AelethionGet Started

// Regulation and assurance

Turn AI obligations into controls and evidence.

Logs are not evidence. Regulation asks organisations to manage risk, protect data, retain records, apply oversight and demonstrate that controls worked. Athena can connect selected obligations to scoped evidence from AI and automated-decision workflows, while legal interpretation and compliance judgement remain with authorised reviewers.

Get Started

// Regulation and assurance

From obligation to evidence.

  1. Obligation

    A law, supervisory requirement or assurance framework defines what must be managed or demonstrated.

  2. Policy

    The organisation determines what AI may see and do, under which authority and in which environment.

  3. Control

    Athena applies that policy at the data, model, tool-call and API boundaries.

  4. Event

    The data transfer, approval, refusal or action is recorded when it occurs.

  5. Evidence

    Records are sealed with integrity, identity, time, custody, coverage and mapping information.

  6. Independent review

    An authorised reviewer verifies the evidence and decides whether it is sufficient.

Athena supplies the controls, the evidence and the mappings. Your auditor makes the judgement.

// Regulation and assurance

Platform Work Directive.

The Platform Work Directive (Directive (EU) 2024/2831) must be transposed into national law by 2 December 2026. It applies to digital labour platforms and covers people performing platform work whether or not they are employees. Article 7 prohibits automated systems from processing certain personal data. Article 8 requires a data protection impact assessment. Article 9 requires platforms to tell workers and their representatives which automated systems are in use and what they decide. Article 10 requires human oversight, and Article 10(5) states that any decision to restrict, suspend or terminate a person’s account or contract must be taken by a human being. Article 11 gives the person a written statement of reasons no later than the day the decision takes effect, and a written reply to a review request within two weeks. Under Article 24, data protection authorities enforce Articles 7 to 11 and can fine up to EUR 20 million or 4% of worldwide turnover.

On 21 August 2026 the Dutch data protection authority fined Uber EUR 824.99 million under Article 22 of the GDPR for deactivating drivers automatically without meaningful human review. Uber is contesting the fine. The authority’s guidance Meaningful Human Intervention of 23 July 2025 sets the standard for that review: the reviewer is competent, has the information, is allowed to overrule the outcome and can influence the decision before it has significant consequences for the person.

Athena contribution.

Athena Algo Assurance covers Articles 7 to 11. It checks the data a system uses against the prohibited categories, keeps the transparency record, holds every decision to restrict, suspend or terminate an account for a named person before it takes effect, records the written reasons and tracks the two-week review deadlines. The directive has no record-keeping article; the sealed record is your proof that the human review happened, for a court disclosure order under Article 21 or an authority request under Articles 9 and 10.

Customer responsibility.

Scope and worker status, the national transposing law, the impact assessment, information given to workers and their representatives, the staffing and training of reviewers, and the substance of each decision and statement of reasons.

// Regulation and assurance

DORA.

DORA has applied since 17 January 2025 to in-scope EU financial entities. It addresses ICT risk management, incident reporting, resilience testing, information sharing and ICT third-party risk.

ECB letter SSM-2026-0301 of 7 July 2026 asks significant institutions to submit an action plan on AI-enabled cybersecurity threats across their ICT environment to the Joint Supervisory Team by 31 October 2026. The letter covers vulnerability and patch management, monitoring, third-party risk, governance, defence in depth and recovery. Records from Athena's connected AI control points may contribute narrow evidence about those workflows, but they do not cover the whole ICT threat surface or constitute the plan itself.

Athena contribution.

Contemporaneous, sealed records of AI data and action events routed through connected control points, including the controls applied, stated models and services, and material for investigation, governance and reporting.

Customer responsibility.

DORA scope, incident classification and notification, resilience programmes, third-party registers, supervisory engagement and legal judgement.

// Regulation and assurance

NIS2.

NIS2 establishes a cybersecurity framework across 18 critical sectors, including risk-management measures, incident reporting, supply-chain considerations, supervision and management accountability. National implementation and enforcement must be checked in each Member State because transposition has not been uniform.

Athena contribution.

Visibility of AI services and data flows, access and action controls, exception and incident evidence, and records for management, security and audit review.

Customer responsibility.

Local scope, broader cybersecurity measures, incident classification, reporting procedures and statutory notifications.

// Regulation and assurance

GDPR.

