examiner cross-mapping

What Gateplex actually does, framework by framework

Gateplex is not a certification and does not issue one. This page describes the controls each compliance pack enforces and the evidence it produces, so your risk and audit teams can judge the mapping for themselves.

EU AI Act

Article 12, record keeping

EU AI Act

Article 50, transparency

Financial services

Spend, transaction, and data access boundaries

HIPAA

Data handling

Active Compliance Control HubMapping_Runtime_Events

Frameworks mapped

Control packs

Evidence model

SHA-256

Runtime eventmapFramework control

agent.tool_callEU_AI_ACT_ART_12

output.disclosure_checkEU_AI_ACT_ART_50

payload.pii_scanHIPAA_SEC_402

payment.authorizeSAMA_CYBER_2.1

api.scope_checkQCB_AI_GUIDELINE

Every mapped event writes one hash chained record chain_intact

EU AI Actdossier 01

Article 12, record keeping

Article 12 requires that high risk systems automatically record events over their lifetime, to a standard that supports traceability.

What the pack enforces

Every intercepted agent action is written to an append only record with the input, the matched rule, the verdict, the agent identity, and the timestamp.

Integrity model

Each record stores its own SHA-256 hash and the hash of the preceding record. The hash is computed server side at insert time, so a modified or removed row breaks the chain.

Evidence output

Period scoped compliance exports covering policy triggers, per agent activity, and hash chain verification status.

Append only evidence ledgerVerifying_Chain

record 0x00A1verified

prev_hash: genesissha256: 9f2c…41be

record 0x00A2verified

prev_hash: 9f2c…41besha256: c7d0…88a3

record 0x00A3verified

prev_hash: c7d0…88a3sha256: 41ee…02fc

record 0x00A4 chain_break_detected

prev_hash: 41ee…02fcsha256: —

A modified or removed row no longer reproduces the stored hash, so verification fails at the exact record where tampering occurred.

EU AI Actdossier 02

Article 50, transparency

Article 50 is now in active legal effect and establishes transparency obligations where people interact with AI systems or receive AI generated output.

What the pack enforces

Output rules that check agent responses before they are returned, including output length limits and pattern rules you define for disclosure text.

Human oversight

Rules can be marked as requiring approval. Matching actions become PENDING_APPROVAL and are held in the approval queue until a named reviewer decides.

Reviewer identity

Reviewer identity is derived server side from the authenticated session. It cannot be supplied or overridden by the client.

Runtime access control planeHuman_In_The_Loop

Held action

VERDICT: PENDING_APPROVAL

rule: requires_approval = true

queue: approval_queue

execution: suspended

Authenticated session identity

reviewed_by_email = jwt.claims.email

source: server side session

write path: database trigger

client grant: denied

Cannot be supplied or overridden by the client

Financial servicesdossier 03

Spend, transaction, and data access boundaries

Built to support the governance, audit trail, and human oversight requirements financial institutions face under frameworks such as Qatar Central Bank's AI Guideline and SAMA Counter-Fraud Framework §3.8(d)(8).

Spend and transaction boundaries

Threshold rules evaluate transaction amounts in the intercepted action. Actions above your configured limit are blocked or routed to a human reviewer before execution.

Data access scope

API scope rules restrict which target hosts and endpoints an agent may reach. Calls outside the declared scope are dropped at the proxy and never egress.

Rule change accountability

Every create, update, enable, disable, and delete on a guardrail rule is written to a hash chained rule change audit log with the actor and a field level diff.

[TRANSACTION BOUNDARIES]

$ 4,200.00ALLOW

$ 18,400.00BLOCK

$ 9,950.00HOLD

threshold: max_amount = 10,000

[DATA ACCESS SCOPE]

agent gateplex proxy

api.core-bank.internalegress

ledger.internal/v1/readegress

pastebin.com/rawdropped

api.unlisted-vendor.iodropped

out_of_scope calls never reach the network perimeter

[RULE CHANGE ACCOUNTABILITY]

rule_audit_log :: entry 0x1F4

actor: r.haddad@bank.example

action: update

- threshold_amount: 25000

+ threshold_amount: 10000

+ requires_approval: true

prev_hash linked

HIPAAdossier 04

Data handling

For teams handling protected health information, the control question is whether sensitive values can leave the perimeter through an agent.

