The Work Beside an AI Compliance Platform

The platforms, and the work beside them

Vanta and Drata are good at what they do. They automate evidence collection and control tracking for AI frameworks. That work is useful. TrustEdge works alongside these platforms.

Vanta's ISO 42001 software is compliance software for that standard. Vanta describes automation that monitors controls, document and policy templates, mapped controls, AI-specific risk scenarios, and scoping of which AI systems and people are in the certification. Vanta's AI governance product maps agents across developer laptops, production code, and vendor platforms, and shows which models, prompts, and data each agent can reach. It describes controls on what an agent is allowed to do, and evidence of that posture on a Trust Center. The page says "Sign up for the waitlist to get early access." Vanta says the product governs the AI an organization uses and secures the AI it builds. For the agents an organization has adopted, Vanta describes controlling what they do and attesting at the use-case level the EU AI Act regulates.

Drata's AI Agent Governance discovers agents running in the environment, enforces policy before an action executes, and, in Drata's words, produces auditor-grade proof of every decision. The product page says the product is built to map to ISO 42001, the EU AI Act, and AIUC-1, among other frameworks. On June 10, 2026, Drata wrote that early access opened that day. On August 4, 2026, Drata announced Limited Availability. That post says AI Agent Governance provides continuous control monitoring and evidence collection for actions taken by AI agents, and that it is available now in Limited Availability to qualified enterprises running agents on Anthropic. The product page is headed Limited Availability. The same page says "Apply for Early Access" and describes an Early Access Program with select enterprises across financial services, healthcare, and software. Drata's pages do not call the product generally available.

Both companies state that they hold ISO 42001 certification. Vanta's post of April 24, 2025 says Vanta earned the certification from an ANAB-accredited assessor. Drata's post of December 2, 2025 says Drata has achieved ISO 42001 certification.

The work a platform does not do

A platform collects evidence against a framework. Deciding scope, reading a contract, testing a model, and judging what an assessor will accept are a person's work. They sit beside the platform. They are not a verdict on the product.

If a team shipped a feature that touches protected health information, that feature is inside the HIPAA scope. If it runs on the system your SOC 2 report describes, it is inside that boundary too, and that is a scoping question for the next examination rather than something an existing report already covers. Scope describes the system you operate now, not the system you described the last time an assessor visited. Someone has to decide which shipped features moved the boundary.

AI clauses show up in customer contracts and security agreements. A clause is not a control. Someone has to read the agreement and say what it commits you to.

Someone has to try to break the model. Prompt injection. Jailbreaks. Data leaving through the retrieval layer. The OWASP Top 10 for LLM Applications names those failures. The current edition is the 2026 list. Evidence that a test was planned is not the test.

What an assessor will accept is a judgment. What is in scope. Which evidence will hold. Which system is the one that will cause a problem.

TrustEdge does that work alongside the platform.

The frameworks the evidence is collected against

ISO/IEC 42001 was published in December 2023. It is a certifiable management-system standard.

NIST AI RMF 1.0 was released on January 26, 2023 as NIST AI 100-1. It is a voluntary framework, not a certification. NIST describes it as intended for voluntary use.

The EU AI Act reached general application on August 2, 2026. Article 50 transparency obligations apply, and the Commission gained enforcement powers over general-purpose AI providers. Regulation (EU) 2026/1744, the Digital Omnibus, has been in force since July 27, 2026. It deferred the high-risk obligations to December 2, 2027 for Annex III systems and August 2, 2028 for Annex I systems.

On December 6, 2024, HITRUST published an AI Security Assessment: ai1 when combined with an e1 or i1 assessment, and ai2 when combined with an r2. Assessments on CSF version 11.4.0 and later can add it by selecting the Security for AI Systems factor. Selecting that factor is what brings the AI security requirements into the assessment. HITRUST awards the certification for a deployed AI system, and only to AI providers — platform providers and product providers. An organization that only uses someone else's system cannot certify that system. The provider has to. A CSF report that never selected the factor did not test those requirements.

The parent company is the assessor

Jacobian Engineering, TrustEdge's parent, is a HITRUST Authorized External Assessor, with CCSFP assessors in house. That credential qualifies Jacobian to assess another organization. It is not a HITRUST certification of TrustEdge, and it is not a HIPAA, SOC 2, FedRAMP, ISO, or EU AI Act certification. Those are not available to borrow.

What the credential lets us say is how an assessor will treat your AI controls.

Start with a pre-assessment

The way in is an AI Governance Pre-Assessment. It is small and concrete. It covers what AI you actually have, what already sits inside your certification boundary, what your customer contracts and security questionnaires already commit you to, a gap list against ISO/IEC 42001 and the NIST AI RMF, and a scoping recommendation for red-teaming. You leave with a document you can take to a board.

If that is the conversation you want, contact us.