Skip to content
Brutor AI Docs

How frameworks are checked

Brutor offers a compliance framework only when its catalog has been checked line by line against the published official text of the instrument. A catalog written from summaries, memory or a vendor’s crosswalk is not offered. This page explains the method, so you can judge — and repeat — the check yourself.

What “offered” means

Section titled “What “offered” means”

A framework is offered when both are true:

  1. Its catalog is verified against the instrument: every obligation carries at least one source from an official publisher of that instrument.
  2. The instrument is final: a law, regulation or standard in force — not a bill, a draft or a consultation.

Only an offered framework can be enabled for a tenant, added to an AI System’s compliance profile, evaluated on the Obligations board, reported on, used for a documentation export, or named in an incident. A framework that is not offered is still listed in the registry with the reason; every attempt to use it is refused with HTTP 409 and that reason. A tenant that enabled it earlier keeps the stored setting, but it reads as off.

Today ten frameworks are offered. Two of them — SOC 2 and ISO/IEC 42001 — are licensed texts, checked by fingerprint (below). Brazil’s PL 2338/2023 is listed as a draft: it is a bill, not law, and cannot be offered until it is enacted and checked.

What a check records

Section titled “What a check records”

For every obligation in an offered catalog, the source records:

Field What it is
Instrument The exact text checked, e.g. Regulation (EU) 2022/2554 (DORA), OJ L 333, 27.12.2022 (consolidation 02022R2554-20221227)
Provision The exact provision, e.g. Art. 19(1) or Art. 5(1)(b) of a delegated regulation
Link The official publication: EUR-Lex for EU law, the eCFR or govinfo for HIPAA, NIST for the AI RMF, the Colorado General Assembly, law.go.kr and KLRI for Korea, the AICPA and ISO for their standards
Checked on The date the entry was compared with that text
Excerpt A short verbatim passage of the operative text, as proof it was read — or, for a licensed text, a fingerprint instead

Each framework page shows these under Checked against for every obligation, so you can follow each link and read the provision yourself. The summaries are Brutor’s own wording, not the instrument’s; the excerpt is the instrument’s.

The catalog also records the version of the instrument it was checked against — which consolidated text, which amending acts were in force on the check date — and dates that come from other official sources (an effective date set by a delegated act, for example). What a catalog does not model — a national transposition, an exemption, a weekend-relief rule — is stated in the obligation’s What the gateway cannot show line rather than left out silently.

A test in the Control Plane refuses a catalog that calls itself verified without a source on every obligation, from a host on the official-publisher list for that framework. The framework pages in these docs are generated from the same catalogs, and a second test fails when a page no longer matches its catalog.

Draft instruments

Section titled “Draft instruments”

A bill, or a decree that has not been issued, has no final text to check against. Such a catalog is marked draft and is never offered. Brazil’s catalog is a placeholder: one entry with an applies from date of 2099-12-31, so nothing reads as in force. When the law is enacted, it is replaced by a real catalog checked against the published text.

Licensed texts

Section titled “Licensed texts”

Some standards are sold, and their copyright forbids reproducing them: the AICPA Trust Services Criteria (SOC 2) and ISO/IEC 42001. They are checked against a licensed copy of the full text, and Brutor never quotes them — not in the product, not in these docs. Each source carries a fingerprint instead of an excerpt:

  • the SHA-256 of the passage the entry was checked against, after normalizing whitespace (runs of whitespace collapsed, a hyphen at a line break removed), over the text extracted with pdftotext -enc UTF-8 (reading order, no layout);
  • the passage’s first words, as a locator, and its length.

The framework pages show, per source: the provision, the official link, “checked against a licensed copy on <date>; passage fingerprint <first 12 hex characters>…” — and no text from the standard.

Anyone with a licensed copy of the same edition and the Control Plane source can repeat the check. From brutor-gateway-control:

Terminal window
.venv-test/bin/python scripts/verify_licensed_sources.py <framework> <licensed pdf>


# for example
.venv-test/bin/python scripts/verify_licensed_sources.py soc2 /path/to/Trust-services-criteria.pdf
.venv-test/bin/python scripts/verify_licensed_sources.py iso-42001 /path/to/ISO_IEC_42001_2023.pdf

It extracts the text with pdftotext (poppler), finds each passage by its first words, recomputes the hash, prints any mismatch and <framework>: n of m fingerprints match, and exits 0 only when every fingerprint matches. The licensed PDF stays on your machine; it is never added to any Brutor repository.

A licensed-text check covers what the fingerprints cover. Anything taken from elsewhere is said so on the framework page — for example, SOC 2’s applies from date (15 December 2018) is the AICPA’s transition date for the 2017 criteria, which the 2022 edition does not restate, so it is not covered by a fingerprint.

Re-checking when an instrument changes

Section titled “Re-checking when an instrument changes”

Laws are amended and standards get new editions. A catalog records the text it was checked against and when (verified_on, and a date per source). When an instrument changes, the catalog is re-checked against the new text, and changed dates ship as a new catalog version with its effective range — so evidence over an older window is still evaluated against the text in force then (version in force). The EU AI Act catalog shows this: 2024-08 for the Act as published, 2026-09 for the Act as amended by Regulation (EU) 2026/1744.

A repeal is handled the same way. Colorado’s SB 24-205 was repealed and reenacted by SB 26-189 before its requirements ever applied, so the colorado catalog now tracks the reenacted law and its 1 January 2027 date; the duties the new text dropped were removed.

Section titled “Related”