Quilzo turns what your AI agents, chatbots and models actually did into compliance evidence: the EU AI Act's deployer duties, ISO/IEC 42001 Annex A, NIST AI RMF and an AI bill of materials, each drawn from a signed record rather than written by hand.
Evidence that is already there
Most AI governance tools are questionnaires. Somebody describes how the AI is supposed to be used, and an auditor reads the description. Quilzo is where the agents run, so it already holds the facts those frameworks ask about: which AI systems exist and who answers for each, what they may do, when a person stepped in, and what was logged.
What it produces
| Framework | What Quilzo gives you |
|---|---|
| EU AI Act | The deployer's duties, each with the evidence that meets it: human oversight, logs, transparency to the people affected, and the inventory of AI systems |
| ISO/IEC 42001 | Annex A as a statement of applicability, every control with what implements it |
| NIST AI RMF | The same continuous checks read as the AI RMF, alongside NIST 800-53, ISO 27001, SOC 2 and OWASP's LLM Top 10 |
| AI bill of materials | Every model, agent and chatbot in CycloneDX 1.6 |
quilzo compliance ai-act quilzo compliance iso42001 quilzo compliance aibom
Controls that generate their own evidence
- Inventory. Every agent, app, tool server and model route on one map, with the person who answers for each, and AI services reached around Quilzo found as shadow AI.
- Human oversight. Ask-first actions and approvals, recorded with who decided and when.
- Logging. A hash-chained log signed with Ed25519 and ML-DSA, anchored in time, with proofs anybody can check.
- Transparency. Chatbots say they are AI, and content an agent wrote is marked as AI-generated.
- Data protection. Personal data masked before it reaches a model, and people can see, correct and erase what agents remember about them.
- Auditors. Scoped engagements exported as one verifiable file, with the days nobody can speak to shown, not hidden.