The GDPR requires lawful, fair and transparent processing, together with purpose limitation, data minimisation, accuracy, storage limitation, integrity, confidentiality and accountability. Automated decision-making can create additional duties depending on the workflow and its effect on individuals.

Athena contribution.

Data minimisation at the AI boundary, destination and transfer records, credential mediation, access and action controls, and evidence of how personal data was handled.

Customer responsibility.

Lawful basis, notices, data-subject rights, controller and processor roles, DPIAs, transfer mechanisms and Article 22 analysis.

// Regulation and assurance

Cyber Resilience Act.

The Cyber Resilience Act applies to products with digital elements. It entered into force on 10 December 2024. Reporting duties for actively exploited vulnerabilities and severe incidents apply from 11 September 2026; the main product obligations apply from 11 December 2027. Reporting means an early warning within 24 hours and a fuller notification within 72 hours.

Athena contribution.

Technical evidence around AI-assisted software changes, tools, APIs, authority, approvals, outcomes, vulnerabilities and incident reconstruction.

Customer responsibility.

Product scope, manufacturer duties, conformity assessment, vulnerability handling, notification decisions and submissions.

// Regulation and assurance

Product Liability Directive.

The revised Product Liability Directive (Directive (EU) 2024/2853) applies to products placed on the market or put into service after 9 December 2026, including software and AI systems. Member States must transpose it by that date. Courts can order disclosure of relevant evidence and apply rebuttable presumptions of defect or causation when the Directive's conditions are met. Failure to comply with a court's disclosure order can trigger a presumption of defect.

Athena contribution.

The sealed record of data, authority, decision, action and outcome for each AI event, verifiable by the court-appointed expert without trusting the defendant's own systems.

Customer responsibility.

Product scope, defect analysis, insurance, disclosure decisions and legal defence.

// Regulation and assurance

EU AI Act.

The EU AI Act applies in stages. General provisions, AI-literacy duties and prohibited practices have applied since 2 February 2025, general-purpose AI rules since 2 August 2025, and most transparency obligations since 2 August 2026. Regulation (EU) 2026/1744 (the Digital Omnibus) moved the Annex III high-risk rules to 2 December 2027 and high-risk systems embedded in Annex I products to 2 August 2028. The near-term pressure therefore sits with DORA, NIS2, the CRA and the Product Liability Directive; the AI Act's record-keeping, traceability and human-oversight duties are the ones Athena's evidence chain answers when they arrive.

For applicable high-risk systems, relevant themes include risk management, data governance, technical documentation, record-keeping, transparency, human oversight, accuracy, robustness and cybersecurity.

Athena contribution.

Evidence of data flows, human and policy control, authority, approvals, runtime decisions, observed outcomes, record integrity and gaps.

Customer responsibility.

Classification, role determination, conformity assessment, fundamental-rights analysis, legal interpretation and final compliance judgement.

// Regulation and assurance

Assurance frameworks.

ISO/IEC 42001:2023.

Athena evidence supports the governance, risk, control, monitoring and record-keeping clauses of the AI management system.

ISO/IEC 27001:2022.

Athena supplies evidence for access, data protection, event recording, change control and risk treatment within the information security management system.

SOC 2.

Athena supplies operational evidence for the security, availability, processing integrity, confidentiality and privacy criteria.

NIST AI Risk Management Framework.

Athena evidence supports the Govern, Map, Measure and Manage functions.

// Regulation and assurance

Evidence that can be reused.

One technical event can support several obligations when the underlying questions overlap. A data-transfer record may inform privacy, security, sovereignty and third-party risk review. An approval-and-action record may inform human oversight, access control, change management and accountability.

Athena can map selected evidence fields to specified controls from the frameworks on this page and represent the mapping in OSCAL. The mapping shows intended support and gaps; it does not establish that every framework requirement is satisfied.

// Regulation and assurance

Global evidence, local interpretation.

The same evidence model can be scoped against particular controls in other national or sector regimes, including eIDAS 2, UK GDPR and FCA requirements, South Africa's POPIA and FICA, and the King V governance code. Any mapping must identify the exact obligation, jurisdiction, evidence field and gap; it is not a universal compliance map.

An evidence pack shows what was observed, which control applied, what passed and what failed.

// Regulation and assurance

Official sources.

Start with one real workflow.

Choose a valuable workflow that needs stronger control or a provable human decision. We will agree the relevant Athena modules, integration boundary, evidence limits, acceptance tests, timetable and commercial scope in writing.

Get Started