Coverage
18 laws, standards, frameworks and guidance sources
Missing evidence is mapped to the obligations that apply to that system. Nothing is claimed for a framework that does not apply, and licensed text is never reproduced.
Law and regulation
- EU AI Act
- EU GDPR
- UK GDPR / Data Protection Act 2018
- India DPDP Act and Rules
- Council of Europe Framework Convention on AI
- EU Digital Services Act / Digital Markets Act overlay
Public authoritative sources. Cited, never reproduced where licensing forbids it.
Risk frameworks
- NIST AI Risk Management Framework 1.0
- NIST AI 600-1 (generative AI profile)
Used as structured risk guidance, not converted into invented obligations.
Standards
- ISO/IEC 42001
- ISO/IEC 42005
- ISO/IEC 23894
- ISO/IEC 27001
- ISO/IEC 27701
- ISO/IEC 38507
Licensed standard text is never reproduced. Clause references only.
Principles and routes
- UNESCO AI Ethics Recommendation
- OECD AI Principles
- UK cross-sector AI principles and regulator routes
- DPIA / FRIA route
Guidance and routing — never turned into requirements the source does not impose.
Every source carries a tier and a status. That is how the coverage claim
stays honest: licensed standard text is never reproduced, sources needing legal interpretation are flagged for legal review,
and principle frameworks are used as guidance rather than converted into invented obligations.
What this is, and what it is not
What Eshalu does
- Reports evidence coverage and gaps against the sources in scope.
- Records which clause, article or domain each control answers.
- Says plainly where evidence is missing, and what would close it.
- Flags where a judgement is legal rather than evidential.
What Eshalu does not do
- It does not certify compliance against any standard.
- It does not give legal advice or make legal determinations.
- It does not reproduce licensed standard text.
- It does not treat a signal — such as an EU high-risk candidate — as a legal conclusion.