Detection

PII rules scan the full request payload, including nested JSON, for patterns such as email addresses, national identifiers, card numbers, and phone numbers.

Containment

Matching actions are blocked at the proxy or held for approval. In the VPC and air gapped editions, payload data never leaves your perimeter at all.

Review trail

Detections, verdicts, and approval decisions are recorded in the same hash chained trail used for the rest of your evidence.

PII / PHI sanitization matrixPerimeter_Enforced

Inbound payloadunsanitized

{
  "patient": "M. Alvarez",
  "ssn": "412-88-7190",
  "card": "4111 1111 1111 1129",
  "email": "m.alvarez@clinic.example",
  "phone": "+1 415 555 0148",
  "note": "MRN 88213, dx follow up"
}

in memory

pii_scan

Outbound payloadcontained

{
  "patient": "M. Alvarez",
  "ssn": "[REDACTED:NATIONAL_ID]",
  "card": "[REDACTED:CARD_NUMBER]",
  "email": "[MASKED:m***@clinic.example]",
  "phone": "[MASKED:+1 415 555 ****]",
  "note": "[HELD_FOR_APPROVAL]"
}

nested_json_scannedheld_for_approvalvpc: payload never leaves perimeter

saudi arabia

Saudi regulatory instruments, separated by legal weight

Two of these instruments are in force today and one is still at consultation stage. None of them names agent governance software. We list what each regulator actually states, and where Gateplex supports the auditability those statements call for.

SAMAIn force

Counter-Fraud Framework, Section 3.8

Status and scope

Mandatory for SAMA-designated Member Organisations, meaning banks and other financial institutions SAMA notifies.

Control Requirement (d)(8) under Counter-Fraud Technology addresses the use of machine learning and artificial intelligence in counter-fraud systems. It sets an auditability expectation rather than a model performance one.

“Where Machine Learning or Artificial Intelligence are used the system should not be 'black box' and should be capable of being audited (e.g., the organisation should have the capability to test what the algorithms are designed to do and whether they are correctly implemented).”
SAMA Counter-Fraud Framework, Section 3.8, Control Requirement (d)(8)

The Framework does not name agent governance software, pre-execution interception, or any particular verdict model. Gateplex is relevant here because deterministic rule evaluation and a hash chained record of every decision give an organisation a concrete way to test what its rules are designed to do and to show whether they were correctly implemented.

rulebook.sama.gov.sa

NCAIn force

Essential Cybersecurity Controls, ECC-2:2024

Status and scope

Mandatory for Saudi government entities, their affiliates, and private-sector entities that own, operate, or host Critical National Infrastructure. Other Saudi entities are encouraged to apply it as best practice.

ECC-2:2024 is the baseline cybersecurity control set. It applies to the environment an agent runs inside, including identity, logging, change management, and third-party controls.

ECC-2:2024 does not contain a dedicated AI governance or AI auditability control. Its AI-related references are contextual, appearing in the Executive Summary, or refer to the Saudi Data and AI Authority by institutional name in a data-privacy control update. It should not be read as regulating AI agent behaviour.

nca.gov.sa

NCAConsultation draft, not binding

AI Cybersecurity Guidelines

Status and scope

No finalised version or effective date published on NCA's own site as of our last check. Treat as a consultation-stage instrument, not a current legal requirement.

NCA opened public consultation on 5 July 2026 and the consultation closed on 5 August 2026. The guidelines are structured around four domains: cybersecurity governance, cybersecurity defence, cybersecurity resilience, and third-party cybersecurity. NCA's announcement states the scope includes generative AI and agentic AI.

We do not cite a document number for these guidelines because we could not confirm one on NCA's own official pages. Nothing here should be planned against as a binding obligation until NCA publishes a final version.

nca.gov.sa

Gateplex is not a certification and no Saudi regulator names it. Where these instruments call for systems that are not black boxes and can be audited, Gateplex contributes deterministic policy evaluation, per-action records of the rule that applied, and a hash chained evidence trail that supports independent review.

auditor verification notice

On sample reports

We do not publish a downloadable sample audit report. Reports are generated from real intercept data in your own environment, and a synthetic example would not represent what you receive. The fastest way to see the real output is a Shadow Compliance Audit against your own agent traffic.

Request a Shadow Audit Enterprise and VPC deployment