tiers: e1 (essentials, 44 statements), i1 (implemented, 182), r2 (risk-based, tailored, often 300+).
• They are scored on the PRISMA maturity model (policy, procedure, implemented, measured, managed). r2 scores all five, while e1 and i1 focus on implementation. K
• "Compliance factors" add requirements for authoritative sources such as HIPAA, NIST, OWASP Agentic, and AI Security.

(c) Who asks and why

• US healthcare payers, providers and health-tech buyers ask vendors that handle PHI. HIPAA does not require HITRUST, but it is a de facto procurement standard. S
• The AI Security Certification is aimed at healthcare and other regulated buyers evaluating AI vendors.

(d) How evidence works

• Readiness, then validated testing by an Authorized External Assessor (evidence per requirement statement, sampling, and PRISMA scoring for r2), then HITRUST QA, then certification.
• A Shared Responsibility and Inheritance Program lets organisations inherit controls from HITRUST-certified service providers. K Qpoint could become an inheritable provider for the AI-monitoring requirements its customers carry. This is a product opportunity worth checking.

(e) What Qpoint can evidence

• AI Security Certification topics (for customers who are AI providers):
  • logging and monitoring — strong;
  • documenting and inventorying — strong for the in-use inventory;
  • filtering and sanitizing — partial→strong through redaction of inputs;
  • access to the AI system — partial (per-user allow-lists);
  • AI supply chain — partial→strong (model and provider inventory);
  • threat management — partial.
  • None: model robustness, development of AI software, legal and compliance.
• The new Agentic factor and the OWASP-agentic mapping carry the ASI ratings from §1. Strongest are ASI02, ASI04 and ASI10.
• Core CSF: endpoint protection, network monitoring and DLP-type statements cover employee AI use, with partial evidence for AI traffic.
• Eligibility gap: most Qpoint customers are AI users, and HITRUST's AI certification excludes users. Until CSF v12 brings AI usage requirements, Qpoint evidence lands in base CSF statements (and AI RM assessment controls), not the AI cert.

(f) Crosswalks

• The CSF is itself a harmonisation, mapping many authoritative sources: NIST 800-53 r5.2.0, NIST CSF, HIPAA, ISO 27001/27002, PCI, SOC 2, OWASP Agentic Top 10 (v11.9), AI sources (NIST AI RMF, ISO 23894, ISO 42001 per partner materials), and others. V/S
• HITRUST publishes a comparison of 42001 and HITRUST AI (blog). S

Sources: https://hitrustalliance.net/advisories/haa-2026-005-csf-version-11.9.0-release · https://hitrustalliance.net/advisories/haa-2026-006-csf-v11.8-creation-deadline-for-e1-and-i1-assessments · https://hitrustalliance.net/assessments-and-certifications/aisecurityassessment · https://hitrustalliance.net/help/ai-sec-assessment · https://hitrustalliance.net/blog/hitrust-ai-risk-management-and-ai-security-certification-whats-the-difference · https://hitrustalliance.net/blog/iso-iec-42001-vs-hitrust-ai-whats-the-difference · https://www.accorian.com/hitrust-csf-v11-9-0-what-changed-and-what-organizations-need-to-do/ · https://www.a-lign.com/articles/the-hitrust-ai-security-assessment-explained

10. ISO/IEC 27001:2022 (ISMS)

(a) Identity and status

• ISO/IEC 27001:2022 (Oct 2022), plus Amd 1:2024 (climate action changes to clauses 4.1/4.2). It is final.
• Kind of thing: a certifiable management-system standard.
• The transition from 27001:2013 closed on 31 Oct 2025 (IAF MD 26:2023, 36 months). Certificates against 2013 are no longer valid. S, multiple
• No 27001:2026 edition and no AI amendment exists. S Auditors are reading existing controls such as 5.23, 8.10, 8.16 and 8.28 to cover AI use. S
• Global accreditation functions moved from IAF and ILAC to a successor body ("Global Accreditation Cooperation") on 1 Jan 2026, according to a single source. UNVERIFIED

(b) Native structure

• Clauses 4–10 (Harmonized Structure, the same skeleton as 42001).
• Annex A has 93 controls in 4 themes:
  • Organizational (5.1–5.37, 37 controls)
  • People (6.1–6.8, 8)
  • Physical (7.1–7.14, 14)
  • Technological (8.1–8.34, 34)
• Controls carry attributes: control type, security properties, cybersecurity concepts (Identify, Protect, Detect, Respond, Recover), operational capabilities and security domains.
• The Statement of Applicability selects controls. 27002:2022 gives guidance.

(c) Who asks and why

• Global, especially EU and APAC, buyers ask vendors for it as the baseline security certification.
• Regulators reference it (e.g., NIS2 implementing acts, DORA practices).
• It is a prerequisite for STAR for AI routes a3 and a4, and pairs with 42001 in an integrated management system.

(d) How evidence works

• Accredited certification-body audit: Stage 1 and Stage 2, then a 3-year certificate with surveillance audits.
• Auditors need records showing that SoA controls operate.

(e) What Qpoint can evidence

(f) Crosswalks

• ISO/IEC 27002:2022 Annex B maps 2022↔2013 controls (official). K
• AICPA TSC↔27001 mapping (version caveat above). CCM v4.1 and AICM map to 27001. NIST CSF 2.0 informative references (OLIR) include 27001:2022. K/S
• 27001 and 42001 share the Harmonized Structure, which allows an integrated audit. K

Sources: https://www.brightdefense.com/news/iso-270012022-deadline-puts-legacy-certificates-at-risk/ · https://www.nsai.ie/certification/management-systems/iso-iec-27001-information-security-management-system/iso-iec-270012022-transition-policy/ · https://www.brightdefense.com/news/iso-27001-what-changed-in-2026/ · https://www.quality.org/guide/isoiec-270012022-details-new-controls-and-impact-revisions

11. Cross-cutting synthesis for Qpoint's design

11.1 Framework shape at a glance

11.2 Evidence primitives that map across all ten

Each artefact below maps to many framework IDs at once. That makes it the right modelling unit: frameworks become views over shared evidence.

11.3 What Qpoint should never claim

These sit outside network or endpoint observation in every framework:

• Organisational governance: leadership, accountability, culture, competence and training delivery, management review, internal audit.
• Model development: training data, data quality and provenance (AI Act Art. 10, 42001 A.7.2–A.7.4, AICM DSP-24, MDS), model evaluation, bias, robustness, red-teaming (AIUC-1 third-party tests, MEASURE 2).
• Output content safety: harmful or out-of-scope outputs, hallucination, misinformation (AIUC-1 C/D001, LLM07, 600-1 content risks).
• Impact and fundamental-rights assessments, classification judgements, transparency notices and disclosures (Art. 50, AIUC-1 E016).
• Provider-side obligations: GPAI obligations, conformity assessment, CE marking, provider logs (Art. 12).

11.4 Role reality check

• Qpoint's customers are mostly AI deployers/users (AICM "AI Customer", AI Act "deployer"). They are not providers.
• The frameworks that best fit that role are 27001, SOC 2, 42001 (scoped to use), AICM (AIC role), NIST AI RMF (GV1.6, MANAGE 3) and AI Act Art. 4/26.
• AIUC-1 and HITRUST AI Security target providers of AI systems and agents. For Qpoint customers they are mostly vendor-due-diligence artefacts, unless the customer ships agents.
• Qpoint itself, as a vendor, will face SOC 2 / 27001 requests, the CRA (endpoint agent), and possibly a STAR for AI listing if it adds AI features.

12. Verification log: what I could not confirm