Ephorian
Open the demo

Rules we cover.

One set of checks, mapped to every rulebook below. Adding a rulebook is a data change, not a rebuild — which is why this page is generated from what the product actually runs on rather than typed into a slide.

5 rulebooks · 23 of 23 checks are pointed at by at least one clause.

Bank of England SS1/23 — Model Risk Management Principles

UK · 2023, effective May 2024 · 5 clauses mapped

  • Principle 1

    Model identification and model risk classification

    • It is on the company-wide list
    • A risk level is set and signed off
  • Principle 2

    Governance

    • One named person owns it
    • Someone is making sure people use it
  • Principle 3

    Model development, implementation and use

    • It is written down how it works
    • Targets were agreed before anyone built it
  • Principle 4

    Independent model validation

    • Someone outside the team checked it
    • Someone checked it is fair
  • Principle 5

    Model risk mitigants

    • Something watches for it getting worse
    • There is a tested off switch, and someone can pull it
    • A person is built into how it works

Digital Operational Resilience Act

EU · Regulation (EU) 2022/2554, applicable January 2025 · 7 clauses mapped

  • Art. 10

    Detection

    • Something watches for it getting worse
    • Everything it does is recorded
  • Art. 11

    Response and recovery

    • There is a tested off switch, and someone can pull it
    • You know how you would leave the supplier
  • Art. 17

    ICT-related incident management process

    • There is a plan to watch it once live
    • Everything it does is recorded
  • Art. 28

    General principles for ICT third-party risk

    • The supplier was checked out
  • Art. 30

    Key contractual provisions and exit strategies

    • You know how you would leave the supplier
    • The supplier was checked out
  • Art. 5

    ICT internal governance and control framework

    • One named person owns it
    • It is on the company-wide list
  • Art. 8

    Identification of ICT-supported functions and assets

    • It is on the company-wide list
    • It is written down how it works

EU Artificial Intelligence Act

EU · Regulation (EU) 2024/1689 · 14 clauses mapped

  • Art. 10

    Data and data governance

    • Data is clean, in the right country, and not kept forever
    • Someone checked it is fair
  • Art. 11

    Technical documentation

    • It is written down how it works
  • Art. 12

    Record-keeping

    • Everything it does is recorded
  • Art. 14

    Human oversight

    • A person is built into how it works
    • There is a tested off switch, and someone can pull it
  • Art. 15

    Accuracy, robustness and cybersecurity

    • Targets were agreed before anyone built it
    • Something watches for it getting worse
  • Art. 26

    Obligations of deployers

    • A person is built into how it works
    • One named person owns it
  • Art. 27

    Fundamental rights impact assessment for deployers

    • A check on how it affects people's rights
  • Art. 43

    Conformity assessment

    • The formal legal check is done
  • Art. 49

    Registration

    • Listed on the EU register
  • Art. 50

    Transparency obligations

    • People are told AI is involved
  • Art. 6 / Annex III

    Classification of high-risk AI systems

    • A risk level is set and signed off
  • Art. 72

    Post-market monitoring

    • There is a plan to watch it once live
    • Something watches for it getting worse
  • Art. 86

    Right to explanation of individual decision-making

    • You can explain a decision to the person it hit
  • Art. 9

    Risk management system

    • A risk level is set and signed off
    • There is a plan to watch it once live

ISO/IEC 42001 — AI Management System

International · 2023 · 5 clauses mapped

  • 6.1.2

    AI risk assessment

    • A risk level is set and signed off
  • 6.1.4

    AI system impact assessment

    • A privacy check is done
    • Someone checked it is fair
  • 8.1

    Operational planning and control

    • One named person owns it
    • It is written down how it works
  • 9.1

    Monitoring, measurement, analysis and evaluation

    • Something watches for it getting worse
    • Targets were agreed before anyone built it
    • Something checks the work before a person does
  • A.10.2

    Allocation of responsibilities with suppliers

    • The supplier was checked out
    • You know how you would leave the supplier

NIST AI Risk Management Framework

US (voluntary) · AI RMF 1.0, January 2023 · 9 clauses mapped

  • GOVERN 1.1

    Legal and regulatory requirements are understood and managed

    • A risk level is set and signed off
    • Listed on the EU register
  • GOVERN 2.1

    Roles and responsibilities are documented

    • One named person owns it
  • GOVERN 6.1

    Third-party risk policies

    • The supplier was checked out
    • You know how you would leave the supplier
  • MANAGE 2.4

    Mechanisms to deactivate the system

    • There is a tested off switch, and someone can pull it
    • A person is built into how it works
  • MANAGE 4.1

    Post-deployment monitoring

    • There is a plan to watch it once live
    • Something watches for it getting worse
  • MAP 1.1

    Context is established and understood

    • It is written down how it works
    • A risk level is set and signed off
  • MAP 5.1

    Likelihood and magnitude of impact

    • A privacy check is done
    • Someone checked it is fair
  • MEASURE 2.11

    Fairness and bias are evaluated

    • Someone checked it is fair
    • Data is clean, in the right country, and not kept forever
  • MEASURE 2.3

    System performance is assessed

    • Targets were agreed before anyone built it
    • Someone outside the team checked it
    • Something checks the work before a person does

Coverage means a clause points at a check this product performs. It does not mean a lawyer has confirmed the mapping, and it is not legal advice. Where a clause has nothing behind it, this page says so.